{"total":228,"rows":[{"id":"2309.07864","title":"The Rise and Potential of Large Language Model Based Agents: A Survey","created":"2023-09-14","cited_by_count":1439,"area":"agents"},{"id":"2403.02691","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","created":"2024-03-05","cited_by_count":538,"area":"agents"},{"id":"2410.02644","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","created":"2024-10-03","cited_by_count":369,"area":"agents"},{"id":"2304.08354","title":"Tool Learning with Foundation Models","created":"2023-04-17","cited_by_count":302,"area":"agents"},{"id":"2503.18813","title":"Defeating Prompt Injections by Design","created":"2025-03-24","cited_by_count":297,"area":"agents"},{"id":"2401.05459","title":"Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Security","created":"2024-01-10","cited_by_count":260,"area":"agents"},{"id":"2404.18231","title":"From Persona to Personalization: A Survey on Role-Playing Language Agents","created":"2024-04-28","cited_by_count":212,"area":"agents"},{"id":"2504.19793","title":"Prompt Injection Attack to Tool Selection in LLM Agents","created":"2025-04-28","cited_by_count":158,"area":"agents"},{"id":"2409.11295","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","created":"2024-09-17","cited_by_count":150,"area":"agents"},{"id":"2406.13352","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","created":"2024-06-19","cited_by_count":145,"area":"agents"},{"id":"2410.07283","title":"Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems","created":"2024-10-09","cited_by_count":133,"area":"agents"},{"id":"2507.15219","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","created":"2025-07-21","cited_by_count":108,"area":"agents"},{"id":"2311.11855","title":"Evil Geniuses: Delving into the Safety of LLM-based Agents","created":"2023-11-20","cited_by_count":106,"area":"agents"},{"id":"2502.13172","title":"Unveiling Privacy Risks in LLM Agent Memory","created":"2025-02-17","cited_by_count":101,"area":"agents"},{"id":"2412.16682","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","created":"2024-12-21","cited_by_count":99,"area":"agents"},{"id":"2602.20156","title":"Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks","created":"2026-02-23","cited_by_count":90,"area":"agents"},{"id":"2502.05174","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","created":"2025-02-07","cited_by_count":77,"area":"agents"},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73,"area":"agents"},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66,"area":"agents"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2502.11127","title":"G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems","created":"2025-02-16","cited_by_count":59,"area":"agents"},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2508.15310","title":"IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents","created":"2025-08-21","cited_by_count":54,"area":"agents"},{"id":"2503.12188","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","created":"2025-03-15","cited_by_count":53,"area":"agents"},{"id":"2402.16965","title":"WIPI: A New Web Threat for LLM-Driven Web Agents","created":"2024-02-26","cited_by_count":51,"area":"agents"},{"id":"2602.06547","title":"\"Do Not Mention This to the User\": Detecting and Understanding Malicious Agent Skills in the Wild","created":"2026-02-06","cited_by_count":50,"area":"agents"},{"id":"2506.02456","title":"VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents","created":"2025-06-03","cited_by_count":45,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2502.01822","title":"Firewalls to Secure Dynamic LLM Agentic Networks","created":"2025-02-03","cited_by_count":36,"area":"agents"},{"id":"2606.04329","title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents","created":"2026-06-03","cited_by_count":33,"area":"agents"},{"id":"2504.14064","title":"DoomArena: A framework for Testing AI Agents Against Evolving Security Threats","created":"2025-04-18","cited_by_count":32,"area":"agents"},{"id":"2404.04442","title":"Exploring Autonomous Agents through the Lens of Large Language Models: A Review","created":"2024-04-05","cited_by_count":31,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2506.23844","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","created":"2025-06-30","cited_by_count":29,"area":"agents"},{"id":"2312.14302","title":"Exploiting Novel GPT-4 APIs","created":"2023-12-21","cited_by_count":28,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","created":"2026-05-14","cited_by_count":27,"area":"agents"},{"id":"2406.08689","title":"Security of AI Agents","created":"2024-06-12","cited_by_count":26,"area":"agents"},{"id":"2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","created":"2026-04-03","cited_by_count":24,"area":"agents"},{"id":"2402.10196","title":"A Trembling House of Cards? Mapping Adversarial Attacks against Language Agents","created":"2024-02-15","cited_by_count":22,"area":"agents"},{"id":"2410.16950","title":"Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In","created":"2024-10-22","cited_by_count":22,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2601.17549","title":"Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents","created":"2026-01-24","cited_by_count":19,"area":"agents"},{"id":"2505.18135","title":"Tool Preferences in Agentic LLMs are Unreliable","created":"2025-05-23","cited_by_count":18,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2506.15253","title":"RAS-Eval: A Comprehensive Benchmark for Security Evaluation of LLM Agents in Real-World Environments","created":"2025-06-18","cited_by_count":17,"area":"agents"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2505.12567","title":"A Survey of Attacks on Large Language Models","created":"2025-05-18","cited_by_count":15,"area":"agents"},{"id":"2506.05739","title":"To