{"total":60,"rows":[{"id":"2504.01990","title":"Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systems","created":"2025-03-31","cited_by_count":126,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30,"area":"agents"},{"id":"2602.22724","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification","created":"2026-02-26","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2505.10924","title":"A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?","created":"2025-05-16","cited_by_count":23,"area":"agents"},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2606.07131","title":"MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills","created":"2026-06-05","cited_by_count":19,"area":"agents"},{"id":"2601.05755","title":"VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit","created":"2026-01-09","cited_by_count":17,"area":"agents"},{"id":"2602.07918","title":"CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution","created":"2026-02-08","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13,"area":"agents"},{"id":"2510.08829","title":"CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization","created":"2025-10-09","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2601.12449","title":"AgenTRIM: Tool Risk Mitigation for Agentic AI","created":"2026-01-18","cited_by_count":11,"area":"agents"},{"id":"2508.20412","title":"MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoning","created":"2025-08-28","cited_by_count":10,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10,"area":"agents"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.01710","title":"Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions","created":"2026-08-03","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2512.05951","title":"Trusted AI Agents in the Cloud","created":"2025-12-05","cited_by_count":6,"area":"agents"},{"id":"2601.22569","title":"Whispers of Wealth: Red-Teaming Google's Agent Payments Protocol via Prompt Injection","created":"2026-01-30","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2606.20922","title":"Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning","created":"2026-06-18","cited_by_count":3,"area":"agents"},{"id":"2605.11026","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","created":"2026-05-10","cited_by_count":2,"area":"agents"},{"id":"2606.12737","title":"PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections","created":"2026-06-10","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.06972","title":"AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2604.07831","title":"Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection","created":"2026-04-09","cited_by_count":1,"area":"agents"},{"id":"2606.14517","title":"From Shield to Target: Denial-of-Service Attacks on LLM-Based Agent Guardrails","created":"2026-06-12","cited_by_count":1,"area":"agents"},{"id":"2608.04053","title":"AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection","created":"2026-08-04","cited_by_count":1,"area":"agents"},{"id":"2608.29942","title":"Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents","created":"2026-08-30","cited_by_count":1,"area":"agents"},{"id":"2609.09404","title":"An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks","created":"2026-09-08","cited_by_count":1,"area":"agents"},{"id":"2609.32691","title":"Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection","created":"2026-09-26","cited_by_count":1,"area":"agents"},{"id":"2606.04141","title":"Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents","created":"2026-06-02","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.05743","title":"The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities","created":"2026-07-07","cited_by_count":0,"area":"agents"},{"id":"2608.04018","title":"Governing Execution Risk in Agentic AI Systems: A Trajectory-Guided Framework for Red Teaming","created":"2026-06-23","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.24017","title":"WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents","created":"2026-08-25","cited_by_count":0,"area":"agents"},{"id":"2608.25711","title":"Reassembling Distributed Risk: Trajectory-Conditioned Action Generation for Multi-Turn Agent Safety","created":"2026-08-26","cited_by_count":0,"area":"agents"},{"id":"2608.27146","title":"When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.10892","title":"DriftNet: A Dual-Head Trajectory Transformer for Detecting and Localizing Prompt Injection in LLM Agents","created":"2026-09-09","cited_by_count":0,"area":"agents"},{"id":"2609.14987","title":"ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.27542","title":"Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents","created":"2026-09-23","cited_by_count":0,"area":"agents"},{"id":"2609.29697","title":"Understanding and Exploiting Initialization Anchoring Weakness in Feedback-Based Agent Planning","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.34245","title":"Certified Multi-Source Integrity for Structured Agent Actions","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.34463","title":"CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.36570","title":"CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2609.36576","title":"Divide and Inject: Can Agents Reconstruct an Indirect Prompt Injection from Fragments?","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2609.39549","title":"Speculative Safety Honeypot: Toward Proactive Defense Against Multi-turn Agent Attacks","created":"2026-09-30","cited_by_count":0,"area":"agents"},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.03089","title":"Securing Computer-Use Agents Against Branch Steering Attacks","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.03585","title":"Threat-Preserving Representation Sensitivity in Agent-Security Benchmarks","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.06966","title":"APEX: Active Protection at Execution Boundaries for LLM Agents","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.07089","title":"Towards a Unified Misuse Monitoring Benchmark","created":"2026-10-05","cited_by_count":0,"area":"agents"}],"next_cursor":null}