{"total":130,"rows":[{"id":"2503.18813","title":"Defeating Prompt Injections by Design","created":"2025-03-24","cited_by_count":297,"area":"agents"},{"id":"2404.18231","title":"From Persona to Personalization: A Survey on Role-Playing Language Agents","created":"2024-04-28","cited_by_count":212,"area":"agents"},{"id":"2409.19091","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","created":"2024-09-27","cited_by_count":96,"area":"safety"},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73,"area":"agents"},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66,"area":"agents"},{"id":"2504.20984","title":"ACE: A Security Architecture for LLM-Integrated App Systems","created":"2025-04-29","cited_by_count":55,"area":null},{"id":"2407.14937","title":"Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)","created":"2024-07-20","cited_by_count":46,"area":"safety"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2601.08012","title":"Towards Verifiably Safe Tool Use for LLM Agents","created":"2026-01-12","cited_by_count":36,"area":"agents"},{"id":"2510.19207","title":"Defending Against Prompt Injection with DataFilter","created":"2025-10-22","cited_by_count":35,"area":"safety"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2604.16548","title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","created":"2026-04-17","cited_by_count":27,"area":"agents"},{"id":"2511.20597","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","created":"2025-11-25","cited_by_count":24,"area":"safety"},{"id":"2404.06921","title":"GoEX: Perspectives and Designs Towards a Runtime for Autonomous LLM Applications","created":"2024-04-10","cited_by_count":23,"area":null},{"id":"2504.03111","title":"Les Dissonances: Cross-Tool Harvesting and Polluting in Pool-of-Tools Empowered LLM Agents","created":"2025-04-04","cited_by_count":22,"area":"agents"},{"id":"2511.17959","title":"Towards Automating Data Access Permissions in AI Agents","created":"2025-11-22","cited_by_count":21,"area":null},{"id":"2603.15125","title":"From Storage to Steering: Memory Control Flow Attacks on LLM Agents","created":"2026-03-16","cited_by_count":19,"area":"agents"},{"id":"2604.03070","title":"How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study","created":"2026-04-03","cited_by_count":19,"area":"agents"},{"id":"2510.05244","title":"Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?","created":"2025-10-06","cited_by_count":18,"area":"safety"},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2601.10440","title":"AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior","created":"2026-01-15","cited_by_count":11,"area":null},{"id":"2508.20412","title":"MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoning","created":"2025-08-28","cited_by_count":10,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2509.25926","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","created":"2025-09-30","cited_by_count":9,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9,"area":"agents"},{"id":"2601.09625","title":"The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism","created":"2026-01-14","cited_by_count":9,"area":"safety"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2505.04799","title":"Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems","created":"2025-05-07","cited_by_count":8,"area":"agents"},{"id":"2603.12230","title":"Security Considerations for Artificial Intelligence Agents","created":"2026-03-12","cited_by_count":8,"area":null},{"id":"2403.13721","title":"Large Language Models meet Network Slicing Management and Orchestration","created":"2024-03-20","cited_by_count":7,"area":null},{"id":"2507.06323","title":"Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms","created":"2025-07-08","cited_by_count":7,"area":"agents"},{"id":"2601.07263","title":"When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent","created":"2026-01-12","cited_by_count":7,"area":"agents"},{"id":"2605.00314","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","created":"2026-05-01","cited_by_count":7,"area":"agents"},{"id":"2605.11770","title":"Behavioral Integrity Verification for AI Agent Skills","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2509.24380","title":"Agentic Services Computing","created":"2025-09-29","cited_by_count":6,"area":"agents"},{"id":"2512.05951","title":"Trusted AI Agents in the Cloud","created":"2025-12-05","cited_by_count":6,"area":"agents"},{"id":"2604.27202","title":"Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives","created":"2026-04-29","cited_by_count":6,"area":"safety"},{"id":"2607.01236","title":"Safeguarding LLM Agents from Misalignment through Provenance Analysis","created":"2026-05-01","cited_by_count":6,"area":"agents"},{"id":"2512.02321","title":"LeechHijack: Covert Computational Resource Exploitation in Intelligent Agent Systems","created":"2025-12-02","cited_by_count":5,"area":"agents"},{"id":"2603.17170","title":"Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices","created":"2026-03-17","cited_by_count":5,"area":null},{"id":"2603.20933","title":"AC4A: Access Control for Agents","created":"2026-03-21","cited_by_count":5,"area":"agents"},{"id":"2605.11360","title":"Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization","created":"2026-05-12","cited_by_count":5,"area":"agents"},{"id":"2605.13044","title":"No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills","created":"2026-05-13","cited_by_count":5,"area":"agents"},{"id":"2605.14932","title":"Toward Securing AI Agents Like Operating