{"total":119,"rows":[{"id":"2504.11703","title":"Progent: Securing AI Agents with Privilege Control","created":"2025-04-16","cited_by_count":141,"area":"agents"},{"id":"2507.15219","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","created":"2025-07-21","cited_by_count":108,"area":"agents"},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66,"area":"agents"},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54,"area":"agents"},{"id":"2503.12188","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","created":"2025-03-15","cited_by_count":53,"area":"agents"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2510.04885","title":"RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection","created":"2025-10-06","cited_by_count":36,"area":"agents"},{"id":"2602.16708","title":"Formal Policy Enforcement for Real-World Agentic Systems","created":"2026-02-18","cited_by_count":33,"area":"agents"},{"id":"2509.22830","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","created":"2025-09-26","cited_by_count":31,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2603.11619","title":"Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats","created":"2026-03-12","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2506.01055","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","created":"2025-06-01","cited_by_count":26,"area":"agents"},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20,"area":"agents"},{"id":"2509.21011","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools","created":"2025-09-25","cited_by_count":18,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2604.23374","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","created":"2026-04-25","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2510.08829","title":"CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization","created":"2025-10-09","cited_by_count":12,"area":"agents"},{"id":"2510.11203","title":"TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detection","created":"2025-10-13","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2605.01970","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","created":"2026-05-03","cited_by_count":12,"area":"agents"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10,"area":"agents"},{"id":"2609.28613","title":"Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions","created":"2026-09-23","cited_by_count":10,"area":"agents"},{"id":"2509.25926","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","created":"2025-09-30","cited_by_count":9,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2512.00966","title":"Mitigating Indirect Prompt Injection via Instruction-Following Intent Analysis","created":"2025-11-30","cited_by_count":9,"area":"agents"},{"id":"2603.19423","title":"The Autonomy Tax: Defense Training Breaks LLM Agents","created":"2026-03-19","cited_by_count":9,"area":"agents"},{"id":"2603.30016","title":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","created":"2026-03-31","cited_by_count":9,"area":"agents"},{"id":"2606.23416","title":"Detecting Malicious Agent Skills in the Wild using Attention","created":"2026-06-22","cited_by_count":8,"area":"agents"},{"id":"2601.07263","title":"When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent","created":"2026-01-12","cited_by_count":7,"area":"agents"},{"id":"2603.02983","title":"Contextualized Privacy Defense for LLM Agents","created":"2026-03-03","cited_by_count":7,"area":"agents"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2512.00520","title":"Toward a Safe Internet of Agents","created":"2025-11-29","cited_by_count":6,"area":"agents"},{"id":"2602.16958","title":"Automating Agent Hijacking via Structural Template Injection","created":"2026-02-18","cited_by_count":6,"area":"agents"},{"id":"2604.24118","title":"AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization","created":"2026-04-27","cited_by_count":6,"area":"agents"},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5,"area":"agents"},{"id":"2510.13825","title":"A2AS: Agentic AI Runtime Security and Self-Defense","created":"2025-10-08","cited_by_count":5,"area":"agents"},{"id":"2605.05868","title":"SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skills","created":"2026-05-07","cited_by_count":5,"area":"agents"},{"id":"2605.13044","title":"No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills","created":"2026-05-13","cited_by_count":5,"area":"agents"},{"id":"2605.14932","title":"Toward Securing AI Agents Like Operating Systems","created":"2026-05-14","cited_by_count":5,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2604.10134","title":"PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3,"area":"agents"},{"id":"2605.16976","title":"Securing LLM Agents Need Intent-to-Execution Integrity","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2605.28071","title":"AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2607.12624","title":"PVDetector: Detecting Prompt Injection Attacks on Purpose-Specific LLM Agents through Policy-Violation Concept Analysis","created":"2026-07-14","cited_by_count":3,"area":"agents"},{"id":"2505.15738","title":"Checkpoint-GCG: