{"total":80,"rows":[{"id":"2503.21460","title":"Large Language Model Agent: A Survey on Methodology, Applications and Challenges","created":"2025-03-27","cited_by_count":205,"area":"agents"},{"id":"2505.03574","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","created":"2025-05-06","cited_by_count":127,"area":"agents"},{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2502.05174","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","created":"2025-02-07","cited_by_count":77,"area":"agents"},{"id":"2508.15310","title":"IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents","created":"2025-08-21","cited_by_count":54,"area":"agents"},{"id":"2503.12188","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","created":"2025-03-15","cited_by_count":53,"area":"agents"},{"id":"2602.22724","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification","created":"2026-02-26","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2603.15125","title":"From Storage to Steering: Memory Control Flow Attacks on LLM Agents","created":"2026-03-16","cited_by_count":19,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2604.23374","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","created":"2026-04-25","cited_by_count":15,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2510.08829","title":"CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization","created":"2025-10-09","cited_by_count":12,"area":"agents"},{"id":"2510.11203","title":"TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detection","created":"2025-10-13","cited_by_count":12,"area":"agents"},{"id":"2607.20827","title":"Auditing Provenance Sensitivity in LLM Agent Action Selection","created":"2026-07-23","cited_by_count":12,"area":"agents"},{"id":"2508.04010","title":"HarmonyGuard: Toward Safety and Utility in Web Agents via Adaptive Policy Enhancement and Dual-Objective Optimization","created":"2025-08-06","cited_by_count":10,"area":"agents"},{"id":"2505.14289","title":"EVA: Evolving Semantic Adversaries for Red-Teaming GUI Agents Against Environmental Injection Attacks","created":"2025-05-20","cited_by_count":9,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2508.00935","title":"Measuring Harmfulness of Computer-Using Agents","created":"2025-07-31","cited_by_count":8,"area":"agents"},{"id":"2602.08995","title":"When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents","created":"2026-02-09","cited_by_count":8,"area":"agents"},{"id":"2602.19555","title":"SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime","created":"2026-02-23","cited_by_count":8,"area":"agents"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2602.20064","title":"The LLMbda Calculus: AI Agents, Conversations, and Information Flow","created":"2026-02-23","cited_by_count":4,"area":"agents"},{"id":"2603.28166","title":"Evaluating Privilege Usage of Agents with Real-World Tools","created":"2026-03-30","cited_by_count":4,"area":"agents"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2603.04469","title":"Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems","created":"2026-03-04","cited_by_count":3,"area":"agents"},{"id":"2603.26221","title":"Clawed and Dangerous: Can We Trust Open Agentic Systems?","created":"2026-03-27","cited_by_count":3,"area":"agents"},{"id":"2605.16976","title":"Securing LLM Agents Need Intent-to-Execution Integrity","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2603.24203","title":"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search","created":"2026-03-25","cited_by_count":2,"area":"agents"},{"id":"2605.11026","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","created":"2026-05-10","cited_by_count":2,"area":"agents"},{"id":"2605.12729","title":"Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety","created":"2026-05-12","cited_by_count":2,"area":"agents"},{"id":"2605.17453","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","created":"2026-05-17","cited_by_count":2,"area":"agents"},{"id":"2605.19192","title":"Hallucination as Exploit: Evidence-Carrying Multimodal Agents","created":"2026-05-18","cited_by_count":2,"area":"agents"},{"id":"2606.12737","title":"PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections","created":"2026-06-10","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2603.06394","title":"Talk Freely, Execute Strictly: Schema-Gated Agentic AI for Flexible and Reproducible Scientific Workflows","created":"2026-03-06","cited_by_count":1,"area":"agents"},{"id":"2606.10742","title":"MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents","created":"2026-06-09","cited_by_count":1,"area":"agents"},{"id":"2606.14517","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","created":"2026-06-12","cited_by_count":1,"area":"agents"},{"id":"2607.12406","title":"Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions","created":"2026-07-14","cited_by_count":1,"area":"agents"},{"id":"2607.20759","title":"IssueTrojanBench: Benchmarking AI Coding Agents Against Malicious Issue Requests","created":"2026-07-22","cited_by_count":1,"area":"agents"},{"id":"2607.21835","title":"ToolGuardian: Declarative Security for AI Agent-Tool Interactions","created":"2026-07-23","cited_by_count":1,"area":"agents"},{"id":"2607.23999","title":"ContainmentBench: Trace-Based Evaluation of Post-Exposure Containment in Tool-Using LLM Agents","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2608.04053","title":"AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection","created":"2026-08-04","cited_by_count":1,"area":"agents"},{"id":"2608.04626","title":"Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2609.32691","title":"Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection","created":"2026-09-26","cited_by_count":1,"area":"agents"},{"id":"2512.06716","title":"SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injection","created":"2025-12-07","cited_by_count":0,"area":"agents"},{"id":"2607.02857","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","created":"2026-07-03","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.17951","title":"RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control","created":"2026-07-20","cited_by_count":0,"area":"agents"},{"id":"2608.12172","title":"Rethinking Agent Security as a Networking Problem","created":"2026-08-12","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.21126","title":"TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents","created":"2026-08-21","cited_by_count":0,"area":"agents"},{"id":"2608.25817","title":"SkillShield: Prompt-Space Security Skills for LLM Coding Agents","created":"2026-08-26","cited_by_count":0,"area":"agents"},{"id":"2608.27146","title":"When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.02035","title":"Implicit Manipulation for Skill Selection in LLM Agents with Semantic Matching","created":"2026-09-02","cited_by_count":0,"area":"agents"},{"id":"2609.03450","title":"Plan Pointers and Record-Directive Form in Budgeted Verification of Inherited Agent Memory","created":"2026-09-03","cited_by_count":0,"area":"agents"},{"id":"2609.14987","title":"ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.16098","title":"Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.23498","title":"Runtime Authorization Consistency Checking for MCP-based Agentic Workflows","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.27155","title":"The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems","created":"2026-09-22","cited_by_count":0,"area":"agents"},{"id":"2609.29547","title":"When Agents Act Unwatched: The Reduced-Supervision Paradox in Agentic AI","created":"2026-08-28","cited_by_count":0,"area":"agents"},{"id":"2609.34245","title":"Certified Multi-Source Integrity for Structured Agent Actions","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.39450","title":"ActionGuard: Tool Call Authorization under Poisoned Skills","created":"2026-09-30","cited_by_count":0,"area":"agents"},{"id":"2609.39549","title":"Speculative Safety Honeypot: Toward Proactive Defense Against Multi-turn Agent Attacks","created":"2026-09-30","cited_by_count":0,"area":"agents"},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.03585","title":"Threat-Preserving Representation Sensitivity in Agent-Security Benchmarks","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.05563","title":"G-CARB: Graph-Localized Conformal Agent Risk Budget for Compositional Harm","created":"2026-10-04","cited_by_count":0,"area":"agents"},{"id":"2610.06966","title":"APEX: Active Protection at Execution Boundaries for LLM Agents","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.14431","title":"MemForm: Benchmarking Memory Formation Poisoning in LLM Agents","created":"2026-10-10","cited_by_count":0,"area":"agents"},{"id":"2610.15390","title":"From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agents","created":"2026-10-11","cited_by_count":0,"area":"agents"},{"id":"2610.18206","title":"SWE-MISBEHAVIOR: Benchmarking and Mitigating Boundary Violations in Software Coding Agents","created":"2026-10-13","cited_by_count":0,"area":"agents"}],"next_cursor":null}