{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:SOONOOV3NNW7ADTPLZHXJQ4T7K","short_pith_number":"pith:SOONOOV3","canonical_record":{"source":{"id":"2607.07433","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-08T14:02:14Z","cross_cats_sorted":[],"title_canon_sha256":"4954cef2bc01018e61597714f5303c3b94982edc0cf9e3152f2382be8130cd5b","abstract_canon_sha256":"6fb6b4b5ec776b1f1a402046c09ea59d34d9daaea6056579eea2576ae086b0f8"},"schema_version":"1.0"},"canonical_sha256":"939cd73abb6b6df00e6f5e4f74c393fab40c40f67c8bba673e09fa6801a9df62","source":{"kind":"arxiv","id":"2607.07433","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.07433","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"arxiv_version","alias_value":"2607.07433v1","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.07433","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"pith_short_12","alias_value":"SOONOOV3NNW7","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"pith_short_16","alias_value":"SOONOOV3NNW7ADTP","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"pith_short_8","alias_value":"SOONOOV3","created_at":"2026-07-09T01:20:24Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:SOONOOV3NNW7ADTPLZHXJQ4T7K","target":"record","payload":{"canonical_record":{"source":{"id":"2607.07433","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-08T14:02:14Z","cross_cats_sorted":[],"title_canon_sha256":"4954cef2bc01018e61597714f5303c3b94982edc0cf9e3152f2382be8130cd5b","abstract_canon_sha256":"6fb6b4b5ec776b1f1a402046c09ea59d34d9daaea6056579eea2576ae086b0f8"},"schema_version":"1.0"},"canonical_sha256":"939cd73abb6b6df00e6f5e4f74c393fab40c40f67c8bba673e09fa6801a9df62","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-09T01:20:24.775766Z","signature_b64":"t4bx7aCxX0On0YtEgRYCspSiZ7vnpsq6e+6CYS9vd3TqBCLXW2rrHDavlLt/8xxDbQPwV0MUkfSIXWc8ruH+Dg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"939cd73abb6b6df00e6f5e4f74c393fab40c40f67c8bba673e09fa6801a9df62","last_reissued_at":"2026-07-09T01:20:24.775354Z","signature_status":"signed_v1","first_computed_at":"2026-07-09T01:20:24.775354Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2607.07433","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-09T01:20:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uRj3jHahCbdBx1B/2QimutZ0Qm10tZjpJbTWEcCq7VlTUnaDZqgyEE91RUdPOjzSvpELQVP7HNbIb2RxJ3bZCg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-26T01:48:51.660520Z"},"content_sha256":"4f509abb50d41a09d94d02e1deb6815732a632f5df08ad8617833c95bc5d5046","schema_version":"1.0","event_id":"sha256:4f509abb50d41a09d94d02e1deb6815732a632f5df08ad8617833c95bc5d5046"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:SOONOOV3NNW7ADTPLZHXJQ4T7K","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Avishai Wool, Aya Spira, Ben Nassi, Elad Feldman, Ron Bitton, Stav Cohen","submitted_at":"2026-07-08T14:02:14Z","abstract_excerpt":"The growing adoption of agentic LLM applications has introduced a new threat previously named as promptware. While prior work has established that adversaries can exploit direct channels to LLM applications to apply promptware under weak threat models, many applications do not provide any direct channels that could be exploited for prompt injection beyond the Internet. This raises a question: can attackers exploit LLM applications at scale without any direct channels in practical threat models? In this work, we show that the inherent tendency of LLMs to hallucinate resource identifiers can be "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.07433","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2607.07433/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-09T01:20:24Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"G7a32VcBEhKeiPOC6BoyNak0NS8N1LfpcBQzEZLd0D2SgraXDgALjU8/sz/P2N/fWdHzJBTXaCZHithdQObMDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-07-26T01:48:51.660898Z"},"content_sha256":"ed363e6099153f7a4b8970c2beadc0a3877854340c0165bfc23078e5ed16d2c0","schema_version":"1.0","event_id":"sha256:ed363e6099153f7a4b8970c2beadc0a3877854340c0165bfc23078e5ed16d2c0"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/SOONOOV3NNW7ADTPLZHXJQ4T7K/bundle.json","state_url":"https://pith.science/pith/SOONOOV3NNW7ADTPLZHXJQ4T7K/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/SOONOOV3NNW7ADTPLZHXJQ4T7K/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-07-26T01:48:51Z","links":{"resolver":"https://pith.science/pith/SOONOOV3NNW7ADTPLZHXJQ4T7K","bundle":"https://pith.science/pith/SOONOOV3NNW7ADTPLZHXJQ4T7K/bundle.json","state":"https://pith.science/pith/SOONOOV3NNW7ADTPLZHXJQ4T7K/state.json","well_known_bundle":"https://pith.science/.well-known/pith/SOONOOV3NNW7ADTPLZHXJQ4T7K/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:SOONOOV3NNW7ADTPLZHXJQ4T7K","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"6fb6b4b5ec776b1f1a402046c09ea59d34d9daaea6056579eea2576ae086b0f8","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-08T14:02:14Z","title_canon_sha256":"4954cef2bc01018e61597714f5303c3b94982edc0cf9e3152f2382be8130cd5b"},"schema_version":"1.0","source":{"id":"2607.07433","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2607.07433","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"arxiv_version","alias_value":"2607.07433v1","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2607.07433","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"pith_short_12","alias_value":"SOONOOV3NNW7","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"pith_short_16","alias_value":"SOONOOV3NNW7ADTP","created_at":"2026-07-09T01:20:24Z"},{"alias_kind":"pith_short_8","alias_value":"SOONOOV3","created_at":"2026-07-09T01:20:24Z"}],"graph_snapshots":[{"event_id":"sha256:ed363e6099153f7a4b8970c2beadc0a3877854340c0165bfc23078e5ed16d2c0","target":"graph","created_at":"2026-07-09T01:20:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2607.07433/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The growing adoption of agentic LLM applications has introduced a new threat previously named as promptware. While prior work has established that adversaries can exploit direct channels to LLM applications to apply promptware under weak threat models, many applications do not provide any direct channels that could be exploited for prompt injection beyond the Internet. This raises a question: can attackers exploit LLM applications at scale without any direct channels in practical threat models? In this work, we show that the inherent tendency of LLMs to hallucinate resource identifiers can be ","authors_text":"Avishai Wool, Aya Spira, Ben Nassi, Elad Feldman, Ron Bitton, Stav Cohen","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-08T14:02:14Z","title":"Beware of Agentic Botnets: Scalable Untargeted Promptware Attacks via Universal and Transferable Adversarial HalluSquatting"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2607.07433","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:4f509abb50d41a09d94d02e1deb6815732a632f5df08ad8617833c95bc5d5046","target":"record","created_at":"2026-07-09T01:20:24Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"6fb6b4b5ec776b1f1a402046c09ea59d34d9daaea6056579eea2576ae086b0f8","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-08T14:02:14Z","title_canon_sha256":"4954cef2bc01018e61597714f5303c3b94982edc0cf9e3152f2382be8130cd5b"},"schema_version":"1.0","source":{"id":"2607.07433","kind":"arxiv","version":1}},"canonical_sha256":"939cd73abb6b6df00e6f5e4f74c393fab40c40f67c8bba673e09fa6801a9df62","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"939cd73abb6b6df00e6f5e4f74c393fab40c40f67c8bba673e09fa6801a9df62","first_computed_at":"2026-07-09T01:20:24.775354Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-09T01:20:24.775354Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"t4bx7aCxX0On0YtEgRYCspSiZ7vnpsq6e+6CYS9vd3TqBCLXW2rrHDavlLt/8xxDbQPwV0MUkfSIXWc8ruH+Dg==","signature_status":"signed_v1","signed_at":"2026-07-09T01:20:24.775766Z","signed_message":"canonical_sha256_bytes"},"source_id":"2607.07433","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:4f509abb50d41a09d94d02e1deb6815732a632f5df08ad8617833c95bc5d5046","sha256:ed363e6099153f7a4b8970c2beadc0a3877854340c0165bfc23078e5ed16d2c0"],"state_sha256":"1262d311c7708061e15d077079d8cf37a8819b14b709268800d50ed526cd0566"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"R+lKNIvxhbSXmqt1146ByMFC13x9nDF11+66MYdiAF0rJ7iJRJyQbnCa8CASdS7+RgnMeE/1++CyVfmBKT4/AQ==","signed_message":"bundle_sha256_bytes","signed_at":"2026-07-26T01:48:51.663068Z","bundle_sha256":"c505edadab3c3a295ae7b2fc04db6eba9b0e042cf36e65eac3a6a233aafa993e"}}