{"total":184,"rows":[{"id":"2503.18813","title":"Defeating Prompt Injections by Design","created":"2025-03-24","cited_by_count":297,"area":"agents"},{"id":"2504.18575","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","created":"2025-04-22","cited_by_count":157,"area":"agents"},{"id":"2409.11295","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","created":"2024-09-17","cited_by_count":150,"area":"agents"},{"id":"2406.13352","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","created":"2024-06-19","cited_by_count":145,"area":"agents"},{"id":"2504.11703","title":"Progent: Securing AI Agents with Privilege Control","created":"2025-04-16","cited_by_count":141,"area":"agents"},{"id":"2505.03574","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","created":"2025-05-06","cited_by_count":127,"area":"agents"},{"id":"2406.12814","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","created":"2024-06-18","cited_by_count":120,"area":"agents"},{"id":"2411.02391","title":"Attacking Vision-Language Computer Agents via Pop-ups","created":"2024-11-04","cited_by_count":116,"area":"agents"},{"id":"2507.15219","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","created":"2025-07-21","cited_by_count":108,"area":"agents"},{"id":"2412.16682","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","created":"2024-12-21","cited_by_count":99,"area":"agents"},{"id":"2405.05175","title":"AirGapAgent: Protecting Privacy-Conscious Conversational Agents","created":"2024-05-08","cited_by_count":94,"area":"agents"},{"id":"2602.20156","title":"Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks","created":"2026-02-23","cited_by_count":90,"area":"agents"},{"id":"2502.05174","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","created":"2025-02-07","cited_by_count":77,"area":"agents"},{"id":"2411.09523","title":"Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents","created":"2024-11-14","cited_by_count":65,"area":"agents"},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54,"area":"agents"},{"id":"2503.12188","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","created":"2025-03-15","cited_by_count":53,"area":"agents"},{"id":"2505.16944","title":"AGENTIF: Benchmarking Instruction Following of Large Language Models in Agentic Scenarios","created":"2025-05-22","cited_by_count":49,"area":"agents"},{"id":"2505.18878","title":"CRMArena-Pro: Holistic Assessment of LLM Agents Across Diverse Business Scenarios and Interactions","created":"2025-05-24","cited_by_count":47,"area":"agents"},{"id":"2505.21936","title":"RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments","created":"2025-05-28","cited_by_count":46,"area":"agents"},{"id":"2606.04990","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","created":"2026-06-03","cited_by_count":37,"area":"agents"},{"id":"2510.04885","title":"RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection","created":"2025-10-06","cited_by_count":36,"area":"agents"},{"id":"2510.26328","title":"Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections","created":"2025-10-30","cited_by_count":33,"area":"agents"},{"id":"2602.16708","title":"Formal Policy Enforcement for Real-World Agentic Systems","created":"2026-02-18","cited_by_count":33,"area":"agents"},{"id":"2409.09013","title":"AI-LieDar: Examine the Trade-off Between Utility and Truthfulness in LLM Agents","created":"2024-09-13","cited_by_count":31,"area":"agents"},{"id":"2508.19461","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","created":"2025-08-26","cited_by_count":31,"area":"agents"},{"id":"2509.22830","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","created":"2025-09-26","cited_by_count":31,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2602.22724","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification","created":"2026-02-26","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2406.08689","title":"Security of AI Agents","created":"2024-06-12","cited_by_count":26,"area":"agents"},{"id":"2602.14211","title":"SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents","created":"2026-02-15","cited_by_count":25,"area":"agents"},{"id":"2606.17573","title":"Cordon: Semantic Transactions for Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":22,"area":"agents"},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2604.06550","title":"SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills","created":"2026-04-08","cited_by_count":20,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2604.23374","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","created":"2026-04-25","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2602.08235","title":"When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents","created":"2026-02-09","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2604.02837","title":"Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis","created":"2026-04-03","cited_by_count":13,"area":"agents"},{"id":"2510.08829","title":"CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization","created":"2025-10-09","cited_by_count":12,"area":"agents"},{"id":"2510.11203","title":"TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detection","created":"2025-10-13","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2605.01970","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","created":"2026-05-03","cited_by_count":12,"area":"agents"},{"id":"2607.20827","title":"Auditing Provenance Sensitivity in LLM Agent Action Selection","created":"2026-07-23","cited_by_count":12,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2505.21069","title":"CXXCrafter: An LLM-Based Agent for Automated C/C++ Open Source Software Building","created":"2025-05-27","cited_by_count":10,"area":"agents"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2508.04010","title":"HarmonyGuard: Toward