Auditing and Attacking Fine-Tuning-Based Prompt Injection Defenses","created":"2025-05-21","cited_by_count":2,"area":"agents"},{"id":"2507.02699","title":"Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents","created":"2025-07-03","cited_by_count":2,"area":"agents"},{"id":"2510.03992","title":"Quantitative Certification of Agentic Tool Selection","created":"2025-10-05","cited_by_count":2,"area":"agents"},{"id":"2604.24920","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2606.12737","title":"PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections","created":"2026-06-10","cited_by_count":2,"area":"agents"},{"id":"2608.05563","title":"When Experience Becomes Instruction: Trajectory Poisoning in Self-Evolving Agent Skill Systems","created":"2026-08-06","cited_by_count":2,"area":"agents"},{"id":"2608.17597","title":"HarnessRisk: A Lifecycle-Oriented Benchmark for Agent Harness Safety","created":"2026-08-18","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.05903","title":"EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents","created":"2026-09-05","cited_by_count":2,"area":"agents"},{"id":"2609.07529","title":"CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2603.07496","title":"From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents","created":"2026-03-08","cited_by_count":1,"area":"agents"},{"id":"2605.11868","title":"IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection","created":"2026-05-12","cited_by_count":1,"area":"agents"},{"id":"2606.05233","title":"Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming","created":"2026-06-03","cited_by_count":1,"area":"agents"},{"id":"2607.23999","title":"ContainmentBench: Trace-Based Evaluation of Post-Exposure Containment in Tool-Using LLM Agents","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2607.24343","title":"Beyond Aggregate Risk: Role-Stratified Conformal Risk Control for LLM Tool Calls","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2608.04053","title":"AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection","created":"2026-08-04","cited_by_count":1,"area":"agents"},{"id":"2608.05108","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.27990","title":"CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?","created":"2026-08-28","cited_by_count":1,"area":"agents"},{"id":"2608.30041","title":"Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection","created":"2026-08-30","cited_by_count":1,"area":"agents"},{"id":"2609.09404","title":"An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks","created":"2026-09-08","cited_by_count":1,"area":"agents"},{"id":"2609.15516","title":"Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems","created":"2026-09-14","cited_by_count":1,"area":"agents"},{"id":"2610.05295","title":"Readable Before Actionable: Causal Tracing of Indirect Prompt Injection","created":"2026-10-04","cited_by_count":1,"area":"agents"},{"id":"2510.22963","title":"When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents","created":"2025-10-27","cited_by_count":0,"area":"agents"},{"id":"2512.24415","title":"Language Model Agents Under Attack: A Cross Model-Benchmark of Profit-Seeking Behaviors in Customer Service","created":"2025-12-30","cited_by_count":0,"area":"agents"},{"id":"2602.16520","title":"Recursive language models for jailbreak detection: a procedural defense for tool-augmented agents","created":"2026-02-18","cited_by_count":0,"area":"agents"},{"id":"2606.28739","title":"Agent Safety Is Action Alignment","created":"2026-06-27","cited_by_count":0,"area":"agents"},{"id":"2607.02857","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","created":"2026-07-03","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.12340","title":"Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents","created":"2026-07-14","cited_by_count":0,"area":"agents"},{"id":"2607.19595","title":"Twin Agent: Context Residual Compression for Privilege Separated Agents","created":"2026-07-21","cited_by_count":0,"area":"agents"},{"id":"2608.00426","title":"MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems","created":"2026-08-01","cited_by_count":0,"area":"agents"},{"id":"2608.04018","title":"Governing Execution Risk in Agentic AI Systems: A Trajectory-Guided Framework for Red Teaming","created":"2026-06-23","cited_by_count":0,"area":"agents"},{"id":"2608.09476","title":"ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents","created":"2026-08-10","cited_by_count":0,"area":"agents"},{"id":"2608.12172","title":"Rethinking Agent Security as a Networking Problem","created":"2026-08-12","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.24017","title":"WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents","created":"2026-08-25","cited_by_count":0,"area":"agents"},{"id":"2608.27092","title":"The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.27146","title":"When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.27800","title":"ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools","created":"2026-08-28","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}