{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:ONU7D72CKUOPYUGW3GVMEIS72O","short_pith_number":"pith:ONU7D72C","canonical_record":{"source":{"id":"2607.05120","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-06T14:07:49Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"af5d392293a8c50c6f9ce1ac49673b60e07e557b8456b4b8f1cd12105339e005","abstract_canon_sha256":"3a9bf566c23bd39b57eba6771232197b77adee8ee4501ba99d248b212d2ddae3"},"schema_version":"1.0"},"canonical_sha256":"7369f1ff42551cfc50d6d9aac2225fd38865e3a0ea205add16f6028f021ceefd","source":{"kind":"arxiv","id":"2607.05120","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.05120","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"arxiv_version","alias_value":"2607.05120v1","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.05120","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"pith_short_12","alias_value":"ONU7D72CKUOP","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"pith_short_16","alias_value":"ONU7D72CKUOPYUGW","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"pith_short_8","alias_value":"ONU7D72C","created_at":"2026-07-07T03:19:16Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:ONU7D72CKUOPYUGW3GVMEIS72O","target":"record","payload":{"canonical_record":{"source":{"id":"2607.05120","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-06T14:07:49Z","cross_cats_sorted":["cs.AI"],"title_canon_sha256":"af5d392293a8c50c6f9ce1ac49673b60e07e557b8456b4b8f1cd12105339e005","abstract_canon_sha256":"3a9bf566c23bd39b57eba6771232197b77adee8ee4501ba99d248b212d2ddae3"},"schema_version":"1.0"},"canonical_sha256":"7369f1ff42551cfc50d6d9aac2225fd38865e3a0ea205add16f6028f021ceefd","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-07T03:19:16.719025Z","signature_b64":"OO18yZq2nMNr9tdDN46ggBHssyQV1qcoDZk8pZN4TUbs9FE0Es4ofjaInvUnAnGS9DumjKb7s3RcuGAjQDeSAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7369f1ff42551cfc50d6d9aac2225fd38865e3a0ea205add16f6028f021ceefd","last_reissued_at":"2026-07-07T03:19:16.718591Z","signature_status":"signed_v1","first_computed_at":"2026-07-07T03:19:16.718591Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.05120","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T03:19:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"YpokGEKuHwMVLfMXLUyffnOD0qPDUvAXxBimzofFHg8HowESFfUM1dSuL3c4Csi5Gwfbo0EdoKp6ExBT4m88DA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T20:01:17.792219Z"},"content_sha256":"41b837ddbeb8ad9f4f8e9a2bcc7afea72e1f8d4e267a5929b6af5ab2e01a63ad","schema_version":"1.0","event_id":"sha256:41b837ddbeb8ad9f4f8e9a2bcc7afea72e1f8d4e267a5929b6af5ab2e01a63ad"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:ONU7D72CKUOPYUGW3GVMEIS72O","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.AI"],"primary_cat":"cs.CR","authors_text":"Byoungyoung Lee, Jihyeon Jeong, Juhee Kim, Luyi Xing, Taehyun Kang, Woohyuk Choi","submitted_at":"2026-07-06T14:07:49Z","abstract_excerpt":"AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection attacks (ADI). ADI injects malicious data disguised as trusted data, such as security-critical meta"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.05120","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.05120/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-07T03:19:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"MAM287m9XNuOVq2UW3K4hmik0hrjKcLFcRZTwVxu3ZcaTfPaonKilbkjzjgAovQEEf+8TxV9mXOAIaKDeOxhAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-06T20:01:17.792810Z"},"content_sha256":"357ffa8d36f9cb8c431154afa8cfc5cc6ab0a2f839650060c5e9981ecd8c9b84","schema_version":"1.0","event_id":"sha256:357ffa8d36f9cb8c431154afa8cfc5cc6ab0a2f839650060c5e9981ecd8c9b84"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/ONU7D72CKUOPYUGW3GVMEIS72O/bundle.json","state_url":"https://pith.science/pith/ONU7D72CKUOPYUGW3GVMEIS72O/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/ONU7D72CKUOPYUGW3GVMEIS72O/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-06T20:01:17Z","links":{"resolver":"https