Protect the LLM Agent Against the Prompt Injection Attack with Polymorphic Prompt","created":"2025-06-06","cited_by_count":15,"area":"agents"},{"id":"2604.23374","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","created":"2026-04-25","cited_by_count":15,"area":"agents"},{"id":"2602.07918","title":"CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution","created":"2026-02-08","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2412.05734","title":"LeakAgent: RL-based Red-teaming Agent for LLM Privacy Leakage","created":"2024-12-07","cited_by_count":13,"area":"agents"},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13,"area":"agents"},{"id":"2604.02837","title":"Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis","created":"2026-04-03","cited_by_count":13,"area":"agents"},{"id":"2506.17318","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2507.05445","title":"A Systematization of Security Vulnerabilities in Computer Use Agents","created":"2025-07-07","cited_by_count":11,"area":"agents"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2505.21499","title":"AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Delivery","created":"2025-05-27","cited_by_count":10,"area":"agents"},{"id":"2512.08417","title":"Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs","created":"2025-12-09","cited_by_count":10,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10,"area":"agents"},{"id":"2607.06000","title":"Context-to-Execution Integrity for LLM Agents","created":"2026-07-07","cited_by_count":10,"area":"agents"},{"id":"2506.07524","title":"TAI3: Testing Agent Integrity in Interpreting User Intent","created":"2025-06-09","cited_by_count":9,"area":"agents"},{"id":"2509.13597","title":"Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents","created":"2025-09-16","cited_by_count":9,"area":"agents"},{"id":"2509.25926","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","created":"2025-09-30","cited_by_count":9,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2602.13477","title":"OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage","created":"2026-02-13","cited_by_count":9,"area":"agents"},{"id":"2603.19423","title":"The Autonomy Tax: Defense Training Breaks LLM Agents","created":"2026-03-19","cited_by_count":9,"area":"agents"},{"id":"2505.12442","title":"IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems","created":"2025-05-18","cited_by_count":8,"area":"agents"},{"id":"2507.09329","title":"When Developer Aid Becomes Security Debt: A Systematic Analysis of Insecure Behaviors in LLM Coding Agents","created":"2025-07-12","cited_by_count":8,"area":"agents"},{"id":"2510.01359","title":"Breaking the Code: Security Assessment of AI Code Agents Through Systematic Jailbreaking Attacks","created":"2025-10-01","cited_by_count":7,"area":"agents"},{"id":"2601.07263","title":"When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent","created":"2026-01-12","cited_by_count":7,"area":"agents"},{"id":"2602.10498","title":"When Skills Lie: Hidden-Comment Injection in LLM Agents","created":"2026-02-11","cited_by_count":7,"area":"agents"},{"id":"2606.07943","title":"Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents","created":"2026-06-06","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2504.09841","title":"StruPhantom: Evolutionary Injection Attacks on Black-Box Tabular Agents Powered by Large Language Models","created":"2025-04-14","cited_by_count":6,"area":"agents"},{"id":"2509.24240","title":"Takedown: How It's Done in Modern Coding Agent Exploits","created":"2025-09-29","cited_by_count":6,"area":"agents"},{"id":"2512.05951","title":"Trusted AI Agents in the Cloud","created":"2025-12-05","cited_by_count":6,"area":"agents"},{"id":"2602.16958","title":"Automating Agent Hijacking via Structural Template Injection","created":"2026-02-18","cited_by_count":6,"area":"agents"},{"id":"2603.00476","title":"Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents","created":"2026-02-28","cited_by_count":6,"area":"agents"},{"id":"2604.24118","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","created":"2026-04-27","cited_by_count":6,"area":"agents"},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5,"area":"agents"},{"id":"2510.07505","title":"PEAR: Planner-Executor Agent Robustness Benchmark","created":"2025-10-08","cited_by_count":5,"area":"agents"},{"id":"2510.13825","title":"A2AS: Agentic AI Runtime Security and Self-Defense","created":"2025-10-08","cited_by_count":5,"area":"agents"},{"id":"2604.18874","title":"How Adversarial Environments Mislead Agentic AI?","created":"2026-04-20","cited_by_count":5,"area":"agents"},{"id":"2605.13044","title":"No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills","created":"2026-05-13","cited_by_count":5,"area":"agents"},{"id":"2606.14154","title":"SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills","created":"2026-06-12","cited_by_count":5,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2502.16750","title":"Guardians of the Agentic System: Preventing Many Shots Jailbreak with Agentic System","created":"2025-02-23","cited_by_count":4,"area":"agents"},{"id":"2509.23694","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2602.10465","title":"Authenticated Workflows: A Systems Approach to Protecting Agentic AI","created":"2026-02-11","cited_by_count":4,"area":"agents"},{"id":"2603.13940","title":"GroupGuard: A Framework for Modeling and Defending Collusive Attacks in Multi-Agent Systems","created":"2026-03-14","cited_by_count":4,"area":"agents"},{"id":"2604.03870","title":"Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs","created":"2026-04-04","cited_by_count":4,"area":"agents"},{"id":"2604.10134","title":"PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification","created":"2026-04-11","cited_by_count":4,"area":"agents"}],"next_cursor":"100"}