{"total":44,"rows":[{"id":"2504.11703","title":"Progent: Securing AI Agents with Privilege Control","created":"2025-04-16","cited_by_count":141,"area":"agents"},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54,"area":"agents"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2502.01822","title":"Firewalls to Secure Dynamic LLM Agentic Networks","created":"2025-02-03","cited_by_count":36,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2509.23614","title":"PSG-Agent: Personality-Aware Safety Guardrail for LLM-based Agents","created":"2025-09-28","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2606.03895","title":"Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents","created":"2026-06-02","cited_by_count":10,"area":"agents"},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2606.26524","title":"VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills","created":"2026-06-25","cited_by_count":9,"area":"agents"},{"id":"2508.20282","title":"Network-Level Prompt and Trait Leakage in Local Research Agents","created":"2025-08-27","cited_by_count":5,"area":"agents"},{"id":"2603.20933","title":"AC4A: Access Control for Agents","created":"2026-03-21","cited_by_count":5,"area":"agents"},{"id":"2606.03518","title":"Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI","created":"2026-06-02","cited_by_count":5,"area":"agents"},{"id":"2512.05065","title":"Personalizing Agent Privacy Decisions via Logical Entailment","created":"2025-12-04","cited_by_count":4,"area":"agents"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2607.13718","title":"How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement","created":"2026-07-15","cited_by_count":4,"area":"agents"},{"id":"2606.26479","title":"Adaptive Evaluation of Out-of-Band Defenses Against Prompt Injection in LLM Agents","created":"2026-06-25","cited_by_count":3,"area":"agents"},{"id":"2607.01510","title":"Janus: a Playground for User-Involved Agentic Permission Management","created":"2026-07-01","cited_by_count":3,"area":"agents"},{"id":"2604.24920","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2606.26649","title":"Autoformalization of Agent Instructions into Policy-as-Code","created":"2026-06-25","cited_by_count":2,"area":"agents"},{"id":"2608.22868","title":"AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems","created":"2026-08-24","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2602.05386","title":"Spider-Sense: Intrinsic Risk Sensing for Efficient Agent Defense with Hierarchical Adaptive Screening","created":"2026-02-05","cited_by_count":1,"area":"agents"},{"id":"2605.12863","title":"Language-Based Agent Control","created":"2026-05-13","cited_by_count":1,"area":"agents"},{"id":"2605.20874","title":"Governance by Construction for Generalist Agents","created":"2026-05-20","cited_by_count":1,"area":"agents"},{"id":"2607.05120","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2607.22445","title":"Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture","created":"2026-07-24","cited_by_count":1,"area":"agents"},{"id":"2606.19380","title":"ClayBuddy: A Framework, Evaluation, & Mitigation of Coding Agent Failures","created":"2026-06-13","cited_by_count":0,"area":"agents"},{"id":"2606.25836","title":"AI Snitches Get Glitches: Towards Evading Agentic Surveillance","created":"2026-06-24","cited_by_count":0,"area":"agents"},{"id":"2607.02857","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","created":"2026-07-03","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2609.17817","title":"Reflections on Trusting Trust, Revisited: Contaminating Self-Modifying AI Coding Agents with Poisoned Benchmarks","created":"2026-09-15","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.35088","title":"When Valid Tool Calls Change Meaning: Formation-Consistent Dispatch for LLM Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.02569","title":"Pincer: Resource Authorization for Agents using a Digital Twin","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.12813","title":"VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails","created":"2026-10-08","cited_by_count":0,"area":"agents"}],"next_cursor":null}