{"total":114,"rows":[{"id":"2505.03574","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","created":"2025-05-06","cited_by_count":127,"area":"agents"},{"id":"2502.11448","title":"AGrail: A Lifelong Agent Guardrail with Effective and Adaptive Safety Detection","created":"2025-02-17","cited_by_count":89,"area":"agents"},{"id":"2510.05156","title":"VeriGuard: Enhancing LLM Agent Safety via Verified Code Generation","created":"2025-10-03","cited_by_count":49,"area":"agents"},{"id":"2606.04990","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","created":"2026-06-03","cited_by_count":37,"area":"agents"},{"id":"2405.10467","title":"Agent Design Pattern Catalogue: A Collection of Architectural Patterns for Foundation Model based Agents","created":"2024-05-16","cited_by_count":35,"area":"agents"},{"id":"2508.19461","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","created":"2025-08-26","cited_by_count":31,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2602.11510","title":"AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems","created":"2026-02-12","cited_by_count":25,"area":"agents"},{"id":"2606.17573","title":"Cordon: Semantic Transactions for Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":22,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2604.07223","title":"TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories","created":"2026-04-08","cited_by_count":16,"area":"agents"},{"id":"2602.06443","title":"TrajAD: Trajectory Anomaly Detection for Trustworthy LLM Agents","created":"2026-02-06","cited_by_count":15,"area":"agents"},{"id":"2604.13630","title":"SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment","created":"2026-04-15","cited_by_count":15,"area":"agents"},{"id":"2408.02205","title":"Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agents","created":"2024-08-05","cited_by_count":14,"area":"agents"},{"id":"2504.08848","title":"X-Guard: Multilingual Guard Agent for Content Moderation","created":"2025-04-11","cited_by_count":13,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2603.11853","title":"OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents","created":"2026-03-12","cited_by_count":11,"area":"agents"},{"id":"2412.01547","title":"Improved Large Language Model Jailbreak Detection via Pretrained Embeddings","created":"2024-12-02","cited_by_count":10,"area":"agents"},{"id":"2604.05432","title":"Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use","created":"2026-04-07","cited_by_count":10,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2505.04799","title":"Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems","created":"2025-05-07","cited_by_count":8,"area":"agents"},{"id":"2603.18096","title":"A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance","created":"2026-03-18","cited_by_count":8,"area":"agents"},{"id":"2506.11083","title":"RedDebate: Safer Responses Through Multi-Agent Red Teaming Debates","created":"2025-06-04","cited_by_count":7,"area":"agents"},{"id":"2604.17562","title":"SafeAgent: A Runtime Protection Architecture for Agentic Systems","created":"2026-04-19","cited_by_count":7,"area":"agents"},{"id":"2607.01793","title":"Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification","created":"2026-07-02","cited_by_count":7,"area":"agents"},{"id":"2512.00520","title":"Toward a Safe Internet of Agents","created":"2025-11-29","cited_by_count":6,"area":"agents"},{"id":"2512.05951","title":"Trusted AI Agents in the Cloud","created":"2025-12-05","cited_by_count":6,"area":"agents"},{"id":"2606.10106","title":"What makes a harness a harness: necessary and sufficient conditions for an agent harness","created":"2026-06-08","cited_by_count":6,"area":"agents"},{"id":"2606.29225","title":"PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents","created":"2026-06-28","cited_by_count":6,"area":"agents"},{"id":"2409.11393","title":"LLM-Agent-UMF: LLM-based Agent Unified Modeling Framework for Seamless Design of Multi Active/Passive Core-Agent Architectures","created":"2024-09-17","cited_by_count":5,"area":"agents"},{"id":"2507.11299","title":"Dr.Copilot: A Multi-Agent Prompt Optimized Assistant for Improving Patient-Doctor Communication in Romanian","created":"2025-07-15","cited_by_count":5,"area":"agents"},{"id":"2602.19547","title":"CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents","created":"2026-02-23","cited_by_count":5,"area":"agents"},{"id":"2512.16279","title":"QuadSentinel: Sequent Safety for Machine-Checkable Control in Multi-agent Systems","created":"2025-12-18","cited_by_count":4,"area":"agents"},{"id":"2604.00835","title":"Agentic Tool Use in Large Language Models","created":"2026-04-01","cited_by_count":4,"area":"agents"},{"id":"2604.10134","title":"PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2605.04785","title":"AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use","created":"2026-05-06","cited_by_count":4,"area":"agents"},{"id":"2606.01166","title":"BraveGuard: From Open-World Threats to Safer Computer-Use