{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:MF5NS7K2O3N5WLPCT5NHLSGZBN","short_pith_number":"pith:MF5NS7K2","canonical_record":{"source":{"id":"2607.23444","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","cross_cats_sorted":[],"title_canon_sha256":"c9cae3361c1b592788941c21e6f33a8facedfafcbd2b390fce75ce2d21aca000","abstract_canon_sha256":"50676d3c0a812d7829a9426fce7a12295b792ee81e1d9bdd6d9f4c9ac53f4920"},"schema_version":"1.0"},"canonical_sha256":"617ad97d5a76dbdb2de29f5a75c8d90b46d1ac5c2209ab9d843fce00202435a2","source":{"kind":"arxiv","id":"2607.23444","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.23444","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"arxiv_version","alias_value":"2607.23444v1","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.23444","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_12","alias_value":"MF5NS7K2O3N5","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_16","alias_value":"MF5NS7K2O3N5WLPC","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_8","alias_value":"MF5NS7K2","created_at":"2026-07-28T01:22:53Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:MF5NS7K2O3N5WLPCT5NHLSGZBN","target":"record","payload":{"canonical_record":{"source":{"id":"2607.23444","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","cross_cats_sorted":[],"title_canon_sha256":"c9cae3361c1b592788941c21e6f33a8facedfafcbd2b390fce75ce2d21aca000","abstract_canon_sha256":"50676d3c0a812d7829a9426fce7a12295b792ee81e1d9bdd6d9f4c9ac53f4920"},"schema_version":"1.0"},"canonical_sha256":"617ad97d5a76dbdb2de29f5a75c8d90b46d1ac5c2209ab9d843fce00202435a2","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-28T01:22:53.126128Z","signature_b64":"DP1snJXT5mMIbhNzGbtrMK0WuVmxEgckhRgXS0I09DZCq5+aoGrTUqvMdExrJOcQdB/sY/RBc22ss0GAX9eSAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"617ad97d5a76dbdb2de29f5a75c8d90b46d1ac5c2209ab9d843fce00202435a2","last_reissued_at":"2026-07-28T01:22:53.125324Z","signature_status":"signed_v1","first_computed_at":"2026-07-28T01:22:53.125324Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.23444","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-28T01:22:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jgVKF2OrdpVXmHNxrE3vytVb9b8SrjQtNDDYzmJ9W14VfN/RNjfsBu/INjpWq68i8/0TwRVRcF87/2NJommEAA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T05:32:54.963899Z"},"content_sha256":"b420ec915813347f27ff24dd29323f8191742f5a8f304b01d804150e7f0e70ab","schema_version":"1.0","event_id":"sha256:b420ec915813347f27ff24dd29323f8191742f5a8f304b01d804150e7f0e70ab"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:MF5NS7K2O3N5WLPCT5NHLSGZBN","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Chuanchao Zang, Jianing Wang, Li Wang, Shanqing Guo, Wenyu Chen, Xiangtao Meng, Xinyu Gao, Zheng Li","submitted_at":"2026-07-26T03:51:20Z","abstract_excerpt":"LLM-based agents extend large language models with long-term memory (LTM) that persists privacy-sensitive user data across sessions. Production systems mitigate extraction risks through memory isolation, binding each user's LTM to a unique identifier. This defense has blocked known attacks on shared storage, fostering the assumption that isolated LTM is secure. We identify the tool interface as an overlooked attack surface. Agents routinely embed LTM-retrieved data in tool invocation parameters, enabling a malicious tool to exfiltrate private memory without violating user-level isolation. Naiv"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.23444","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.23444/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-28T01:22:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"2qkMiFDPmBiXLZc3qWRuVsFByJ4ceCZgXpb0B2wpWkpBoF7IXTDxF3OylPUTtvzWLtuw9cZY3yejz+cxtSWlAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T05:32:54.964783Z"},"content_sha256":"23ee70af6c91024ce6a2ede90dac271151912774704685ef1bf4340240d39c04","schema_version":"1.0","event_id":"sha256:23ee70af6c91024ce6a2ede90dac271151912774704685ef1bf4340240d39c04"},{"event_type":"integrity_finding","subject_pith_number":"pith:2026:MF5NS7K2O3N5WLPCT5NHLSGZBN","target":"integrity","payload":{"note":"DOI in the printed bibliography is fragmented by whitespace or line breaks. A longer candidate (10.1007/s11704-024-40231-1) was visible in the surrounding text but could not be confirmed against doi.org as printed.","snippet":"Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, Wayne Xin Zhao, Zhewei Wei, and Jirong Wen. A survey on large language model based au- tonomous agents.Frontiers of