{"total":113,"rows":[{"id":"2403.02691","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","created":"2024-03-05","cited_by_count":538,"area":"agents"},{"id":"2410.02644","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","created":"2024-10-03","cited_by_count":369,"area":"agents"},{"id":"2401.10019","title":"R-Judge: Benchmarking Safety Risk Awareness for LLM Agents","created":"2024-01-18","cited_by_count":288,"area":"agents"},{"id":"2504.18575","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","created":"2025-04-22","cited_by_count":157,"area":"agents"},{"id":"2409.11295","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","created":"2024-09-17","cited_by_count":150,"area":"agents"},{"id":"2406.13352","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","created":"2024-06-19","cited_by_count":145,"area":"agents"},{"id":"2407.19354","title":"The Emerged Security and Privacy of LLM Agent: A Survey with Case Studies","created":"2024-07-28","cited_by_count":131,"area":"agents"},{"id":"2404.08144","title":"LLM Agents can Autonomously Exploit One-day Vulnerabilities","created":"2024-04-11","cited_by_count":128,"area":"agents"},{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2406.01637","title":"Teams of LLM Agents can Exploit Zero-Day Vulnerabilities","created":"2024-06-02","cited_by_count":95,"area":"agents"},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87,"area":"agents"},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73,"area":"agents"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2402.16965","title":"WIPI: A New Web Threat for LLM-Driven Web Agents","created":"2024-02-26","cited_by_count":51,"area":"agents"},{"id":"2508.13220","title":"MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols","created":"2025-08-17","cited_by_count":51,"area":"agents"},{"id":"2505.21936","title":"RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments","created":"2025-05-28","cited_by_count":46,"area":"agents"},{"id":"2510.04885","title":"RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection","created":"2025-10-06","cited_by_count":36,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2506.23844","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","created":"2025-06-30","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","created":"2026-05-14","cited_by_count":27,"area":"agents"},{"id":"2511.05269","title":"TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems","created":"2025-11-07","cited_by_count":26,"area":"agents"},{"id":"2410.16950","title":"Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In","created":"2024-10-22","cited_by_count":22,"area":"agents"},{"id":"2507.14293","title":"WebGuard: Building a Generalizable Guardrail for Web Agents","created":"2025-07-18","cited_by_count":21,"area":"agents"},{"id":"2603.21019","title":"SkillProbe: Security Auditing for Emerging Agent Skill Marketplaces via Multi-Agent Collaboration","created":"2026-03-22","cited_by_count":21,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2506.02040","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","created":"2025-05-31","cited_by_count":19,"area":"agents"},{"id":"2605.12015","title":"SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces","created":"2026-05-12","cited_by_count":19,"area":"agents"},{"id":"2509.21011","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools","created":"2025-09-25","cited_by_count":18,"area":"agents"},{"id":"2602.05746","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","created":"2026-02-05","cited_by_count":16,"area":"agents"},{"id":"2509.22040","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","created":"2025-09-26","cited_by_count":15,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13,"area":"agents"},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2506.17318","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2510.08829","title":"CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization","created":"2025-10-09","cited_by_count":12,"area":"agents"},{"id":"2510.18563","title":"The Trust Paradox in LLM-Based Multi-Agent Systems: When Collaboration Becomes a Security Vulnerability","created":"2025-10-21","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2602.14161","title":"When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift","created":"2026-02-15","cited_by_count":11,"area":"agents"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2512.08417","title":"Attention is All You Need to Defend Against Indirect Prompt Injection Attacks in LLMs","created":"2025-12-09","cited_by_count":10,"area":"agents"},{"id":"2609.28613","title":"Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions","created":"2026-09-23","cited_by_count":10,"area":"agents"},{"id":"2506.07524","title":"TAI3: Testing Agent Integrity in Interpreting User Intent","created":"2025-06-09","cited_by_count":9,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2510.22620","title":"Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents","created":"2025-10-26","cited_by_count":8,"area":"agents"},{"id":"2603.18096","title":"A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance","created":"2026-03-18","cited_by_count":8,"area":"agents"},{"id":"2603.19974","title":"Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance","created":"2026-03-20","cited_by_count":8,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2509.24240","title":"Takedown: How It's Done in Modern Coding Agent Exploits","created":"2025-09-29","cited_by_count":6,"area":"agents"},{"id":"2602.16958","title":"Automating Agent Hijacking via Structural Template Injection","created":"2026-02-18","cited_by_count":6,"area":"agents"},{"id":"2604.01350","title":"No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents","created":"2026-04-01","cited_by_count":6,"area":"agents"},{"id":"2604.09443","title":"Many-Tier Instruction Hierarchy in LLM Agents","created":"2026-04-10","cited_by_count":6,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2412.10807","title":"Towards Action Hijacking of Large Language Model-based