{"total":59,"rows":[{"id":"2503.18813","title":"Defeating Prompt Injections by Design","created":"2025-03-24","cited_by_count":297,"area":"agents"},{"id":"2504.11703","title":"Progent: Securing AI Agents with Privilege Control","created":"2025-04-16","cited_by_count":141,"area":"agents"},{"id":"2507.15219","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","created":"2025-07-21","cited_by_count":108,"area":"agents"},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87,"area":"agents"},{"id":"2502.05174","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","created":"2025-02-07","cited_by_count":77,"area":"agents"},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66,"area":"agents"},{"id":"2503.12188","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","created":"2025-03-15","cited_by_count":53,"area":"agents"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2502.01822","title":"Firewalls to Secure Dynamic LLM Agentic Networks","created":"2025-02-03","cited_by_count":36,"area":"agents"},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2502.20383","title":"Why Are Web AI Agents More Vulnerable Than Standalone LLMs? A Security Analysis","created":"2025-02-27","cited_by_count":27,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2510.11203","title":"TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detection","created":"2025-10-13","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2505.13076","title":"The Hidden Dangers of Browsing AI Agents","created":"2025-05-19","cited_by_count":11,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2606.03895","title":"Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents","created":"2026-06-02","cited_by_count":10,"area":"agents"},{"id":"2509.25926","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","created":"2025-09-30","cited_by_count":9,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2512.00966","title":"Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysis","created":"2025-11-30","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2505.04799","title":"Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems","created":"2025-05-07","cited_by_count":8,"area":"agents"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2603.20933","title":"AC4A: Access Control for Agents","created":"2026-03-21","cited_by_count":5,"area":"agents"},{"id":"2605.14932","title":"Toward Securing AI Agents Like Operating Systems","created":"2026-05-14","cited_by_count":5,"area":"agents"},{"id":"2602.20064","title":"The LLMbda Calculus: AI Agents, Conversations, and Information Flow","created":"2026-02-23","cited_by_count":4,"area":"agents"},{"id":"2607.13718","title":"How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement","created":"2026-07-15","cited_by_count":4,"area":"agents"},{"id":"2607.29167","title":"Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory","created":"2026-07-31","cited_by_count":4,"area":"agents"},{"id":"2510.21057","title":"Soft Instruction De-escalation Defense","created":"2025-10-24","cited_by_count":3,"area":"agents"},{"id":"2605.16976","title":"Securing LLM Agents Need Intent-to-Execution Integrity","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2603.13424","title":"Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection","created":"2026-03-13","cited_by_count":2,"area":"agents"},{"id":"2605.19192","title":"Hallucination as Exploit: Evidence-Carrying Multimodal Agents","created":"2026-05-18","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2606.23277","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","created":"2026-06-22","cited_by_count":1,"area":"agents"},{"id":"2607.05120","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2609.24446","title":"ActGov: Governing LLM Agent Actions via Policy-Constrained Validation","created":"2026-09-21","cited_by_count":1,"area":"agents"},{"id":"2606.26627","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","created":"2026-06-25","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.27009","title":"The Guard That Cried Wolf: How Scary Words Make Agent Guardrails Refuse Legitimate Actions","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.27141","title":"Safety Does Not Compose: Non-Decaying Loop State for Autonomous LLM Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.27234","title":"SPA: Securing Persistent LLM Agents Across Queries with Plan-First Information-Flow Control","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.05911","title":"Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents","created":"2026-09-05","cited_by_count":0,"area":"agents"},{"id":"2609.14003","title":"Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control","created":"2026-09-12","cited_by_count":0,"area":"agents"},{"id":"2609.31318","title":"AgentXploit: Autonomous Repository-to-Runtime Red-Teaming for AI Agents","created":"2026-09-25","cited_by_count":0,"area":"agents"}],"next_cursor":null}