Agents","created":"2026-05-31","cited_by_count":4,"area":"agents"},{"id":"2607.13718","title":"How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement","created":"2026-07-15","cited_by_count":4,"area":"agents"},{"id":"2603.11862","title":"You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents","created":"2026-03-12","cited_by_count":3,"area":"agents"},{"id":"2603.23791","title":"The Cognitive Firewall:Securing Browser Based AI Agents Against Indirect Prompt Injection Via Hybrid Edge Cloud Defense","created":"2026-03-24","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2605.30924","title":"EMBGuard: Constructing Hazard-Aware Guardrails for Safe Planning in Embodied Agents","created":"2026-05-29","cited_by_count":3,"area":"agents"},{"id":"2606.04306","title":"Organizational Control Layer: Governance Infrastructure at the Execution Boundary of LLM Agent Systems","created":"2026-06-03","cited_by_count":3,"area":"agents"},{"id":"2606.26924","title":"A Deterministic Control Plane for LLM Coding Agents","created":"2026-06-25","cited_by_count":3,"area":"agents"},{"id":"2607.08028","title":"From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents","created":"2026-07-09","cited_by_count":3,"area":"agents"},{"id":"2607.25619","title":"SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents","created":"2026-07-28","cited_by_count":3,"area":"agents"},{"id":"2608.12895","title":"Agent Behavioral Contracts II: Certifying Compositional Reliability Without Assuming Independence","created":"2026-08-13","cited_by_count":3,"area":"agents"},{"id":"2407.05674","title":"Controllable and Reliable Knowledge-Intensive Task-Oriented Conversational Agents with Declarative Genie Worksheets","created":"2024-07-08","cited_by_count":2,"area":"agents"},{"id":"2507.02986","title":"GAF-Guard: An Agentic Framework for Risk Management and Governance in Large Language Models","created":"2025-07-01","cited_by_count":2,"area":"agents"},{"id":"2511.08835","title":"Beyond Task-Oriented and Chitchat Dialogues: Proactive and Transition-Aware Conversational Agents","created":"2025-11-11","cited_by_count":2,"area":"agents"},{"id":"2602.21447","title":"Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG","created":"2026-02-24","cited_by_count":2,"area":"agents"},{"id":"2603.07191","title":"Governance Architecture for Autonomous Agent Systems: Threats, Framework, and Engineering Practice","created":"2026-03-07","cited_by_count":2,"area":"agents"},{"id":"2604.11174","title":"EmbodiedGovBench: A Benchmark for Governance, Recovery, and Upgrade Safety in Embodied Agent Systems","created":"2026-04-13","cited_by_count":2,"area":"agents"},{"id":"2604.24477","title":"GAMMAF: A Common Framework for Graph-Based Anomaly Monitoring Benchmarking in LLM Multi-Agent Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2605.10614","title":"PRISM: Generation-Time Detection and Mitigation of Secret Leakage in Multi-Agent LLM Pipelines","created":"2026-05-11","cited_by_count":2,"area":"agents"},{"id":"2605.17380","title":"ADR: An Agentic Detection System for Enterprise Agentic AI Security","created":"2026-05-17","cited_by_count":2,"area":"agents"},{"id":"2606.02240","title":"AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations","created":"2026-06-01","cited_by_count":2,"area":"agents"},{"id":"2602.05386","title":"Spider-Sense: Intrinsic Risk Sensing for Efficient Agent Defense with Hierarchical Adaptive Screening","created":"2026-02-05","cited_by_count":1,"area":"agents"},{"id":"2602.21496","title":"Beyond Refusal: Probing the Limits of Agentic Self-Correction for Semantic Sensitive Information","created":"2026-02-25","cited_by_count":1,"area":"agents"},{"id":"2604.04035","title":"Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agents","created":"2026-04-05","cited_by_count":1,"area":"agents"},{"id":"2604.11666","title":"Playing Along: Learning a Double-Agent Defender for Belief Steering via Theory of Mind","created":"2026-04-13","cited_by_count":1,"area":"agents"},{"id":"2604.16870","title":"Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives","created":"2026-04-18","cited_by_count":1,"area":"agents"},{"id":"2604.18658","title":"Owner-Harm: A Missing Threat Model for AI Agent Safety","created":"2026-04-20","cited_by_count":1,"area":"agents"},{"id":"2604.22879","title":"Beyond Single-Agent Alignment: Preventing Context-Fragmented Violations in Multi-Agent Systems","created":"2026-04-24","cited_by_count":1,"area":"agents"},{"id":"2605.24248","title":"Attested Tool-Server Admission: A Security Extension to the Model Context Protocol","created":"2026-05-22","cited_by_count":1,"area":"agents"},{"id":"2606.14517","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","created":"2026-06-12","cited_by_count":1,"area":"agents"},{"id":"2607.02121","title":"Behind the Refusal: Determining Guardrail Activation via Behavioral