Agent","created":"2024-12-14","cited_by_count":4,"area":"agents"},{"id":"2512.14860","title":"Penetration Testing of Agentic AI: A Comparative Security Analysis Across Models and Frameworks","created":"2025-12-16","cited_by_count":4,"area":"agents"},{"id":"2603.10092","title":"Execution Is the New Attack Surface: Survivability-Aware Agentic Crypto Trading with OpenClaw-Style Local Executors","created":"2026-03-10","cited_by_count":4,"area":"agents"},{"id":"2604.03870","title":"Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs","created":"2026-04-04","cited_by_count":4,"area":"agents"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2606.21877","title":"AgentRiskBOM: A Risk-Scoping Security Bill of Materials for Agentic AI Systems","created":"2026-06-20","cited_by_count":4,"area":"agents"},{"id":"2607.10490","title":"NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations","created":"2026-07-11","cited_by_count":4,"area":"agents"},{"id":"2510.21057","title":"Soft Instruction De-escalation Defense","created":"2025-10-24","cited_by_count":3,"area":"agents"},{"id":"2603.26221","title":"Clawed and Dangerous: Can We Trust Open Agentic Systems?","created":"2026-03-27","cited_by_count":3,"area":"agents"},{"id":"2604.06284","title":"ClawLess: A Security Model of AI Agents","created":"2026-04-07","cited_by_count":3,"area":"agents"},{"id":"2604.12284","title":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","created":"2026-04-14","cited_by_count":3,"area":"agents"},{"id":"2605.28201","title":"Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2606.21409","title":"Don't Blindly Trust It: How Unreliable Feedback Breaks Tool-Using LLM Agents","created":"2026-06-19","cited_by_count":3,"area":"agents"},{"id":"2606.23189","title":"Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity?","created":"2026-06-22","cited_by_count":3,"area":"agents"},{"id":"2607.12624","title":"PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis","created":"2026-07-14","cited_by_count":3,"area":"agents"},{"id":"2607.25619","title":"SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents","created":"2026-07-28","cited_by_count":3,"area":"agents"},{"id":"2505.15738","title":"Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defenses","created":"2025-05-21","cited_by_count":2,"area":"agents"},{"id":"2507.02699","title":"Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents","created":"2025-07-03","cited_by_count":2,"area":"agents"},{"id":"2601.13612","title":"PINA: Prompt Injection Attack against Navigation Agents","created":"2026-01-20","cited_by_count":2,"area":"agents"},{"id":"2603.24203","title":"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search","created":"2026-03-25","cited_by_count":2,"area":"agents"},{"id":"2605.08460","title":"When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks","created":"2026-05-08","cited_by_count":2,"area":"agents"},{"id":"2605.17453","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","created":"2026-05-17","cited_by_count":2,"area":"agents"},{"id":"2606.09084","title":"Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2606.13385","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","created":"2026-06-11","cited_by_count":2,"area":"agents"},{"id":"2608.22868","title":"AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems","created":"2026-08-24","cited_by_count":2,"area":"agents"},{"id":"2609.07529","title":"CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2602.07391","title":"NAAMSE: Framework for Evolutionary Security Evaluation of Agents","created":"2026-02-07","cited_by_count":1,"area":"agents"},{"id":"2604.15774","title":"MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents","created":"2026-04-17","cited_by_count":1,"area":"agents"},{"id":"2604.18658","title":"Owner-Harm: A Missing Threat Model for AI Agent Safety","created":"2026-04-20","cited_by_count":1,"area":"agents"},{"id":"2605.11868","title":"IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection","created":"2026-05-12","cited_by_count":1,"area":"agents"},{"id":"2605.17324","title":"ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents","created":"2026-05-17","cited_by_count":1,"area":"agents"},{"id":"2607.01153","title":"Adversarial Pragmatics for AI Safety Evaluation: A Diagnostic Framework and Seed Benchmark for Language-Mediated Control","created":"2026-07-01","cited_by_count":1,"area":"agents"},{"id":"2607.05120","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2608.30041","title":"Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection","created":"2026-08-30","cited_by_count":1,"area":"agents"},{"id":"2609.39050","title":"Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems","created":"2026-09-30","cited_by_count":1,"area":"agents"},{"id":"2610.00400","title":"Representation Transitions Reveal Emerging Safety Risks in Multi-Turn LLM Agents","created":"2026-09-30","cited_by_count":1,"area":"agents"},{"id":"2605.08258","title":"Designing Intelligent Enterprise Agents: A Capability-Aligned Multi-Agent Architecture","created":"2026-05-07","cited_by_count":0,"area":"agents"},{"id":"2605.12535","title":"Ghost in the Context: Policy-Carriage Integrity in LLM Agents","created":"2026-05-02","cited_by_count":0,"area":"agents"},{"id":"2605.16471","title":"From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI","created":"2026-05-15","cited_by_count":0,"area":"agents"},{"id":"2605.30454","title":"The Surface You Test Is Not the Surface That Breaks","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2606.04141","title":"Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents","created":"2026-06-02","cited_by_count":0,"area":"agents"},{"id":"2606.09315","title":"Brain-Prompt Injection: A Route-Safety Audit for BCI-LLM Agents","created":"2026-06-08","cited_by_count":0,"area":"agents"},{"id":"2606.10304","title":"MIRAGE: A Polarity-Flipping Encoding Subspace in LLM Agents","created":"2026-06-09","cited_by_count":0,"area":"agents"},{"id":"2606.21732","title":"Safe to Check, Unsafe to Use: Relinking at the Compression Boundary of LLM Agents","created":"2026-06-19","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}