Safety and Utility in Web Agents via Adaptive Policy Enhancement and Dual-Objective Optimization","created":"2025-08-06","cited_by_count":10,"area":"agents"},{"id":"2606.06087","title":"LatentSkill: From In-Context Textual Skills to In-Weight Latent Skills for LLM Agents","created":"2026-06-04","cited_by_count":10,"area":"agents"},{"id":"2607.06000","title":"Context-to-Execution Integrity for LLM Agents","created":"2026-07-07","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9,"area":"agents"},{"id":"2603.03258","title":"Inherited Goal Drift: Contextual Pressure Can Undermine Agentic Goals","created":"2026-03-03","cited_by_count":9,"area":"agents"},{"id":"2603.19423","title":"The Autonomy Tax: Defense Training Breaks LLM Agents","created":"2026-03-19","cited_by_count":9,"area":"agents"},{"id":"2603.30016","title":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","created":"2026-03-31","cited_by_count":9,"area":"agents"},{"id":"2603.19974","title":"Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance","created":"2026-03-20","cited_by_count":8,"area":"agents"},{"id":"2603.02983","title":"Contextualized Privacy Defense for LLM Agents","created":"2026-03-03","cited_by_count":7,"area":"agents"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2602.22303","title":"Training Agents to Self-Report Misbehavior","created":"2026-02-25","cited_by_count":6,"area":"agents"},{"id":"2604.09443","title":"Many-Tier Instruction Hierarchy in LLM Agents","created":"2026-04-10","cited_by_count":6,"area":"agents"},{"id":"2605.02812","title":"Autonomous LLM Agent Worms: Cross-Platform Propagation, Automated Discovery and Temporal Re-Entry Defense","created":"2026-05-04","cited_by_count":6,"area":"agents"},{"id":"2605.23989","title":"Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security","created":"2026-05-17","cited_by_count":5,"area":"agents"},{"id":"2606.14154","title":"SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills","created":"2026-06-12","cited_by_count":5,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2606.30755","title":"Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens","created":"2026-06-29","cited_by_count":5,"area":"agents"},{"id":"2509.23694","title":"SafeSearch: Automated Red-Teaming of LLM-Based Search Agents","created":"2025-09-28","cited_by_count":4,"area":"agents"},{"id":"2601.21233","title":"Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs","created":"2026-01-29","cited_by_count":4,"area":"agents"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2607.10490","title":"NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations","created":"2026-07-11","cited_by_count":4,"area":"agents"},{"id":"2608.11727","title":"Harness-IF: Evaluating Instruction Following Across Instruction Surfaces in Coding Agents","created":"2026-08-12","cited_by_count":4,"area":"agents"},{"id":"2608.12323","title":"Why Do AI Agents Break Rules? How Framing, Context, and Social Signals Shape Compliance","created":"2026-05-29","cited_by_count":4,"area":"agents"},{"id":"2510.09093","title":"Exploiting Web Search Tools of AI Agents for Data Exfiltration","created":"2025-10-10","cited_by_count":3,"area":"agents"},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3,"area":"agents"},{"id":"2604.12284","title":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","created":"2026-04-14","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2606.01567","title":"Defenses & Enablers For Skill Injection Attacks on Terminal Based Agents","created":"2026-06-01","cited_by_count":3,"area":"agents"},{"id":"2606.21409","title":"Don't Blindly Trust It: How Unreliable Feedback Breaks Tool-Using LLM Agents","created":"2026-06-19","cited_by_count":3,"area":"agents"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2607.12624","title":"PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis","created":"2026-07-14","cited_by_count":3,"area":"agents"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2505.15738","title":"Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defenses","created":"2025-05-21","cited_by_count":2,"area":"agents"},{"id":"2506.02357","title":"Evaluating LLM Agent Adherence to Hierarchical Safety Principles: A Lightweight Benchmark for Probing Foundational Controllability Components","created":"2025-06-03","cited_by_count":2,"area":"agents"},{"id":"2602.21447","title":"Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG","created":"2026-02-24","cited_by_count":2,"area":"agents"},{"id":"2603.13424","title":"Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection","created":"2026-03-13","cited_by_count":2,"area":"agents"},{"id":"2603.18245","title":"Who Tests the Testers? Systematic Enumeration and Coverage Audit of LLM Agent Tool Call Safety","created":"2026-03-18","cited_by_count":2,"area":"agents"},{"id":"2605.08460","title":"When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks","created":"2026-05-08","cited_by_count":2,"area":"agents"},{"id":"2606.02240","title":"AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations","created":"2026-06-01","cited_by_count":2,"area":"agents"},{"id":"2606.06460","title":"Will the Agent Recuse, and Will It Stop? Measuring LLM-Agent Compliance with In-Band Governance Signals at the Access Door and Mid-Flight","created":"2026-06-04","cited_by_count":2,"area":"agents"},{"id":"2606.18356","title":"SafeClawBench: Separating Semantic, Audit-Evidence, and Sandbox Harm in Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":2,"area":"agents"},{"id":"2607.09016","title":"SLBench: Evaluating How LLM Agents Follow Logical Relations in Skills","created":"2026-07-10","cited_by_count":2,"area":"agents"},{"id":"2607.25398","title":"HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following","created":"2026-07-28","cited_by_count":2,"area":"agents"}],"next_cursor":"100"}