://pith.science/pith/ONU7D72CKUOPYUGW3GVMEIS72O","bundle":"https://pith.science/pith/ONU7D72CKUOPYUGW3GVMEIS72O/bundle.json","state":"https://pith.science/pith/ONU7D72CKUOPYUGW3GVMEIS72O/state.json","well_known_bundle":"https://pith.science/.well-known/pith/ONU7D72CKUOPYUGW3GVMEIS72O/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:ONU7D72CKUOPYUGW3GVMEIS72O","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"3a9bf566c23bd39b57eba6771232197b77adee8ee4501ba99d248b212d2ddae3","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-06T14:07:49Z","title_canon_sha256":"af5d392293a8c50c6f9ce1ac49673b60e07e557b8456b4b8f1cd12105339e005"},"schema_version":"1.0","source":{"id":"2607.05120","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.05120","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"arxiv_version","alias_value":"2607.05120v1","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.05120","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"pith_short_12","alias_value":"ONU7D72CKUOP","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"pith_short_16","alias_value":"ONU7D72CKUOPYUGW","created_at":"2026-07-07T03:19:16Z"},{"alias_kind":"pith_short_8","alias_value":"ONU7D72C","created_at":"2026-07-07T03:19:16Z"}],"graph_snapshots":[{"event_id":"sha256:357ffa8d36f9cb8c431154afa8cfc5cc6ab0a2f839650060c5e9981ecd8c9b84","target":"graph","created_at":"2026-07-07T03:19:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.05120/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"AI agents act on behalf of user prompts, consuming external data and taking actions based on the agent context. Prior research on AI agent security has primarily focused on indirect prompt injection (IPI). Its most well-studied category is instruction injection, where attacker-controlled untrusted data is interpreted as an instruction. In response, many mitigations have been proposed to prevent instruction injection attacks. In this paper, we introduce a new category of IPI, agent data injection attacks (ADI). ADI injects malicious data disguised as trusted data, such as security-critical meta","authors_text":"Byoungyoung Lee, Jihyeon Jeong, Juhee Kim, Luyi Xing, Taehyun Kang, Woohyuk Choi","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-06T14:07:49Z","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.05120","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:41b837ddbeb8ad9f4f8e9a2bcc7afea72e1f8d4e267a5929b6af5ab2e01a63ad","target":"record","created_at":"2026-07-07T03:19:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"3a9bf566c23bd39b57eba6771232197b77adee8ee4501ba99d248b212d2ddae3","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-06T14:07:49Z","title_canon_sha256":"af5d392293a8c50c6f9ce1ac49673b60e07e557b8456b4b8f1cd12105339e005"},"schema_version":"1.0","source":{"id":"2607.05120","kind":"arxiv","version":1}},"canonical_sha256":"7369f1ff42551cfc50d6d9aac2225fd38865e3a0ea205add16f6028f021ceefd","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7369f1ff42551cfc50d6d9aac2225fd38865e3a0ea205add16f6028f021ceefd","first_computed_at":"2026-07-07T03:19:16.718591Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-07T03:19:16.718591Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"OO18yZq2nMNr9tdDN46ggBHssyQV1qcoDZk8pZN4TUbs9FE0Es4ofjaInvUnAnGS9DumjKb7s3RcuGAjQDeSAg==","signature_status":"signed_v1","signed_at":"2026-07-07T03:19:16.719025Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.05120","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:41b837ddbeb8ad9f4f8e9a2bcc7afea72e1f8d4e267a5929b6af5ab2e01a63ad","sha256:357ffa8d36f9cb8c431154afa8cfc5cc6ab0a2f839650060c5e9981ecd8c9b84"],"state_sha256":"b634afeb34e6af97a896d21e4d5797163a7980c6b5b516eea52d8c1cdf74ad05"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"fCI40TVZA7dhB5iCrZCQs2na1CfpBK2nyHqN9j2VRMYOt0X62LCF43ODhl2XUkuag4HOd54GXnA3of4dQb2eAA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-06T20:01:17.798146Z","bundle_sha256":"2fb88e2ef57c8a7235fe94f992418e2ef28b8101fd4e0ae11a461632bc3965ce"}}