{"total":125,"rows":[{"id":"2507.21504","title":"Evaluation and Benchmarking of LLM Agents: A Survey","created":"2025-07-29","cited_by_count":152,"area":"agents"},{"id":"2510.09023","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","created":"2025-10-10","cited_by_count":129,"area":"safety"},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87,"area":"agents"},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58,"area":"agents"},{"id":"2508.15310","title":"IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents","created":"2025-08-21","cited_by_count":54,"area":"agents"},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54,"area":"agents"},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38,"area":"agents"},{"id":"2509.17488","title":"Privacy in Action: Towards Realistic Privacy Mitigation and Evaluation for LLM-Powered Agents","created":"2025-09-22","cited_by_count":36,"area":"agents"},{"id":"2510.26328","title":"Agent Skills Enable a New Class of Realistic and Trivially Simple Prompt Injections","created":"2025-10-30","cited_by_count":33,"area":"agents"},{"id":"2509.22830","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","created":"2025-09-26","cited_by_count":31,"area":"agents"},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30,"area":"agents"},{"id":"2506.23844","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","created":"2025-06-30","cited_by_count":29,"area":"agents"},{"id":"2509.11035","title":"Free-MAD: Consensus-Free Multi-Agent Debate","created":"2025-09-14","cited_by_count":29,"area":"lr"},{"id":"2602.22724","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification","created":"2026-02-26","cited_by_count":29,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2507.20526","title":"Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition","created":"2025-07-28","cited_by_count":24,"area":"lr"},{"id":"2505.10924","title":"A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?","created":"2025-05-16","cited_by_count":23,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2603.12277","title":"Prompt Injection as Role Confusion","created":"2026-02-22","cited_by_count":17,"area":"safety"},{"id":"2504.20472","title":"Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction","created":"2025-04-29","cited_by_count":16,"area":"safety"},{"id":"2510.03204","title":"FocusAgent: Simple Yet Effective Ways of Trimming the Large Context of Web Agents","created":"2025-10-03","cited_by_count":16,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2505.06493","title":"System Prompt Poisoning: Persistent Attacks on Large Language Models Beyond User Injection","created":"2025-05-10","cited_by_count":14,"area":"safety"},{"id":"2507.14799","title":"Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree","created":"2025-07-20","cited_by_count":14,"area":"agents"},{"id":"2601.12560","title":"Agentic Artificial Intelligence (AI): Architectures, Taxonomies, and Evaluation of Large Language Model Agents","created":"2026-01-18","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13,"area":"agents"},{"id":"2506.15170","title":"From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2602.11416","title":"Optimizing Agent Planning for Security and Autonomy","created":"2026-02-11","cited_by_count":10,"area":"safety"},{"id":"2602.17622","title":"What Makes a Good LLM Agent for Real-world Penetration Testing?","created":"2026-02-19","cited_by_count":10,"area":"agents"},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10,"area":"agents"},{"id":"2609.28613","title":"Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions","created":"2026-09-23","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2509.25624","title":"STAC: When Innocent Tools Form Dangerous Chains for LLM Agents","created":"2025-09-30","cited_by_count":8,"area":"agents"},{"id":"2510.22620","title":"Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents","created":"2025-10-26","cited_by_count":8,"area":"agents"},{"id":"2510.04261","title":"VortexPIA: Indirect Prompt Injection Attack against LLMs for Efficient Extraction of User Privacy","created":"2025-10-05","cited_by_count":7,"area":"safety"},{"id":"2602.09877","title":"The Devil Behind Moltbook: Anthropic Safety is Always Vanishing in Self-Evolving AI Societies","created":"2026-02-10","cited_by_count":7,"area":"synth"},{"id":"2604.25109","title":"Structured Security Auditing and Robustness Enhancement for Untrusted Agent Skills","created":"2026-04-28","cited_by_count":7,"area":null},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2602.16958","title":"Automating Agent Hijacking via Structural Template Injection","created":"2026-02-18","cited_by_count":6,"area":"agents"},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5,"area":"agents"},{"id":"2602.15344","title":"ER-MIA: Black-Box Adversarial Memory Injection Attacks on Long-Term Memory-Augmented Large Language Models","created":"2026-02-17","cited_by_count":5,"area":null},{"id":"2605.23989","title":"Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security","created":"2026-05-17","cited_by_count":5,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2505.00841","title":"From Texts to Shields: Convergence of Large Language Models and Cybersecurity","created":"2025-05-01","cited_by_count":4,"area":null},{"id":"2510.04257","title":"AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents","created":"2025-10-05","cited_by_count":4,"area":"mllm"},{"id":"2607.10490","title":"NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations","created":"2026-07-11","cited_by_count":4,"area":"agents"},{"id":"2510.21057","title":"Soft Instruction De-escalation Defense","created":"2025-10-24","cited_by_count":3,"area":"agents"},{"id":"2601.03600","title":"ALERT: Zero-shot LLM Jailbreak Detection via Internal Discrepancy Amplification","created":"2026-01-07","cited_by_count":3,"area":"safety"},{"id":"2602.14281","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents","created":"2026-02-15","cited_by_count":3,"area":"agents"},{"id":"2605.16976","title":"Securing LLM Agents Need Intent-to-Execution Integrity","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2605.28071","title":"AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2508.08629","title":"Securing