Monitoring","created":"2026-07-02","cited_by_count":1,"area":"agents"},{"id":"2607.05518","title":"aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2607.22445","title":"Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture","created":"2026-07-24","cited_by_count":1,"area":"agents"},{"id":"2608.27990","title":"CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?","created":"2026-08-28","cited_by_count":1,"area":"agents"},{"id":"2609.08258","title":"Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems","created":"2026-09-08","cited_by_count":1,"area":"agents"},{"id":"2603.25097","title":"ElephantBroker: A Knowledge-Grounded Cognitive Runtime for Trustworthy AI Agents","created":"2026-03-26","cited_by_count":0,"area":"agents"},{"id":"2604.17025","title":"Harness as an Asset: Enforcing Determinism via the Convergent AI Agent Framework (CAAF)","created":"2026-04-18","cited_by_count":0,"area":"agents"},{"id":"2604.27586","title":"Trace-Level Analysis of Information Contamination in Multi-Agent Systems","created":"2026-04-30","cited_by_count":0,"area":"agents"},{"id":"2605.00741","title":"Self-Adaptive Multi-Agent LLM-Based Security Pattern Selection for IoT Systems","created":"2026-05-01","cited_by_count":0,"area":"agents"},{"id":"2605.02187","title":"Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents","created":"2026-05-04","cited_by_count":0,"area":"agents"},{"id":"2605.07935","title":"TraceFix: Repairing Agent Coordination Protocols with TLA+ Counterexamples","created":"2026-05-08","cited_by_count":0,"area":"agents"},{"id":"2605.11234","title":"The Semantic Training Gap: Ontology-Grounded Tool Architectures for Industrial AI Agent Systems","created":"2026-05-11","cited_by_count":0,"area":"agents"},{"id":"2605.17909","title":"Ethical Hyper-Velocity (EHV): A Hardware-Rooted Zero-Trust Runtime Enforcement Architecture for Agentic AI Systems","created":"2026-05-18","cited_by_count":0,"area":"agents"},{"id":"2605.18764","title":"From Intent to AI Pipelines: A Controlled Agentic Framework for Non-AI Expert Scientists","created":"2026-04-10","cited_by_count":0,"area":"agents"},{"id":"2605.20173","title":"A Methodology for Selecting and Composing Runtime Architecture Patterns for Production LLM Agents","created":"2026-05-19","cited_by_count":0,"area":"agents"},{"id":"2605.25653","title":"When Agents Control Robots: A Zero Trust Policy Model for Agentic Cyber-Physical Systems","created":"2026-05-25","cited_by_count":0,"area":"agents"},{"id":"2606.03271","title":"Agentic Relationship Harm: Benchmarking and Gating Relational Manipulation in AI Agents","created":"2026-06-02","cited_by_count":0,"area":"agents"},{"id":"2606.14831","title":"Is Your Agent Playing Dead? Deployed LLM Agents Exhibit Constraint-Evasive Fabrication and Thanatosis","created":"2026-06-12","cited_by_count":0,"area":"agents"},{"id":"2606.15077","title":"Risk-Aware LLM Agents for Geospatial Data Retrieval: Design and Preliminary Adversarial Evaluation","created":"2026-06-13","cited_by_count":0,"area":"agents"},{"id":"2606.15579","title":"Your Agent Has a Genome: Sequence-Level Behavioral Analysis and Runtime Governance of LLM-Powered Autonomous Agents","created":"2026-04-05","cited_by_count":0,"area":"agents"},{"id":"2606.17092","title":"Securing Multi-Agent GIS Systems: Risk Evaluation and Prompt Hardening Optimization","created":"2026-06-13","cited_by_count":0,"area":"agents"},{"id":"2607.08395","title":"Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents","created":"2026-07-09","cited_by_count":0,"area":"agents"},{"id":"2607.11226","title":"Heterogeneous Agent Cohorts for Safe Open-Ended Exploration with Runtime Constraint Memory","created":"2026-07-13","cited_by_count":0,"area":"agents"},{"id":"2607.16215","title":"RAIL Guard: Closing the Evaluation-to-Remediation Gap in Responsible AI for LLM Agents","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2607.20488","title":"Autonomous Topology Mutation: Safe Runtime Restructuring for Multi-Agent LLM Systems with Capability, State, and Shadow Invariants","created":"2026-06-04","cited_by_count":0,"area":"agents"},{"id":"2608.11274","title":"Agent Safety Should Be a Runtime Contract","created":"2026-08-11","cited_by_count":0,"area":"agents"},{"id":"2608.12172","title":"Rethinking Agent Security as a Networking Problem","created":"2026-08-12","cited_by_count":0,"area":"agents"},{"id":"2608.27092","title":"The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.27141","title":"Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.03192","title":"Where Reliability Lives: Experimental Localisation of Behavioural Properties in an Agent System","created":"2026-09-02","cited_by_count":0,"area":"agents"},{"id":"2609.13353","title":"SkillAtlas: An Attack Trace Library for Agent Skills","created":"2026-09-11","cited_by_count":0,"area":"agents"},{"id":"2609.13731","title":"Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges","created":"2026-09-12","cited_by_count":0,"area":"agents"},{"id":"2609.16694","title":"Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives","created":"2026-09-15","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}