{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2025:GFSTCVOALHBEHC2YXIUDHGJDQO","short_pith_number":"pith:GFSTCVOA","canonical_record":{"source":{"id":"2506.01055","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-01T15:48:06Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"f336d0bc202212495c9c365a05f352e690ec281f264138fd61fc274101642763","abstract_canon_sha256":"bf3549d23a45af39999f7583e1649286995ccf7f0b9b99db5c4a00359598232d"},"schema_version":"1.0"},"canonical_sha256":"31653155c059c2438b58ba28339923838684cbec207badbfd392b3fd403275eb","source":{"kind":"arxiv","id":"2506.01055","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.01055","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"arxiv_version","alias_value":"2506.01055v1","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.01055","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"pith_short_12","alias_value":"GFSTCVOALHBE","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"pith_short_16","alias_value":"GFSTCVOALHBEHC2Y","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"pith_short_8","alias_value":"GFSTCVOA","created_at":"2026-07-05T11:13:45Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2025:GFSTCVOALHBEHC2YXIUDHGJDQO","target":"record","payload":{"canonical_record":{"source":{"id":"2506.01055","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-01T15:48:06Z","cross_cats_sorted":["cs.CL"],"title_canon_sha256":"f336d0bc202212495c9c365a05f352e690ec281f264138fd61fc274101642763","abstract_canon_sha256":"bf3549d23a45af39999f7583e1649286995ccf7f0b9b99db5c4a00359598232d"},"schema_version":"1.0"},"canonical_sha256":"31653155c059c2438b58ba28339923838684cbec207badbfd392b3fd403275eb","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T11:13:45.220836Z","signature_b64":"praAU56SNLXJG583ilxRdMGNe//o+I61v4FsPTz22Hnckf/+pBpgDUmzKIqspS1JFhtLZ+CNh3jgPvJMGkmRAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"31653155c059c2438b58ba28339923838684cbec207badbfd392b3fd403275eb","last_reissued_at":"2026-07-05T11:13:45.220366Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T11:13:45.220366Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2506.01055","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:13:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Ub6SPnBjbomC4ZrW5AxiJEQOQPkvELQ2hQc77zZYxGDKOS7rqaTGPDlWeJOAXJoSPWH6hul/jIepAXZ+CiqkAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T09:29:45.444482Z"},"content_sha256":"b9e50aa8e67570cb047d1a90c5dd1a1f4046fbc08e50b7f070a99f027e732051","schema_version":"1.0","event_id":"sha256:b9e50aa8e67570cb047d1a90c5dd1a1f4046fbc08e50b7f070a99f027e732051"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2025:GFSTCVOALHBEHC2YXIUDHGJDQO","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CL"],"primary_cat":"cs.CR","authors_text":"Daria Stetsenko, Fabrizio Gilardi, Meysam Alizadeh, Zeynab Samei","submitted_at":"2025-06-01T15:48:06Z","abstract_excerpt":"Previous benchmarks on prompt injection in large language models (LLMs) have primarily focused on generic tasks and attacks, offering limited insights into more complex threats like data exfiltration. This paper examines how prompt injection can cause tool-calling agents to leak personal data observed during task execution. Using a fictitious banking agent, we develop data flow-based attacks and integrate them into AgentDojo, a recent benchmark for agentic security. To enhance its scope, we also create a richer synthetic dataset of human-AI banking conversations. In 16 user tasks from AgentDoj"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.01055","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2506.01055/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T11:13:45Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"Y8XP7fzWIhOEpG2C+IJTdnwYVetynQDv5wt3xaUErfvZGBvnwcecISv3ldN/MkBkH8SHk3TrlhHodr7JB2e3Ag==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T09:29:45.444989Z"},"content_sha256":"1031c2682d3d120d2a56e41399bff2ec22dd41a55986f8fe4ccf61d3d9d1902b","schema_version":"1.0","event_id":"sha256:1031c2682d3d120d2a56e41399bff2ec22dd41a55986f8fe4ccf61d3d9d1902b"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/GFSTCVOALHBEHC2YXIUDHGJDQO/bundle.json","state_url":"https://pith.science/pith/GFSTCVOALHBEHC2YXIUDHGJDQO/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/GFSTCVOALHBEHC2YXIUDHGJDQO/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-03T09:29:45Z","links":{"resolver":"https://pith.science/pith/GFSTCVOALHBEHC2YXIUDHGJDQO","bundle":"https://pith.science/pith/GFSTCVOALHBEHC2YXIUDHGJDQO/bundle.json","state":"https://pith.science/pith/GFSTCVOALHBEHC2YXIUDHGJDQO/state.json","well_known_bundle":"https://pith.science/.well-known/pith/GFSTCVOALHBEHC2YXIUDHGJDQO/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2025:GFSTCVOALHBEHC2YXIUDHGJDQO","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"bf3549d23a45af39999f7583e1649286995ccf7f0b9b99db5c4a00359598232d","cross_cats_sorted":["cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-01T15:48:06Z","title_canon_sha256":"f336d0bc202212495c9c365a05f352e690ec281f264138fd61fc274101642763"},"schema_version":"1.0","source":{"id":"2506.01055","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2506.01055","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"arxiv_version","alias_value":"2506.01055v1","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2506.01055","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"pith_short_12","alias_value":"GFSTCVOALHBE","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"pith_short_16","alias_value":"GFSTCVOALHBEHC2Y","created_at":"2026-07-05T11:13:45Z"},{"alias_kind":"pith_short_8","alias_value":"GFSTCVOA","created_at":"2026-07-05T11:13:45Z"}],"graph_snapshots":[{"event_id":"sha256:1031c2682d3d120d2a56e41399bff2ec22dd41a55986f8fe4ccf61d3d9d1902b","target":"graph","created_at":"2026-07-05T11:13:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2506.01055/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Previous benchmarks on prompt injection in large language models (LLMs) have primarily focused on generic tasks and attacks, offering limited insights into more complex threats like data exfiltration. This paper examines how prompt injection can cause tool-calling agents to leak personal data observed during task execution. Using a fictitious banking agent, we develop data flow-based attacks and integrate them into AgentDojo, a recent benchmark for agentic security. To enhance its scope, we also create a richer synthetic dataset of human-AI banking conversations. In 16 user tasks from AgentDoj","authors_text":"Daria Stetsenko, Fabrizio Gilardi, Meysam Alizadeh, Zeynab Samei","cross_cats":["cs.CL"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2506.01055","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b9e50aa8e67570cb047d1a90c5dd1a1f4046fbc08e50b7f070a99f027e732051","target":"record","created_at":"2026-07-05T11:13:45Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"bf3549d23a45af39999f7583e1649286995ccf7f0b9b99db5c4a00359598232d","cross_cats_sorted":["cs.CL"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-06-01T15:48:06Z","title_canon_sha256":"f336d0bc202212495c9c365a05f352e690ec281f264138fd61fc274101642763"},"schema_version":"1.0","source":{"id":"2506.01055","kind":"arxiv","version":1}},"canonical_sha256":"31653155c059c2438b58ba28339923838684cbec207badbfd392b3fd403275eb","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"31653155c059c2438b58ba28339923838684cbec207badbfd392b3fd403275eb","first_computed_at":"2026-07-05T11:13:45.220366Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T11:13:45.220366Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"praAU56SNLXJG583ilxRdMGNe//o+I61v4FsPTz22Hnckf/+pBpgDUmzKIqspS1JFhtLZ+CNh3jgPvJMGkmRAA==","signature_status":"signed_v1","signed_at":"2026-07-05T11:13:45.220836Z","signed_message":"canonical_sha256_bytes"},"source_id":"2506.01055","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b9e50aa8e67570cb047d1a90c5dd1a1f4046fbc08e50b7f070a99f027e732051","sha256:1031c2682d3d120d2a56e41399bff2ec22dd41a55986f8fe4ccf61d3d9d1902b"],"state_sha256":"44ab3788f62335980e91a6e97794542fbc1fa2718e5afdd1a7592f65f0adb168"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"0X5mLv6HnFm4JrpjwSiuSrYHJZ0aHsxQAK6RyPt/T1mgKCEvPoujfrFhMb0h7vYrzstV/D4GbiPnL7c8bvBaAQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-03T09:29:45.448120Z","bundle_sha256":"7e61accb48840aa1c32df161e272903a926ded367ebcc61b5716072ceb176639"}}