Educational LLMs: A Generalised Taxonomy of Attacks on LLMs and DREAD Risk Assessment","created":"2025-08-12","cited_by_count":2,"area":"safety"},{"id":"2510.23675","title":"QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents","created":"2025-10-27","cited_by_count":2,"area":"agents"},{"id":"2603.24203","title":"Invisible Threats from Model Context Protocol: Generating Stealthy Injection Payload via Tree-based Adaptive Search","created":"2026-03-25","cited_by_count":2,"area":"agents"},{"id":"2605.12729","title":"Large Language Models for Agentic NetOps and AIOps: Architectures, Evaluation, and Safety","created":"2026-05-12","cited_by_count":2,"area":"agents"},{"id":"2607.11698","title":"Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming","created":"2026-07-13","cited_by_count":2,"area":"agents"},{"id":"2608.16032","title":"Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened","created":"2026-08-17","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.05903","title":"EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents","created":"2026-09-05","cited_by_count":2,"area":"agents"},{"id":"2609.07529","title":"CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2506.19109","title":"Enhancing Security in LLM Applications: A Performance Evaluation of Early Detection Systems","created":"2025-06-23","cited_by_count":1,"area":"safety"},{"id":"2507.00052","title":"VSF-Med:A Vulnerability Scoring Framework for Medical Vision-Language Models","created":"2025-06-25","cited_by_count":1,"area":"mllm"},{"id":"2510.19844","title":"CourtGuard: A Local, Multiagent Prompt Injection Classifier","created":"2025-10-20","cited_by_count":1,"area":"safety"},{"id":"2602.05066","title":"Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks","created":"2026-02-04","cited_by_count":1,"area":"agents"},{"id":"2602.17022","title":"ReIn: Conversational Error Recovery with Reasoning Inception","created":"2026-02-19","cited_by_count":1,"area":"lr"},{"id":"2603.07496","title":"From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents","created":"2026-03-08","cited_by_count":1,"area":"agents"},{"id":"2604.03242","title":"DRAFT: Task Decoupled Latent Reasoning for Agent Safety","created":"2026-02-11","cited_by_count":1,"area":"lr"},{"id":"2605.00081","title":"Alignment Contracts for Agentic Security Systems","created":"2026-04-30","cited_by_count":1,"area":"agents"},{"id":"2606.00611","title":"TRACE: Trajectory Risk-Aware Compression for Long-Horizon Agent Safety","created":"2026-05-30","cited_by_count":1,"area":"agents"},{"id":"2606.23277","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","created":"2026-06-22","cited_by_count":1,"area":"agents"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2607.23999","title":"ContainmentBench: Trace-Based Evaluation of Post-Exposure Containment in Tool-Using LLM Agents","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2608.05430","title":"Robust Context-Aware Detection of Malicious Instructions in Text","created":"2026-08-05","cited_by_count":1,"area":"safety"},{"id":"2608.28411","title":"LongPIBench: A Long-Context Benchmark for Prompt Injection","created":"2026-08-28","cited_by_count":1,"area":"safety"},{"id":"2609.32691","title":"Silent Failures in Agentic Security Evaluation: A Validated Harness for Tool-Call Mediation Under Indirect Prompt Injection","created":"2026-09-26","cited_by_count":1,"area":"agents"},{"id":"2604.18248","title":"Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection","created":"2026-04-20","cited_by_count":0,"area":"safety"},{"id":"2604.23887","title":"Evaluation of Prompt Injection Defenses in Large Language Models","created":"2026-04-26","cited_by_count":0,"area":"safety"},{"id":"2604.27464","title":"Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study","created":"2026-04-30","cited_by_count":0,"area":"agents"},{"id":"2605.12876","title":"Certified Robustness under Heterogeneous Perturbations via Hybrid Randomized Smoothing","created":"2026-05-13","cited_by_count":0,"area":null},{"id":"2605.30454","title":"The Surface You Test Is Not the Surface That Breaks","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2606.00914","title":"Adversarial Feeds Steer LLM Agent Decisions Against Their Defaults","created":"2026-05-30","cited_by_count":0,"area":"agents"},{"id":"2606.07992","title":"VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation","created":"2026-06-06","cited_by_count":0,"area":"agents"},{"id":"2606.16242","title":"Rapid Poison: Practical Poisoning Attacks Against the Rapid Response Framework","created":"2026-06-15","cited_by_count":0,"area":"safety"},{"id":"2606.21071","title":"Local LLM Agents as Vulnerable Runtimes:A Source-Code Audit of the Agent Runtime Layer","created":"2026-06-19","cited_by_count":0,"area":"agents"},{"id":"2607.16199","title":"PlanFlip: Attacking Multi-Agent LLM Systems via Planning-Phase Prompt Injection","created":"2026-04-30","cited_by_count":0,"area":"agents"},{"id":"2607.17986","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","created":"2026-07-20","cited_by_count":0,"area":null},{"id":"2607.24964","title":"ALIBI: Adaptive Agentic Attacks on LLM-Based Vulnerability Detectors via Adversarial Code Comments","created":"2026-07-27","cited_by_count":0,"area":"agents"},{"id":"2608.00426","title":"MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems","created":"2026-08-01","cited_by_count":0,"area":"agents"},{"id":"2608.08212","title":"Harmful Content Is Not Enough: Continuation Framing Moderates In-Context Emergent Misalignment","created":"2026-08-08","cited_by_count":0,"area":"safety"},{"id":"2608.08795","title":"Toward Metacognitive One-Shot Indirect Prompt Injection: Strategy Abstraction Via Outcome-Conditioned Reflection","created":"2026-08-09","cited_by_count":0,"area":"safety"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.20658","title":"The Claws in Plain Sight: Unauthorized Context Disclosure through LLM Agent Tool Calls","created":"2026-08-21","cited_by_count":0,"area":"agents"},{"id":"2608.27092","title":"The Framing Gap: Indirect Prompt-Injection Exfiltration Defeats Surface-Level Defenses in Tool-Using Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}