Comput","arxiv_id":"2607.23444","detector":"doi_compliance","evidence":{"ref_index":30,"verdict_class":"incontrovertible","resolved_title":null,"printed_excerpt":"10.1007/s11704-","reconstructed_doi":"10.1007/s11704-024-40231-1"},"severity":"advisory","ref_index":30,"audited_at":"2026-07-30T22:11:43.932766Z","event_type":"pith.integrity.v1","detected_doi":"10.1007/s11704-024-40231-1","detector_url":"https://pith.science/pith-integrity-protocol#doi_compliance","external_url":null,"finding_type":"recoverable_identifier","evidence_hash":"d88bb27f11fd7469b1bba2c1624f1d13d53090349f5163c1a74d8fa8865f94d6","paper_version":1,"verdict_class":"incontrovertible","resolved_title":null,"detector_version":"1.1.0","detected_arxiv_id":null,"integrity_event_id":14107,"payload_sha256":"b3a0226a76bf0306e72cdd096c85adfd7574816b2fcf0c3946aa98ea8f6dd24f","signature_b64":null,"signing_key_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-30T22:16:15Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"U56MdXQYoDNkSXysdIpIfFIHpnSPQyfJCAA/pK2FN/gYGwJ0jmdJfrbaESXVCQBHaiq/fmb4DtH1Zj7c9/LWAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-04T05:32:54.970270Z"},"content_sha256":"6261fc9266d0c9e4458fee3f6ba330fa9f3a6a677ff3dd572baecbb6bdc3c5c0","schema_version":"1.0","event_id":"sha256:6261fc9266d0c9e4458fee3f6ba330fa9f3a6a677ff3dd572baecbb6bdc3c5c0"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/MF5NS7K2O3N5WLPCT5NHLSGZBN/bundle.json","state_url":"https://pith.science/pith/MF5NS7K2O3N5WLPCT5NHLSGZBN/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/MF5NS7K2O3N5WLPCT5NHLSGZBN/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-04T05:32:54Z","links":{"resolver":"https://pith.science/pith/MF5NS7K2O3N5WLPCT5NHLSGZBN","bundle":"https://pith.science/pith/MF5NS7K2O3N5WLPCT5NHLSGZBN/bundle.json","state":"https://pith.science/pith/MF5NS7K2O3N5WLPCT5NHLSGZBN/state.json","well_known_bundle":"https://pith.science/.well-known/pith/MF5NS7K2O3N5WLPCT5NHLSGZBN/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:MF5NS7K2O3N5WLPCT5NHLSGZBN","merge_version":"pith-open-graph-merge-v1","event_count":3,"valid_event_count":3,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"50676d3c0a812d7829a9426fce7a12295b792ee81e1d9bdd6d9f4c9ac53f4920","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","title_canon_sha256":"c9cae3361c1b592788941c21e6f33a8facedfafcbd2b390fce75ce2d21aca000"},"schema_version":"1.0","source":{"id":"2607.23444","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.23444","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"arxiv_version","alias_value":"2607.23444v1","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.23444","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_12","alias_value":"MF5NS7K2O3N5","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_16","alias_value":"MF5NS7K2O3N5WLPC","created_at":"2026-07-28T01:22:53Z"},{"alias_kind":"pith_short_8","alias_value":"MF5NS7K2","created_at":"2026-07-28T01:22:53Z"}],"graph_snapshots":[{"event_id":"sha256:23ee70af6c91024ce6a2ede90dac271151912774704685ef1bf4340240d39c04","target":"graph","created_at":"2026-07-28T01:22:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.23444/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"LLM-based agents extend large language models with long-term memory (LTM) that persists privacy-sensitive user data across sessions. Production systems mitigate extraction risks through memory isolation, binding each user's LTM to a unique identifier. This defense has blocked known attacks on shared storage, fostering the assumption that isolated LTM is secure. We identify the tool interface as an overlooked attack surface. Agents routinely embed LTM-retrieved data in tool invocation parameters, enabling a malicious tool to exfiltrate private memory without violating user-level isolation. Naiv","authors_text":"Chuanchao Zang, Jianing Wang, Li Wang, Shanqing Guo, Wenyu Chen, Xiangtao Meng, Xinyu Gao, Zheng Li","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","title":"Isolated but Exposed: Persistence-Based Memory Extraction Attack on LLM Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.23444","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:b420ec915813347f27ff24dd29323f8191742f5a8f304b01d804150e7f0e70ab","target":"record","created_at":"2026-07-28T01:22:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"50676d3c0a812d7829a9426fce7a12295b792ee81e1d9bdd6d9f4c9ac53f4920","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-07-26T03:51:20Z","title_canon_sha256":"c9cae3361c1b592788941c21e6f33a8facedfafcbd2b390fce75ce2d21aca000"},"schema_version":"1.0","source":{"id":"2607.23444","kind":"arxiv","version":1}},"canonical_sha256":"617ad97d5a76dbdb2de29f5a75c8d90b46d1ac5c2209ab9d843fce00202435a2","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"617ad97d5a76dbdb2de29f5a75c8d90b46d1ac5c2209ab9d843fce00202435a2","first_computed_at":"2026-07-28T01:22:53.125324Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-28T01:22:53.125324Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"DP1snJXT5mMIbhNzGbtrMK0WuVmxEgckhRgXS0I09DZCq5+aoGrTUqvMdExrJOcQdB/sY/RBc22ss0GAX9eSAA==","signature_status":"signed_v1","signed_at":"2026-07-28T01:22:53.126128Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.23444","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:b420ec915813347f27ff24dd29323f8191742f5a8f304b01d804150e7f0e70ab","sha256:23ee70af6c91024ce6a2ede90dac271151912774704685ef1bf4340240d39c04","sha256:6261fc9266d0c9e4458fee3f6ba330fa9f3a6a677ff3dd572baecbb6bdc3c5c0"],"state_sha256":"1a5e53e85e47189adf7e7ff176122cb3a145c8032d63e9ff885b20b8d1f8aa93"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"rQoG/a8vw7rXYyQvAc3XU8pQXLwOTPqjYWTFIph2eFfeT0RvoX6r36+fKz98/CB+F6GPamHwAmwpGl2et9VzAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-04T05:32:54.974150Z","bundle_sha256":"7995eb717fad924cf87caf5bf4736fc835f1b12214b076b9a32717c4466aa269"}}