{"total":90,"rows":[{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2602.15654","title":"Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections","created":"2026-02-17","cited_by_count":48,"area":"agents"},{"id":"2604.03081","title":"Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems","created":"2026-04-03","cited_by_count":45,"area":"agents"},{"id":"2601.05504","title":"Memory Poisoning Attack and Defense on Memory Based LLM-Agents","created":"2026-01-09","cited_by_count":44,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2506.13666","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","created":"2025-06-16","cited_by_count":27,"area":"agents"},{"id":"2510.02554","title":"ToolTweak: An Attack on Tool Selection in LLM-based Agents","created":"2025-10-02","cited_by_count":26,"area":"agents"},{"id":"2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","created":"2026-04-03","cited_by_count":24,"area":"agents"},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20,"area":"agents"},{"id":"2604.04759","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","created":"2026-04-06","cited_by_count":20,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2606.24322","title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","created":"2026-06-23","cited_by_count":18,"area":"agents"},{"id":"2601.04566","title":"BackdoorAgent: A Unified Framework for Backdoor Attacks on LLM-based Agents","created":"2026-01-08","cited_by_count":16,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2505.12567","title":"A Survey of Attacks on Large Language Models","created":"2025-05-18","cited_by_count":15,"area":"agents"},{"id":"2602.11327","title":"Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP","created":"2026-02-11","cited_by_count":15,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2608.05179","title":"Autonomous Research Agents: A Survey of AI Scientists and the Verification Gap","created":"2026-06-29","cited_by_count":9,"area":"agents"},{"id":"2602.19555","title":"SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime","created":"2026-02-23","cited_by_count":8,"area":"agents"},{"id":"2507.06323","title":"Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms","created":"2025-07-08","cited_by_count":7,"area":"agents"},{"id":"2605.17830","title":"Remembering More, Risking More: Longitudinal Safety Risks in Memory-Equipped LLM Agents","created":"2026-05-18","cited_by_count":7,"area":"agents"},{"id":"2410.22339","title":"DAWN: Designing Distributed Agents in a Worldwide Network","created":"2024-10-11","cited_by_count":6,"area":"agents"},{"id":"2509.24240","title":"Takedown: How It's Done in Modern Coding Agent Exploits","created":"2025-09-29","cited_by_count":6,"area":"agents"},{"id":"2604.01350","title":"No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents","created":"2026-04-01","cited_by_count":6,"area":"agents"},{"id":"2605.17641","title":"Causal Intervention-Based Memory Selection for Long-Horizon LLM Agents","created":"2026-05-17","cited_by_count":6,"area":"agents"},{"id":"2510.16558","title":"A First Look at the Security Issues in the Model Context Protocol Ecosystem","created":"2025-10-18","cited_by_count":5,"area":"agents"},{"id":"2602.19547","title":"CIBER: A Comprehensive Benchmark for Security Evaluation of Code Interpreter Agents","created":"2026-02-23","cited_by_count":5,"area":"agents"},{"id":"2603.15408","title":"TrinityGuard: A Unified Framework for Safeguarding Multi-Agent Systems","created":"2026-03-16","cited_by_count":5,"area":"agents"},{"id":"2603.20933","title":"AC4A: Access Control for Agents","created":"2026-03-21","cited_by_count":5,"area":"agents"},{"id":"2605.09594","title":"Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills","created":"2026-05-10","cited_by_count":5,"area":"agents"},{"id":"2606.14154","title":"SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills","created":"2026-06-12","cited_by_count":5,"area":"agents"},{"id":"2507.06850","title":"The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise","created":"2025-07-09","cited_by_count":4,"area":"agents"},{"id":"2509.23694","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2604.25562","title":"SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents","created":"2026-04-28","cited_by_count":4,"area":"agents"},{"id":"2605.24245","title":"Deep-Research Agents Can Be Poisoned via User-Generated Content","created":"2026-05-22","cited_by_count":4,"area":"agents"},{"id":"2606.01166","title":"BraveGuard: From Open-World Threats to Safer Computer-Use Agents","created":"2026-05-31","cited_by_count":4,"area":"agents"},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3,"area":"agents"},{"id":"2603.02960","title":"Architecting Trust in Artificial Epistemic Agents","created":"2026-03-03","cited_by_count":3,"area":"agents"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2505.14215","title":"Safety Degradation in AI Agents","created":"2025-05-20","cited_by_count":2,"area":"agents"},{"id":"2512.02261","title":"TradeTrap: Are LLM-based Trading Agents Truly Reliable and Faithful?","created":"2025-12-01","cited_by_count":2,"area":"agents"},{"id":"2602.01942","title":"Human Society-Inspired Approaches to Agentic AI Security: The 4C Framework","created":"2026-02-02","cited_by_count":2,"area":"agents"},{"id":"2605.08460","title":"When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks","created":"2026-05-08","cited_by_count":2,"area":"agents"},{"id":"2605.12729","title":"Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety","created":"2026-05-12","cited_by_count":2,"area":"agents"},{"id":"2605.17480","title":"The Capability Paradox: How Smarter Auditors Make Multi-Agent Systems Less Secure","created":"2026-05-17","cited_by_count":2,"area":"agents"},{"id":"2606.08661","title":"Data