Systems","created":"2026-05-14","cited_by_count":5,"area":"agents"},{"id":"2608.21159","title":"AID-Guard: Stateful Authorization for Delegated Agent Effects","created":"2026-08-21","cited_by_count":5,"area":null},{"id":"2511.20284","title":"Can LLMs Make (Personalized) Access Control Decisions?","created":"2025-11-25","cited_by_count":4,"area":null},{"id":"2604.18231","title":"AgenTEE: Confidential LLM Agent Execution on Edge Devices","created":"2026-04-20","cited_by_count":4,"area":"agents"},{"id":"2604.19657","title":"An AI Agent Execution Environment to Safeguard User Data","created":"2026-04-21","cited_by_count":4,"area":null},{"id":"2607.13718","title":"How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement","created":"2026-07-15","cited_by_count":4,"area":"agents"},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3,"area":"agents"},{"id":"2602.14281","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents","created":"2026-02-15","cited_by_count":3,"area":"agents"},{"id":"2602.20493","title":"AWCP: A Workspace Delegation Protocol for Deep-Engagement Collaboration across Remote Agents","created":"2026-02-24","cited_by_count":3,"area":"agents"},{"id":"2604.06284","title":"ClawLess: A Security Model of AI Agents","created":"2026-04-07","cited_by_count":3,"area":"agents"},{"id":"2605.28071","title":"AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2607.14166","title":"Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives","created":"2026-07-15","cited_by_count":3,"area":"agents"},{"id":"2609.05269","title":"CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls","created":"2026-09-04","cited_by_count":3,"area":"agents"},{"id":"2601.23132","title":"Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines","created":"2026-01-30","cited_by_count":2,"area":null},{"id":"2604.12986","title":"Parallax: Why AI Agents That Think Must Never Act","created":"2026-04-14","cited_by_count":2,"area":"safety"},{"id":"2604.24920","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2606.12737","title":"PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections","created":"2026-06-10","cited_by_count":2,"area":"agents"},{"id":"2608.17597","title":"HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety","created":"2026-08-18","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2512.10563","title":"NormCode: A Semi-Formal Language for Auditable AI Planning","created":"2025-12-11","cited_by_count":1,"area":null},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2603.17639","title":"VeriGrey: Greybox Agent Validation","created":"2026-03-18","cited_by_count":1,"area":"agents"},{"id":"2605.16630","title":"PrivScope: Task-scoped Disclosure Control for Hybrid Agentic Systems","created":"2026-05-15","cited_by_count":1,"area":"agents"},{"id":"2605.17324","title":"ASPI: Seeking Ambiguity Clarification Amplifies Prompt Injection Vulnerability in LLM Agents","created":"2026-05-17","cited_by_count":1,"area":"agents"},{"id":"2606.15549","title":"One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents","created":"2026-06-14","cited_by_count":1,"area":"agents"},{"id":"2607.05120","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2607.05518","title":"aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2608.01117","title":"SoK: Intent-Oriented Systematization of Multi-Turn LLM Jailbreaks","created":"2026-08-02","cited_by_count":1,"area":"safety"},{"id":"2608.05430","title":"Robust Context-Aware Detection of Malicious Instructions in Text","created":"2026-08-05","cited_by_count":1,"area":"safety"},{"id":"2608.27990","title":"CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?","created":"2026-08-28","cited_by_count":1,"area":"agents"},{"id":"2609.14631","title":"LLM Agent Capabilities Should Follow Task Intent and Context Source","created":"2026-09-13","cited_by_count":1,"area":"agents"},{"id":"2609.15516","title":"Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems","created":"2026-09-14","cited_by_count":1,"area":"agents"},{"id":"2609.24446","title":"ActGov: Governing LLM Agent Actions via Policy-Constrained Validation","created":"2026-09-21","cited_by_count":1,"area":"agents"},{"id":"2512.06716","title":"SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injection","created":"2025-12-07","cited_by_count":0,"area":"agents"},{"id":"2602.19450","title":"Red-Teaming Claude Opus and ChatGPT-based Security Advisors for Trusted Execution Environments","created":"2026-02-23","cited_by_count":0,"area":"safety"},{"id":"2602.21127","title":"\"Are You Sure?\": An Empirical Study of Human Perception Vulnerability in LLM-Driven Agentic Systems","created":"2026-02-24","cited_by_count":0,"area":"agents"},{"id":"2605.02187","title":"Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents","created":"2026-05-04","cited_by_count":0,"area":"agents"},{"id":"2605.10907","title":"Engineering Robustness into Personal Agents with the AI Workflow Store","created":"2026-05-11","cited_by_count":0,"area":null},{"id":"2605.21694","title":"PocketAgents: A Manifest-Driven Library of Autonomous Defense Agents","created":"2026-05-20","cited_by_count":0,"area":"agents"},{"id":"2606.26627","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","created":"2026-06-25","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.05743","title":"The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities","created":"2026-07-07","cited_by_count":0,"area":"agents"},{"id":"2607.09489","title":"Ceci n'est pas une pipe: AI systems as semantic abstractions","created":"2026-07-10","cited_by_count":0,"area":null}],"next_cursor":"100"}