{"total":202,"rows":[{"id":"2401.10019","title":"R-Judge: Benchmarking Safety Risk Awareness for LLM Agents","created":"2024-01-18","cited_by_count":288,"area":"agents"},{"id":"2403.04783","title":"AutoDefense: Multi-Agent LLM Defense against Jailbreak Attacks","created":"2024-03-02","cited_by_count":145,"area":"agents"},{"id":"2502.13172","title":"Unveiling Privacy Risks in LLM Agent Memory","created":"2025-02-17","cited_by_count":101,"area":"agents"},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87,"area":"agents"},{"id":"2401.11880","title":"PsySafe: A Comprehensive Framework for Psychological-based Attack, Defense, and Evaluation of Multi-agent System Safety","created":"2024-01-22","cited_by_count":80,"area":"agents"},{"id":"2502.05174","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","created":"2025-02-07","cited_by_count":77,"area":"agents"},{"id":"2510.02373","title":"A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory","created":"2025-09-29","cited_by_count":67,"area":"agents"},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66,"area":"agents"},{"id":"2410.13886","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","created":"2024-10-11","cited_by_count":65,"area":"agents"},{"id":"2504.03767","title":"MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits","created":"2025-04-02","cited_by_count":63,"area":"agents"},{"id":"2502.11127","title":"G-Safeguard: A Topology-Guided Security Lens and Treatment on LLM-based Multi-agent Systems","created":"2025-02-16","cited_by_count":59,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2502.08586","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","created":"2025-02-12","cited_by_count":49,"area":"agents"},{"id":"2410.12855","title":"JAILJUDGE: A Comprehensive Jailbreak Judge Benchmark with Multi-Agent Enhanced Explanation Evaluation Framework","created":"2024-10-11","cited_by_count":47,"area":"agents"},{"id":"2506.02456","title":"VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents","created":"2025-06-03","cited_by_count":45,"area":"agents"},{"id":"2507.21206","title":"Agentic Web: Weaving the Next Web with AI Agents","created":"2025-07-28","cited_by_count":45,"area":"agents"},{"id":"2606.04990","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","created":"2026-06-03","cited_by_count":37,"area":"agents"},{"id":"2604.02022","title":"ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis","created":"2026-04-02","cited_by_count":36,"area":"agents"},{"id":"2405.10467","title":"Agent Design Pattern Catalogue: A Collection of Architectural Patterns for Foundation Model based Agents","created":"2024-05-16","cited_by_count":35,"area":"agents"},{"id":"2504.00218","title":"$\\textit{Agents Under Siege}$: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks","created":"2025-03-31","cited_by_count":34,"area":"agents"},{"id":"2512.23738","title":"Enforcing Temporal Constraints for LLM Agents","created":"2025-12-25","cited_by_count":34,"area":"agents"},{"id":"2411.03814","title":"MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialogue","created":"2024-11-06","cited_by_count":33,"area":"agents"},{"id":"2602.16708","title":"Formal Policy Enforcement for Real-World Agentic Systems","created":"2026-02-18","cited_by_count":33,"area":"agents"},{"id":"2504.14064","title":"DoomArena: A framework for Testing AI Agents Against Evolving Security Threats","created":"2025-04-18","cited_by_count":32,"area":"agents"},{"id":"2508.19461","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","created":"2025-08-26","cited_by_count":31,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2510.09781","title":"Building a Foundational Guardrail for General Agentic Systems via Synthetic Data","created":"2025-10-10","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2506.13666","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","created":"2025-06-16","cited_by_count":27,"area":"agents"},{"id":"2506.01055","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","created":"2025-06-01","cited_by_count":26,"area":"agents"},{"id":"2602.11510","title":"AgentLeak: A Benchmark for Internal-Channel Privacy Leakage in Multi-Agent LLM Systems","created":"2026-02-12","cited_by_count":25,"area":"agents"},{"id":"2510.01354","title":"WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents","created":"2025-10-01","cited_by_count":24,"area":"agents"},{"id":"2505.16120","title":"LLM-Powered AI Agent Systems and Their Applications in Industry","created":"2025-05-22","cited_by_count":22,"area":"agents"},{"id":"2606.17573","title":"Cordon: Semantic Transactions for Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":22,"area":"agents"},{"id":"2507.14293","title":"WebGuard: Building a Generalizable Guardrail for Web Agents","created":"2025-07-18","cited_by_count":21,"area":"agents"},{"id":"2603.12644","title":"Uncovering Security Threats and Architecting Defenses in Autonomous Agents: A Case Study of OpenClaw","created":"2026-03-13","cited_by_count":20,"area":"agents"},{"id":"2603.15125","title":"From Storage to Steering: Memory Control Flow Attacks on LLM Agents","created":"2026-03-16","cited_by_count":19,"area":"agents"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2602.06443","title":"TrajAD: Trajectory Anomaly Detection for Trustworthy LLM Agents","created":"2026-02-06","cited_by_count":15,"area":"agents"},{"id":"2604.05485","title":"Auditable Agents","created":"2026-04-07","cited_by_count":15,"area":"agents"},{"id":"2604.13630","title":"SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment","created":"2026-04-15","cited_by_count":15,"area":"agents"},{"id":"2601.10955","title":"Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents","created":"2026-01-16","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2412.05734","title":"LeakAgent: RL-based Red-teaming Agent for LLM Privacy Leakage","created":"2024-12-07","cited_by_count":13,"area":"agents"},{"id":"2504.08848","title":"X-Guard: Multilingual Guard Agent for Content Moderation","created":"2025-04-11","cited_by_count":13,"area":"agents"},{"id":"2504.15699","title":"Advancing Embodied Agent Security: From Safety Benchmarks to Input Moderation","created":"2025-04-22","cited_by_count":13,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2410.07109","title":"I Want to Break Free! Persuasion and Anti-Social Behavior of LLMs in Multi-Agent Settings with Social Hierarchy","created":"2024-10-09","cited_by_count":12,"area":"agents"},{"id":"2509.23614","title":"PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents","created":"2025-09-28","cited_by_count":12,"area":"agents"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2504.20965","title":"AegisLLM: Scaling Agentic Systems for Self-Reflective Defense in LLM Security","created":"2025-04-29","cited_by_count":10,"area":"agents"},{"id":"2510.08240","title":"The Alignment Waltz: Jointly Training Agents to Collaborate for Safety","created":"2025-10-09","cited_by_count":10,"area":"agents"},{"id":"2512.00966","title":"Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysis","created":"2025-11-30","cited_by_count":9,"area":"agents"},{"id":"2604.13954","title":"HINTBench: Horizon-agent Intrinsic Non-attack Trajectory Benchmark","created":"2026-04-15","cited_by_count":9,"area":"agents"},{"id":"2605.26154","title":"MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning","created":"2026-05-24","cited_by_count":9,"area":"agents"},{"id":"2602.11749","title":"AIR: Improving Agent Safety through Incident Response","created":"2026-02-12","cited_by_count":8,"area":"agents"},{"id":"2605.11882","title":"On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment","created":"2026-05-12","cited_by_count":8,"area":"agents"},{"id":"2605.27690","title":"TRACES: Proactive Safety Auditing for Multi-Turn LLM Agents via Trajectory-State Modeling","created":"2026-05-26","cited_by_count":8,"area":"agents"},{"id":"2605.29801","title":"AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security","created":"2026-05-28","cited_by_count":8,"area":"agents"},{"id":"2506.11083","title":"RedDebate: Safer Responses Through Multi-Agent Red Teaming Debates","created":"2025-06-04","cited_by_count":7,"area":"agents"},{"id":"2507.06323","title":"Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms","created":"2025-07-08","cited_by_count":7,"area":"agents"},{"id":"2604.17562","title":"SafeAgent: A Runtime Protection Architecture for Agentic Systems","created":"2026-04-19","cited_by_count":7,"area":"agents"},{"id":"2605.11514","title":"FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2607.01793","title":"Safety Testing LLM Agents at Scale: From Risk Discovery to Evidence-Grounded Verification","created":"2026-07-02","cited_by_count":7,"area":"agents"},{"id":"2512.05951","title":"Trusted AI Agents in the Cloud","created":"2025-12-05","cited_by_count":6,"area":"agents"},{"id":"2604.01350","title":"No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents","created":"2026-04-01","cited_by_count":6,"area":"agents"},{"id":"2606.10106","title":"What makes a harness a harness: necessary and sufficient conditions for an agent