Agents Under Attack: Vulnerabilities in LLM-Driven Analytical Systems","created":"2026-06-07","cited_by_count":2,"area":"agents"},{"id":"2606.18356","title":"SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":2,"area":"agents"},{"id":"2607.05189","title":"When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents","created":"2026-07-06","cited_by_count":2,"area":"agents"},{"id":"2607.15657","title":"Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents","created":"2026-07-17","cited_by_count":2,"area":"agents"},{"id":"2607.17291","title":"DRNOISE: Benchmarking Deep Research Agents in Misleading Evidence Environments","created":"2026-07-19","cited_by_count":2,"area":"agents"},{"id":"2603.13950","title":"ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Covering","created":"2026-03-14","cited_by_count":1,"area":"agents"},{"id":"2603.18235","title":"Toward Reliable, Safe, and Secure LLMs for Scientific Applications","created":"2026-03-18","cited_by_count":1,"area":"agents"},{"id":"2604.15774","title":"MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents","created":"2026-04-17","cited_by_count":1,"area":"agents"},{"id":"2604.17125","title":"CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systems","created":"2026-04-18","cited_by_count":1,"area":"agents"},{"id":"2605.09822","title":"Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning","created":"2026-05-10","cited_by_count":1,"area":"agents"},{"id":"2606.10742","title":"MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents","created":"2026-06-09","cited_by_count":1,"area":"agents"},{"id":"2608.00718","title":"Adversarial Attacks in Multi-Agent LLM Pipelines: Unveiling Structural Vulnerabilities in Agentic AI Architectures","created":"2026-08-01","cited_by_count":1,"area":"agents"},{"id":"2608.04626","title":"Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.27990","title":"CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?","created":"2026-08-28","cited_by_count":1,"area":"agents"},{"id":"2608.30041","title":"Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection","created":"2026-08-30","cited_by_count":1,"area":"agents"},{"id":"2609.06027","title":"Evaluating Deep-Search Agents under Hierarchical Web Evidence Poisoning","created":"2026-09-05","cited_by_count":1,"area":"agents"},{"id":"2609.07713","title":"The Emerging AI Paper-Review Arms Race: Adversarial Co-Evolution in Scholarly Publishing","created":"2026-09-07","cited_by_count":1,"area":"agents"},{"id":"2609.08258","title":"Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems","created":"2026-09-08","cited_by_count":1,"area":"agents"},{"id":"2609.15516","title":"Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems","created":"2026-09-14","cited_by_count":1,"area":"agents"},{"id":"2508.17155","title":"Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents","created":"2025-08-23","cited_by_count":0,"area":"agents"},{"id":"2510.22963","title":"When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents","created":"2025-10-27","cited_by_count":0,"area":"agents"},{"id":"2602.21127","title":"\"Are You Sure?\": An Empirical Study of Human Perception Vulnerability in LLM-Driven Agentic Systems","created":"2026-02-24","cited_by_count":0,"area":"agents"},{"id":"2604.23483","title":"Agentic Adversarial Rewriting Exposes Architectural Vulnerabilities in Black-Box NLP Pipelines","created":"2026-04-26","cited_by_count":0,"area":"agents"},{"id":"2605.02187","title":"Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents","created":"2026-05-04","cited_by_count":0,"area":"agents"},{"id":"2606.00914","title":"Adversarial Feeds Steer LLM Agent Decisions Against Their Defaults","created":"2026-05-30","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.12340","title":"Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents","created":"2026-07-14","cited_by_count":0,"area":"agents"},{"id":"2607.24893","title":"Early Detection of Distributed Backdoors in Multi-Agent LLM Systems: A Characterization Study","created":"2026-07-27","cited_by_count":0,"area":"agents"},{"id":"2608.07952","title":"Persistent Semantic Entities in Tool-Augmented LLM Systems","created":"2026-08-08","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.24017","title":"WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents","created":"2026-08-25","cited_by_count":0,"area":"agents"},{"id":"2609.14723","title":"Detecting and Localizing Segment-Level Poisoning in Multi-Source LLM-Agent Inputs","created":"2026-09-13","cited_by_count":0,"area":"agents"},{"id":"2609.19789","title":"Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systems","created":"2026-09-17","cited_by_count":0,"area":"agents"},{"id":"2609.20080","title":"A Proposal for an Agentic AI Architecture to Support Multi-Domain Decision-Making in the Brazilian Armed Forces","created":"2026-09-17","cited_by_count":0,"area":"agents"},{"id":"2609.22510","title":"Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents","created":"2026-09-18","cited_by_count":0,"area":"agents"},{"id":"2609.22818","title":"The Price of Safety: Benign-Case Utility and Token Overhead of Memory-Poisoning Defenses in LLM Agents","created":"2026-09-19","cited_by_count":0,"area":"agents"},{"id":"2609.22961","title":"When Agentic Trust Crosses Organizational Boundaries: Structural Externalization and a Reference Model for Trust Evidence","created":"2026-09-19","cited_by_count":0,"area":"agents"},{"id":"2609.34132","title":"From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.19910","title":"When Non-Adversarial Noise Hurts Learning: Benchmarking Skill Self-Evolution in Agents","created":"2026-10-14","cited_by_count":0,"area":"agents"}],"next_cursor":null}