{"total":68,"rows":[{"id":"2406.02630","title":"AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathways","created":"2024-06-04","cited_by_count":127,"area":null},{"id":"2505.23643","title":"Securing AI Agents with Information-Flow Control","created":"2025-05-29","cited_by_count":121,"area":null},{"id":"2405.03644","title":"When LLMs Meet Cybersecurity: A Systematic Literature Review","created":"2024-05-06","cited_by_count":71,"area":null},{"id":"2504.20984","title":"ACE: A Security Architecture for LLM-Integrated App Systems","created":"2025-04-29","cited_by_count":55,"area":null},{"id":"2502.08745","title":"IHEval: Evaluating Language Models on Following the Instruction Hierarchy","created":"2025-02-12","cited_by_count":53,"area":null},{"id":"2406.00936","title":"A Survey of Useful LLM Evaluation","created":"2024-06-03","cited_by_count":29,"area":null},{"id":"2404.16251","title":"Prompt Leakage effect and defense strategies for multi-turn LLM interactions","created":"2024-04-24","cited_by_count":23,"area":null},{"id":"2406.12137","title":"IDs for AI Systems","created":"2024-06-17","cited_by_count":19,"area":null},{"id":"2602.11865","title":"Intelligent AI Delegation","created":"2026-02-12","cited_by_count":18,"area":null},{"id":"2505.13176","title":"ToolSpectrum : Towards Personalized Tool Utilization for Large Language Models","created":"2025-05-19","cited_by_count":6,"area":null},{"id":"2603.17170","title":"Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices","created":"2026-03-17","cited_by_count":5,"area":null},{"id":"2606.22916","title":"Intent-Governed Tool Authorization for AI Agents","created":"2026-06-22","cited_by_count":5,"area":null},{"id":"2608.28945","title":"Automated Researchers Can Mitigate Well-characterized Alignment Failures","created":"2026-08-28","cited_by_count":5,"area":null},{"id":"2506.07330","title":"JavelinGuard: Low-Cost Transformer Architectures for LLM Security","created":"2025-06-09","cited_by_count":4,"area":null},{"id":"2605.11003","title":"The Authorization-Execution Gap Is a Major Safety and Security Problem in Open-World Agents","created":"2026-05-10","cited_by_count":4,"area":null},{"id":"2502.02818","title":"TranSQL+: Serving Large Language Models with SQL on Low-Resource Hardware","created":"2025-02-05","cited_by_count":3,"area":null},{"id":"2512.20164","title":"AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications","created":"2025-12-23","cited_by_count":3,"area":null},{"id":"2603.25100","title":"From Logic Monopoly to Social Contract: Separation of Power and the Institutional Foundations for Autonomous Agent Economies","created":"2026-03-26","cited_by_count":3,"area":null},{"id":"2606.30383","title":"Whose Side Is Your Agent On? Multi-Party Principal Loyalty in LLM Agents","created":"2026-06-29","cited_by_count":3,"area":null},{"id":"2608.22808","title":"CatchBench: When Can an Agent Failure Be Caught?","created":"2026-08-24","cited_by_count":3,"area":null},{"id":"2605.08310","title":"WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation","created":"2026-05-08","cited_by_count":2,"area":null},{"id":"2605.12233","title":"No More, No Less: Task Alignment in Terminal Agents","created":"2026-05-12","cited_by_count":2,"area":null},{"id":"2606.20510","title":"Efficient and Sound Probabilistic Verification for AI Agents","created":"2026-06-18","cited_by_count":2,"area":null},{"id":"2606.23449","title":"AOHP: An Open-Source OS-Level Agent Harness for Personalized, Efficient and Secure Interaction","created":"2026-06-22","cited_by_count":2,"area":null},{"id":"2607.02345","title":"SkillFuzz: Fuzzing Skill Composition for Implicit Intents Discovery in Open Skill Marketplaces","created":"2026-07-02","cited_by_count":2,"area":null},{"id":"2607.25364","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","created":"2026-07-28","cited_by_count":2,"area":null},{"id":"2607.26228","title":"Steering Instruction Hierarchies at Inference Time","created":"2026-07-28","cited_by_count":2,"area":null},{"id":"2609.11030","title":"The Agent Incident Registry: Toward Preventing Repeated AI Agent Failures","created":"2026-09-10","cited_by_count":2,"area":null},{"id":"2605.13213","title":"Hierarchical Attacks for Multi-Modal Multi-Agent Reasoning","created":"2026-05-13","cited_by_count":1,"area":null},{"id":"2605.15118","title":"Talk is (Not) Cheap: A Taxonomy and Benchmark Coverage Audit for LLM Attacks","created":"2026-05-14","cited_by_count":1,"area":null},{"id":"2606.18996","title":"TRAP: Benchmark for Task-completion and Resistance to Active Privacy-extraction","created":"2026-06-17","cited_by_count":1,"area":null},{"id":"2607.02814","title":"SovereignNegotiation-Bench: Evaluating User-Owned Personal Agents In Delegated Bargaining Under Privacy, Consent, Evidence, And Institutional Pressure","created":"2026-07-02","cited_by_count":1,"area":null},{"id":"2608.14992","title":"Does a Tool Result Carry More Authority Than Plain Text? Three Prospective Studies of False-Claim Adoption in a Synthetic Assignment Task with Claude Opus 5","created":"2026-08-15","cited_by_count":1,"area":null},{"id":"2608.21230","title":"Utility Under Attack: Agent Memory Poisoning and the Limits of Content Screening and Provenance Ranking","created":"2026-08-21","cited_by_count":1,"area":null},{"id":"2609.15017","title":"PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift","created":"2026-09-14","cited_by_count":1,"area":null},{"id":"2609.30325","title":"ScopeBench: Do Agents Preserve Engagement Boundaries Under Goal Pressure?","created":"2026-09-23","cited_by_count":1,"area":null},{"id":"2506.00197","title":"When GPT Spills the Tea: Comprehensive Assessment of Knowledge File Leakage in GPTs","created":"2025-05-30","cited_by_count":0,"area":null},{"id":"2510.16005","title":"Breaking Guardrails, Facing Walls: Insights on Adversarial AI for Defenders & Researchers","created":"2025-10-14","cited_by_count":0,"area":null},{"id":"2604.20704","title":"Auto-ART: Structured Literature Synthesis and Automated Adversarial Robustness Testing","created":"2026-04-22","cited_by_count":0,"area":null},{"id":"2605.09737","title":"System-Prompt Anchoring with Cross-Attention Layers","created":"2026-05-10","cited_by_count":0,"area":null},{"id":"2605.26159","title":"Device Context Protocol: A Compact, Safety-First Architecture for LLM-Driven Control of Constrained Devices","created":"2026-05-24","cited_by_count":0,"area":null},{"id":"2606.18120","title":"Structural Role Injection in Handlebars-Templated LLM Prompts: Triple-Brace Interpolation, Delimiter Family, and the Limits of HTML Auto-Escaping","created":"2026-06-16","cited_by_count":0,"area":null},{"id":"2606.31272","title":"The Decomposition Is the Fingerprint: Per-Component Identity for Agent Skills","created":"2026-06-30","cited_by_count":0,"area":null},{"id":"2607.05364","title":"REDDIT: Forgetting-Resistant Correction of Timestamp Drift in ASR via Replay-Based Distribution Editing","created":"2026-07-06","cited_by_count":0,"area":null},{"id":"2607.05484","title":"SHARC: SHAP-Based Interpretability in Machine Learning Risk Models for Regulatory Capital under ICAAP and CCAR","created":"2026-07-06","cited_by_count":0,"area":null},{"id":"2607.16660","title":"From Adoption to Deployment: A Qualitative Study on AI Integration in Software Development Practice","created":"2026-07-18","cited_by_count":0,"area":null},{"id":"2607.17986","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","created":"2026-07-20","cited_by_count":0,"area":null},{"id":"2607.19837","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","created":"2026-07-22","cited_by_count":0,"area":null},{"id":"2608.12789","title":"PIPES: Securing Agent Perception with Provenance and Priors","created":"2026-08-13","cited_by_count":0,"area":null},{"id":"2608.12880","title":"Labels Are Not Endpoints: Treatment Leakage and Construct Validity in MCP Agent Security Evaluation","created":"2026-08-13","cited_by_count":0,"area":null},{"id":"2609.00060","title":"A Formal Analysis of Agent Payment Protocols","created":"2026-08-30","cited_by_count":0,"area":null},{"id":"2609.13725","title":"IBBench-Light: A Paired Evaluation of Task-Conditioned Responses to External Directives","created":"2026-09-12","cited_by_count":0,"area":null},{"id":"2609.24927","title":"Et Tu, Brute? Economic Misalignment in Personal AI Agents","created":"2026-09-21","cited_by_count":0,"area":null},{"id":"2609.32915","title":"AgentTell: Behavioural Side-Channel Leakage in Browser-Use Agents","created":"2026-09-26","cited_by_count":0,"area":null},{"id":"2609.35381","title":"MCP Error Messages Written for Developers Hurt the Most Capable Agents Most","created":"2026-09-28","cited_by_count":0,"area":null},{"id":"2609.35814","title":"Constructing Challenging Browser-Use Tasks by Controlled Environment Interventions","created":"2026-09-20","cited_by_count":0,"area":null},{"id":"2609.38460","title":"NAQD Env: A benchmark for selective withdrawal in language agents","created":"2026-09-29","cited_by_count":0,"area":null},{"id":"2609.38469","title":"The Backdrop Exposes What the World Around an Agent Costs It","created":"2026-09-29","cited_by_count":0,"area":null},{"id":"2609.38983","title":"Approval Laundering: Systematizing Approval--Execution Binding Failures in AI Coding-Agent Harnesses","created":"2026-09-30","cited_by_count":0,"area":null},{"id":"2610.00354","title":"Proof-Gated Signing: Solver-Checked Transaction Guards that Hold Under State Drift for Onchain AI Agents","created":"2026-09-30","cited_by_count":0,"area":null},{"id":"2610.02920","title":"HASTE: Evolving Agent Harnesses Against Emerging Attacks Using Sparse Evidence","created":"2026-10-02","cited_by_count":0,"area":null},{"id":"2610.04210","title":"Can LLMs Separate Pasted Artifacts from User Speech? Absorption at Unmarked Prompt Seams","created":"2026-10-03","cited_by_count":0,"area":null},{"id":"2610.04975","title":"Runtime Authorization of Self-Generated Subgoals in Long-Horizon Tool-Using AI Agents","created":"2026-10-04","cited_by_count":0,"area":null},{"id":"2610.05139","title":"Hidden in the Comments: A Context-Injection Attack Surface in Code LLMs","created":"2026-10-04","cited_by_count":0,"area":null},{"id":"2610.06914","title":"A Governed Agent Architecture for Natural-Language Dashboard Generation over Enterprise DataBrain","created":"2026-10-02","cited_by_count":0,"area":null},{"id":"2610.13623","title":"APEX-Harm: Evaluating Agent Safety in Shared Professional Workspaces","created":"2026-10-09","cited_by_count":0,"area":null},{"id":"2610.15537","title":"Poisoned into Action: Context Attacks on Typed Decision Workflows","created":"2026-10-11","cited_by_count":0,"area":null},{"id":"2610.17820","title":"Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifiers","created":"2026-10-13","cited_by_count":0,"area":null}],"next_cursor":null}