{"total":69,"rows":[{"id":"2503.18813","title":"Defeating Prompt Injections by Design","created":"2025-03-24","cited_by_count":297,"area":"agents"},{"id":"2503.21460","title":"Large Language Model Agent: A Survey on Methodology, Applications and Challenges","created":"2025-03-27","cited_by_count":205,"area":"agents"},{"id":"2505.23643","title":"Securing AI Agents with Information-Flow Control","created":"2025-05-29","cited_by_count":121,"area":null},{"id":"2504.15585","title":"A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment","created":"2025-04-22","cited_by_count":116,"area":"lr"},{"id":"2503.23350","title":"A Survey of WebAgents: Towards Next-Generation AI Agents for Web Automation with Large Foundation Models","created":"2025-03-30","cited_by_count":87,"area":"agents"},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66,"area":"agents"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2601.08012","title":"Towards Verifiably Safe Tool Use for LLM Agents","created":"2026-01-12","cited_by_count":36,"area":"agents"},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2506.01055","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","created":"2025-06-01","cited_by_count":26,"area":"agents"},{"id":"2505.10924","title":"A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?","created":"2025-05-16","cited_by_count":23,"area":"agents"},{"id":"2507.13686","title":"TopicAttack: An Indirect Prompt Injection Attack via Topic Transition","created":"2025-07-18","cited_by_count":17,"area":"safety"},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17,"area":"agents"},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2604.23374","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","created":"2026-04-25","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2605.28914","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","created":"2026-05-27","cited_by_count":13,"area":"agents"},{"id":"2505.17767","title":"Position: The Real Barrier to LLM Agent Usability is Agentic ROI","created":"2025-05-23","cited_by_count":12,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2601.10440","title":"AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior","created":"2026-01-15","cited_by_count":11,"area":null},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.11416","title":"Optimizing Agent Planning for Security and Autonomy","created":"2026-02-11","cited_by_count":10,"area":"safety"},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9,"area":"agents"},{"id":"2601.09625","title":"The Promptware Kill Chain: How Prompt Injections Gradually Evolved Into a Multistep Malware Delivery Mechanism","created":"2026-01-14","cited_by_count":9,"area":"safety"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2605.00314","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","created":"2026-05-01","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.28061","title":"ToolPrivacyBench: Benchmarking Purpose-Bound Privacy in Tool-Using LLM Agents","created":"2026-06-26","cited_by_count":7,"area":"agents"},{"id":"2604.19657","title":"An AI Agent Execution Environment to Safeguard User Data","created":"2026-04-21","cited_by_count":4,"area":null},{"id":"2509.14608","title":"Enterprise AI Must Enforce Participant-Aware Access Control","created":"2025-09-18","cited_by_count":3,"area":null},{"id":"2603.26221","title":"Clawed and Dangerous: Can We Trust Open Agentic Systems?","created":"2026-03-27","cited_by_count":3,"area":"agents"},{"id":"2604.10286","title":"STARS: Skill-Triggered Audit for Request-Conditioned Invocation Safety in Agent Systems","created":"2026-04-11","cited_by_count":3,"area":"agents"},{"id":"2606.01991","title":"SafeMCP: Proactive Power Regulation for LLM Agent Defense via Environment-Grounded Look-Ahead Reasoning","created":"2026-06-01","cited_by_count":3,"area":"lr"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2508.06418","title":"Quantifying Conversation Drift in MCP via Latent Polytope","created":"2025-08-08","cited_by_count":2,"area":"agents"},{"id":"2603.24203","title":"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search","created":"2026-03-25","cited_by_count":2,"area":"agents"},{"id":"2604.15579","title":"Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents","created":"2026-04-16","cited_by_count":2,"area":"safety"},{"id":"2608.16032","title":"Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened","created":"2026-08-17","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2604.04035","title":"Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agents","created":"2026-04-05","cited_by_count":1,"area":"agents"},{"id":"2606.23277","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","created":"2026-06-22","cited_by_count":1,"area":"agents"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2607.19356","title":"NEXUS: Structured Runtime Safety for Tool-Using LLM Agents","created":"2026-05-25","cited_by_count":1,"area":"agents"},{"id":"2608.24957","title":"ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure","created":"2026-08-25","cited_by_count":1,"area":"agents"},{"id":"2605.03129","title":"PIIGuard: Mitigating PII Harvesting under Adversarial Sanitization","created":"2026-05-04","cited_by_count":0,"area":null},{"id":"2605.03213","title":"When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI","created":"2026-05-04","cited_by_count":0,"area":"agents"},{"id":"2605.29224","title":"Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2606.12341","title":"OCELOT: Inference-Leakage Budgets for Privacy-Preserving LLM Agents","created":"2026-06-10","cited_by_count":0,"area":"agents"},{"id":"2606.26627","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","created":"2026-06-25","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.18847","title":"Data Leakage Prevention in Agentic Applications via Preemptive Hardening","created":"2026-07-21","cited_by_count":0,"area":"agents"},{"id":"2607.29405","title":"Beyond Component Testing: Validating Agentic AI Systems","created":"2026-07-31","cited_by_count":0,"area":"agents"},{"id":"2608.10530","title":"On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models","created":"2026-08-11","cited_by_count":0,"area":"agents"},{"id":"2608.12172","title":"Rethinking Agent Security as a Networking Problem","created":"2026-08-12","cited_by_count":0,"area":"agents"},{"id":"2608.27092","title":"The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.27146","title":"When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.05911","title":"Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents","created":"2026-09-05","cited_by_count":0,"area":"agents"},{"id":"2609.18128","title":"Symbolic Temporal Supervision of LLM Agents Using Contracts","created":"2026-09-16","cited_by_count":0,"area":"agents"},{"id":"2609.27542","title":"Control-Token Injection Suppresses Chain-of-Thought and Defeats Reasoning-Based Oversight in Tool-Using Agents","created":"2026-09-23","cited_by_count":0,"area":"agents"},{"id":"2609.36414","title":"Eternal Sunshine of the Spotless Mind: Systematically Erasing LLM's Memories","created":"2026-09-29","cited_by_count":0,"area":null},{"id":"2610.00797","title":"Sapien: A Stateful Policy Engine for Autonomous AI Agents","created":"2026-09-30","cited_by_count":0,"area":null},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.03089","title":"Securing Computer-Use Agents Against Branch Steering Attacks","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.06966","title":"APEX: Active Protection at Execution Boundaries for LLM Agents","created":"2026-10-03","cited_by_count":0,"area":"agents"}],"next_cursor":null}