harness","created":"2026-06-08","cited_by_count":6,"area":"agents"},{"id":"2606.29225","title":"PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents","created":"2026-06-28","cited_by_count":6,"area":"agents"},{"id":"2608.09885","title":"SHE: Trajectory-driven Safety Harness Evolution for LLM Agents","created":"2026-08-10","cited_by_count":6,"area":"agents"},{"id":"2602.19547","title":"CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents","created":"2026-02-23","cited_by_count":5,"area":"agents"},{"id":"2604.08608","title":"Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines","created":"2026-04-08","cited_by_count":5,"area":"agents"},{"id":"2605.08442","title":"Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents","created":"2026-05-08","cited_by_count":5,"area":"agents"},{"id":"2605.17467","title":"VerifyMAS: Hypothesis Verification for Failure Attribution in LLM Multi-Agent Systems","created":"2026-05-17","cited_by_count":5,"area":"agents"},{"id":"2506.22557","title":"MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs","created":"2025-06-27","cited_by_count":4,"area":"agents"},{"id":"2508.03864","title":"Evo-MARL: Co-Evolutionary Multi-Agent Reinforcement Learning for Internalized Safety","created":"2025-08-05","cited_by_count":4,"area":"agents"},{"id":"2512.16279","title":"QuadSentinel: Sequent Safety for Machine-Checkable Control in Multi-agent Systems","created":"2025-12-18","cited_by_count":4,"area":"agents"},{"id":"2602.10465","title":"Authenticated Workflows: A Systems Approach to Protecting Agentic AI","created":"2026-02-11","cited_by_count":4,"area":"agents"},{"id":"2603.22751","title":"Observable Channels, Not Just Storage: Evaluating Privacy Leakage in LLM Agent Pipelines","created":"2026-03-24","cited_by_count":4,"area":"agents"},{"id":"2605.04785","title":"AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use","created":"2026-05-06","cited_by_count":4,"area":"agents"},{"id":"2606.01166","title":"BraveGuard: From Open-World Threats to Safer Computer-Use Agents","created":"2026-05-31","cited_by_count":4,"area":"agents"},{"id":"2606.15609","title":"FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion","created":"2026-06-14","cited_by_count":4,"area":"agents"},{"id":"2607.09375","title":"Mach-Mind-4-Flash Technical Report","created":"2026-07-10","cited_by_count":4,"area":"agents"},{"id":"2607.29167","title":"Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory","created":"2026-07-31","cited_by_count":4,"area":"agents"},{"id":"2409.03793","title":"Safeguarding AI Agents: Developing and Analyzing Safety Architectures","created":"2024-09-03","cited_by_count":3,"area":"agents"},{"id":"2502.12630","title":"Automating Prompt Leakage Attacks on Large Language Models Using Agentic Approach","created":"2025-02-18","cited_by_count":3,"area":"agents"},{"id":"2603.04469","title":"Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems","created":"2026-03-04","cited_by_count":3,"area":"agents"},{"id":"2604.07988","title":"LogAct: Enabling Agentic Reliability via Shared Logs","created":"2026-04-09","cited_by_count":3,"area":"agents"},{"id":"2605.00424","title":"Skills as Verifiable Artifacts: A Trust Schema and a Biconditional Correctness Criterion for Human-in-the-Loop Agent Runtimes","created":"2026-05-01","cited_by_count":3,"area":"agents"},{"id":"2605.16346","title":"PropGuard: Safeguarding LLM-MAS via Propagation-Aware Exploration and Remediation","created":"2026-05-08","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2605.22001","title":"Blind Spots in the Guard: How Domain-Camouflaged Injection Attacks Evade Detection in Multi-Agent LLM Systems","created":"2026-05-21","cited_by_count":3,"area":"agents"},{"id":"2605.30924","title":"EMBGuard: Constructing Hazard-Aware Guardrails for Safe Planning in Embodied Agents","created":"2026-05-29","cited_by_count":3,"area":"agents"},{"id":"2606.04306","title":"Organizational Control Layer: Governance Infrastructure at the Execution Boundary of LLM Agent Systems","created":"2026-06-03","cited_by_count":3,"area":"agents"},{"id":"2606.20922","title":"Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning","created":"2026-06-18","cited_by_count":3,"area":"agents"},{"id":"2607.08028","title":"From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents","created":"2026-07-09","cited_by_count":3,"area":"agents"},{"id":"2607.25619","title":"SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents","created":"2026-07-28","cited_by_count":3,"area":"agents"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2505.15738","title":"Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defenses","created":"2025-05-21","cited_by_count":2,"area":"agents"}],"next_cursor":"100"}