{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2024:EU2IPK3GB5VFPC56HWKR7WQHOF","short_pith_number":"pith:EU2IPK3G","schema_version":"1.0","canonical_sha256":"253487ab660f6a578bbe3d951fda07714cb6cf374634686345d1bbcb5c460d76","source":{"kind":"arxiv","id":"2410.14923","version":2},"attestation_state":"computed","paper":{"title":"Imprompter: Tricking LLM Agents into Improper Tool Use","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Earlence Fernandes, Rajesh K. Gupta, Shuheng Li, Taylor Berg-Kirkpatrick, Xiaohan Fu, Yihao Liu, Zihan Wang","submitted_at":"2024-10-19T01:00:57Z","abstract_excerpt":"Large Language Model (LLM) Agents are an emerging computing paradigm that blends generative machine learning with tools such as code interpreters, web browsing, email, and more generally, external resources. These agent-based systems represent an emerging shift in personal computing. We contribute to the security foundations of agent-based systems and surface a new class of automatically computed obfuscated adversarial prompt attacks that violate the confidentiality and integrity of user resources connected to an LLM agent. We show how prompt optimization techniques can find such prompts autom"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2410.14923","kind":"arxiv","version":2},"metadata":{"license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","primary_cat":"cs.CR","submitted_at":"2024-10-19T01:00:57Z","cross_cats_sorted":[],"title_canon_sha256":"7dfadf6bd6f0aa24d62c0dd709a37c3571449b415eace6fd22481b5cf3c24222","abstract_canon_sha256":"4a34836172b63f13c21dbf045426079c3905d93f09db4c5416b1e972bd6cf9d9"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T09:24:00.928091Z","signature_b64":"9EThMQ8eEC/31pUSbFrIq9138jmTHksPFOOMD7XqkCAwgwtCNYoqRWmZU5rh5h3iBcADwoPcAdlQVNMdHv0zBg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"253487ab660f6a578bbe3d951fda07714cb6cf374634686345d1bbcb5c460d76","last_reissued_at":"2026-07-05T09:24:00.927599Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T09:24:00.927599Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Imprompter: Tricking LLM Agents into Improper Tool Use","license":"http://creativecommons.org/licenses/by-nc-sa/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Earlence Fernandes, Rajesh K. Gupta, Shuheng Li, Taylor Berg-Kirkpatrick, Xiaohan Fu, Yihao Liu, Zihan Wang","submitted_at":"2024-10-19T01:00:57Z","abstract_excerpt":"Large Language Model (LLM) Agents are an emerging computing paradigm that blends generative machine learning with tools such as code interpreters, web browsing, email, and more generally, external resources. These agent-based systems represent an emerging shift in personal computing. We contribute to the security foundations of agent-based systems and surface a new class of automatically computed obfuscated adversarial prompt attacks that violate the confidentiality and integrity of user resources connected to an LLM agent. We show how prompt optimization techniques can find such prompts autom"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2410.14923","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2410.14923/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2410.14923","created_at":"2026-07-05T09:24:00.927671+00:00"},{"alias_kind":"arxiv_version","alias_value":"2410.14923v2","created_at":"2026-07-05T09:24:00.927671+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2410.14923","created_at":"2026-07-05T09:24:00.927671+00:00"},{"alias_kind":"pith_short_12","alias_value":"EU2IPK3GB5VF","created_at":"2026-07-05T09:24:00.927671+00:00"},{"alias_kind":"pith_short_16","alias_value":"EU2IPK3GB5VFPC56","created_at":"2026-07-05T09:24:00.927671+00:00"},{"alias_kind":"pith_short_8","alias_value":"EU2IPK3G","created_at":"2026-07-05T09:24:00.927671+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":15,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2606.15057","citing_title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","ref_index":42,"is_internal_anchor":false},{"citing_arxiv_id":"2606.12474","citing_title":"SAIGuard: Communication-State Simulation for Proactive Defense of LLM Multi-Agent Systems","ref_index":17,"is_internal_anchor":false},{"citing_arxiv_id":"2606.10525","citing_title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","ref_index":14,"is_internal_anchor":false},{"citing_arxiv_id":"2605.15030","citing_title":"WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections","ref_index":21,"is_internal_anchor":false},{"citing_arxiv_id":"2606.00497","citing_title":"\"I Strongly Suspect This Website Is a Scam\": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents","ref_index":127,"is_internal_anchor":false},{"citing_arxiv_id":"2605.22643","citing_title":"Boiling the Frog: A Multi-Turn Benchmark for Agentic Safety","ref_index":30,"is_internal_anchor":false},{"citing_arxiv_id":"2605.22643","citing_title":"Boiling the Frog: A Multi-Turn Benchmark for Agentic Safety","ref_index":30,"is_internal_anchor":false},{"citing_arxiv_id":"2506.20911","citing_title":"FaSTA$^*$: Fast-Slow Toolpath Agent with Subroutine Mining for Efficient Multi-turn Image Editing","ref_index":5,"is_internal_anchor":false},{"citing_arxiv_id":"2510.21236","citing_title":"AgentBound: Securing Execution Boundaries of AI Agents","ref_index":14,"is_internal_anchor":false},{"citing_arxiv_id":"2510.23883","citing_title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","ref_index":45,"is_internal_anchor":false},{"citing_arxiv_id":"2601.18842","citing_title":"GUIGuard-Bench: Toward a General Evaluation for Privacy-Preserving GUI Agents","ref_index":56,"is_internal_anchor":false},{"citing_arxiv_id":"2602.11327","citing_title":"Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP","ref_index":71,"is_internal_anchor":false},{"citing_arxiv_id":"2604.03070","citing_title":"How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study","ref_index":18,"is_internal_anchor":false},{"citing_arxiv_id":"2503.23278","citing_title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","ref_index":26,"is_internal_anchor":false},{"citing_arxiv_id":"2604.15415","citing_title":"HarmfulSkillBench: How Do Harmful Skills Weaponize Your Agents?","ref_index":21,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF","json":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF.json","graph_json":"https://pith.science/api/pith-number/EU2IPK3GB5VFPC56HWKR7WQHOF/graph.json","events_json":"https://pith.science/api/pith-number/EU2IPK3GB5VFPC56HWKR7WQHOF/events.json","paper":"https://pith.science/paper/EU2IPK3G"},"agent_actions":{"view_html":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF","download_json":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF.json","view_paper":"https://pith.science/paper/EU2IPK3G","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2410.14923&json=true","fetch_graph":"https://pith.science/api/pith-number/EU2IPK3GB5VFPC56HWKR7WQHOF/graph.json","fetch_events":"https://pith.science/api/pith-number/EU2IPK3GB5VFPC56HWKR7WQHOF/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF/action/timestamp_anchor","attest_storage":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF/action/storage_attestation","attest_author":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF/action/author_attestation","sign_citation":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF/action/citation_signature","submit_replication":"https://pith.science/pith/EU2IPK3GB5VFPC56HWKR7WQHOF/action/replication_record"}},"created_at":"2026-07-05T09:24:00.927671+00:00","updated_at":"2026-07-05T09:24:00.927671+00:00"}