{"total":85,"rows":[{"id":"2507.21504","title":"Evaluation and Benchmarking of LLM Agents: A Survey","created":"2025-07-29","cited_by_count":152,"area":"agents"},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87,"area":"agents"},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58,"area":"agents"},{"id":"2508.15310","title":"IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents","created":"2025-08-21","cited_by_count":54,"area":"agents"},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2509.17488","title":"Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents","created":"2025-09-22","cited_by_count":36,"area":"agents"},{"id":"2510.26328","title":"Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections","created":"2025-10-30","cited_by_count":33,"area":"agents"},{"id":"2509.22830","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","created":"2025-09-26","cited_by_count":31,"area":"agents"},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30,"area":"agents"},{"id":"2506.23844","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","created":"2025-06-30","cited_by_count":29,"area":"agents"},{"id":"2602.22724","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification","created":"2026-02-26","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2505.10924","title":"A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?","created":"2025-05-16","cited_by_count":23,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2510.03204","title":"FocusAgent: Simple Yet Effective Ways of Trimming the Large Context of Web Agents","created":"2025-10-03","cited_by_count":16,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2507.14799","title":"Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree","created":"2025-07-20","cited_by_count":14,"area":"agents"},{"id":"2601.12560","title":"Agentic Artificial Intelligence (AI): Architectures, Taxonomies, and Evaluation of Large Language Model Agents","created":"2026-01-18","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13,"area":"agents"},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.17622","title":"What Makes a Good LLM Agent for Real-world Penetration Testing?","created":"2026-02-19","cited_by_count":10,"area":"agents"},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10,"area":"agents"},{"id":"2609.28613","title":"Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions","created":"2026-09-23","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2509.25624","title":"STAC: When Innocent Tools Form Dangerous Chains for LLM Agents","created":"2025-09-30","cited_by_count":8,"area":"agents"},{"id":"2510.22620","title":"Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents","created":"2025-10-26","cited_by_count":8,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2602.16958","title":"Automating Agent Hijacking via Structural Template Injection","created":"2026-02-18","cited_by_count":6,"area":"agents"},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5,"area":"agents"},{"id":"2605.23989","title":"Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security","created":"2026-05-17","cited_by_count":5,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2607.10490","title":"NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations","created":"2026-07-11","cited_by_count":4,"area":"agents"},{"id":"2510.21057","title":"Soft Instruction De-escalation Defense","created":"2025-10-24","cited_by_count":3,"area":"agents"},{"id":"2602.14281","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents","created":"2026-02-15","cited_by_count":3,"area":"agents"},{"id":"2605.16976","title":"Securing LLM Agents Need Intent-to-Execution Integrity","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2605.28071","title":"AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2510.23675","title":"QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents","created":"2025-10-27","cited_by_count":2,"area":"agents"},{"id":"2603.24203","title":"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search","created":"2026-03-25","cited_by_count":2,"area":"agents"},{"id":"2605.12729","title":"Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety","created":"2026-05-12","cited_by_count":2,"area":"agents"},{"id":"2607.11698","title":"Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming","created":"2026-07-13","cited_by_count":2,"area":"agents"},{"id":"2608.16032","title":"Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened","created":"2026-08-17","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.05903","title":"EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents","created":"2026-09-05","cited_by_count":2,"area":"agents"},{"id":"2609.07529","title":"CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2602.05066","title":"Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks","created":"2026-02-04","cited_by_count":1,"area":"agents"},{"id":"2603.07496","title":"From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents","created":"2026-03-08","cited_by_count":1,"area":"agents"},{"id":"2605.00081","title":"Alignment Contracts for Agentic Security Systems","created":"2026-04-30","cited_by_count":1,"area":"agents"},{"id":"2606.00611","title":"TRACE: Trajectory Risk-Aware Compression for Long-Horizon Agent Safety","created":"2026-05-30","cited_by_count":1,"area":"agents"},{"id":"2606.23277","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","created":"2026-06-22","cited_by_count":1,"area":"agents"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2607.23999","title":"ContainmentBench: Trace-Based Evaluation of Post-Exposure Containment in Tool-Using LLM Agents","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2609.32691","title":"Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection","created":"2026-09-26","cited_by_count":1,"area":"agents"},{"id":"2604.27464","title":"Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study","created":"2026-04-30","cited_by_count":0,"area":"agents"},{"id":"2605.30454","title":"The Surface You Test Is Not the Surface That Breaks","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2606.00914","title":"Adversarial Feeds Steer LLM Agent Decisions Against Their Defaults","created":"2026-05-30","cited_by_count":0,"area":"agents"},{"id":"2606.07992","title":"VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation","created":"2026-06-06","cited_by_count":0,"area":"agents"},{"id":"2606.21071","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","created":"2026-06-19","cited_by_count":0,"area":"agents"},{"id":"2607.16199","title":"PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection","created":"2026-04-30","cited_by_count":0,"area":"agents"},{"id":"2607.24964","title":"ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments","created":"2026-07-27","cited_by_count":0,"area":"agents"},{"id":"2608.00426","title":"MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems","created":"2026-08-01","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.20658","title":"The Claws in Plain Sight: Unauthorized Context Disclosure through LLM Agent Tool Calls","created":"2026-08-21","cited_by_count":0,"area":"agents"},{"id":"2608.27092","title":"The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.30207","title":"SIR: Self-improving Red-teaming for Compute Use Agents","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.14003","title":"Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control","created":"2026-09-12","cited_by_count":0,"area":"agents"},{"id":"2609.14987","title":"ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.16098","title":"Universal Defenses for Tool-Integrated LLM Agents Against Adversarial Attacks","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.18357","title":"Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents","created":"2026-09-16","cited_by_count":0,"area":"agents"},{"id":"2609.22510","title":"Defusing Explosive Prompts: Understanding and Preventing Trigger-Based Prompt Injections in LLM Agents","created":"2026-09-18","cited_by_count":0,"area":"agents"},{"id":"2609.37567","title":"Concealing LLM-Based Multi-Agent Topology via Phantom Structure Injection","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2609.39065","title":"Can Agents Trust Their Skills? Uncovering Unsafe Chains of Trust in Skill-Based LLM Agents","created":"2026-09-30","cited_by_count":0,"area":"agents"},{"id":"2609.39450","title":"ActionGuard: Tool Call Authorization under Poisoned Skills","created":"2026-09-30","cited_by_count":0,"area":"agents"},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.04083","title":"Self-Propagating Misalignment in LLM Agents, and Why Auditing or Disabling Memory Is Not Enough","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.06966","title":"APEX: Active Protection at Execution Boundaries for LLM Agents","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.07359","title":"Evaluate the Stack, Not the Layer: Do Deterministic and LLM Gates for Agent Actions Fail Independently?","created":"2026-10-05","cited_by_count":0,"area":"agents"},{"id":"2610.18007","title":"Cost-Efficient Privacy Enforcement for Email-Generating LLM Agents under Strategic Information Requests","created":"2026-10-13","cited_by_count":0,"area":"agents"}],"next_cursor":null}