{"total":102,"rows":[{"id":"2510.02373","title":"A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory","created":"2025-09-29","cited_by_count":67,"area":"agents"},{"id":"2602.06052","title":"A Survey of Agent Memory in the Second Half: Towards Self-Evolving and Long-Horizon Agents","created":"2026-01-14","cited_by_count":44,"area":"agents"},{"id":"2602.16901","title":"AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks","created":"2026-02-18","cited_by_count":39,"area":"agents"},{"id":"2606.04990","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","created":"2026-06-03","cited_by_count":37,"area":"agents"},{"id":"2606.04329","title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents","created":"2026-06-03","cited_by_count":33,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2604.16548","title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","created":"2026-04-17","cited_by_count":27,"area":"agents"},{"id":"2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","created":"2026-05-14","cited_by_count":27,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2604.04759","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","created":"2026-04-06","cited_by_count":20,"area":"agents"},{"id":"2603.15125","title":"From Storage to Steering: Memory Control Flow Attacks on LLM Agents","created":"2026-03-16","cited_by_count":19,"area":"agents"},{"id":"2606.24322","title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","created":"2026-06-23","cited_by_count":18,"area":"agents"},{"id":"2505.23559","title":"SafeScientist: Toward Risk-Aware Scientific Discoveries by LLM Agents","created":"2025-05-29","cited_by_count":16,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2605.14421","title":"MemLineage: Lineage-Guided Enforcement for LLM Agent Memory","created":"2026-05-14","cited_by_count":16,"area":"agents"},{"id":"2604.23374","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","created":"2026-04-25","cited_by_count":15,"area":"agents"},{"id":"2603.22862","title":"The Evolution of Tool Use in LLM Agents: From Single-Tool Call to Multi-Tool Orchestration","created":"2026-03-24","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2605.18930","title":"OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences","created":"2026-05-18","cited_by_count":14,"area":"agents"},{"id":"2506.17318","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","created":"2025-06-18","cited_by_count":12,"area":"agents"},{"id":"2605.01970","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","created":"2026-05-03","cited_by_count":12,"area":"agents"},{"id":"2507.08270","title":"Agent Safety Alignment via Reinforcement Learning","created":"2025-07-11","cited_by_count":11,"area":"agents"},{"id":"2512.04668","title":"Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs","created":"2025-12-04","cited_by_count":11,"area":"agents"},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2605.26154","title":"MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning","created":"2026-05-24","cited_by_count":9,"area":"agents"},{"id":"2606.25115","title":"Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory","created":"2026-06-23","cited_by_count":9,"area":"agents"},{"id":"2602.19555","title":"SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime","created":"2026-02-23","cited_by_count":8,"area":"agents"},{"id":"2608.01679","title":"When Memory Becomes Authority: Benchmarking Authority Collapse at the Memory Consolidation Boundary","created":"2026-08-03","cited_by_count":8,"area":"agents"},{"id":"2605.11514","title":"FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2606.07943","title":"Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents","created":"2026-06-06","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2607.14651","title":"MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents","created":"2026-07-16","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2509.24240","title":"Takedown: How It's Done in Modern Coding Agent Exploits","created":"2025-09-29","cited_by_count":6,"area":"agents"},{"id":"2604.01350","title":"No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents","created":"2026-04-01","cited_by_count":6,"area":"agents"},{"id":"2606.22030","title":"When Does Belief-Based Agent Memory Help? Reliability-Conditional Updating and Provenance-Capped Poisoning Defense","created":"2026-06-20","cited_by_count":6,"area":"agents"},{"id":"2606.25161","title":"TRUSTMEM: Learning Trustworthy Memory Consolidation for LLM Agents with Long-Term Memory","created":"2026-06-23","cited_by_count":6,"area":"agents"},{"id":"2607.06595","title":"When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents","created":"2026-07-06","cited_by_count":6,"area":"agents"},{"id":"2604.16966","title":"Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning","created":"2026-04-18","cited_by_count":5,"area":"agents"},{"id":"2605.08442","title":"Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents","created":"2026-05-08","cited_by_count":5,"area":"agents"},{"id":"2508.03864","title":"Evo-MARL: Co-Evolutionary Multi-Agent Reinforcement Learning for Internalized Safety","created":"2025-08-05","cited_by_count":4,"area":"agents"},{"id":"2603.20357","title":"Memory poisoning and secure multi-agent systems","created":"2026-03-20","cited_by_count":4,"area":"agents"},{"id":"2605.09278","title":"EquiMem: Calibrating Shared Memory in Multi-Agent Debate via Game-Theoretic Equilibrium","created":"2026-05-10","cited_by_count":4,"area":"agents"},{"id":"2605.16282","title":"Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2605.30169","title":"Dissociative Identity: Language Model Agents Lack Grounding for Reputation Mechanisms","created":"2026-05-28","cited_by_count":4,"area":"agents"},{"id":"2606.15609","title":"FragFuse: Bypassing Access Control of Large Language Model Agents via Memory-Based Query Fragmentation and Fusion","created":"2026-06-14","cited_by_count":4,"area":"agents"},{"id":"2607.27080","title":"MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair","created":"2026-07-29","cited_by_count":4,"area":"agents"},{"id":"2608.23471","title":"InjecMEM: Memory Injection Attack on LLM Agent Memory Systems","created":"2026-08-24","cited_by_count":4,"area":"agents"},{"id":"2506.02539","title":"VerificAgent: Domain-Specific Memory Verification for Scalable Oversight of Aligned Computer-Use Agents","created":"2025-06-03","cited_by_count":3,"area":"agents"},{"id":"2605.28201","title":"Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2608.16246","title":"CompoSkill: Compositional Skill Chain Attacks from Individually Scanner-Passing LLM Agent Skills","created":"2026-08-17","cited_by_count":3,"area":"agents"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2606.09084","title":"Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2606.30566","title":"Forensic Trajectory Signatures for Agent Memory Poisoning Detection","created":"2026-06-29","cited_by_count":2,"area":"agents"},{"id":"2607.05189","title":"When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents","created":"2026-07-06","cited_by_count":2,"area":"agents"},{"id":"2607.15657","title":"Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agents","created":"2026-07-17","cited_by_count":2,"area":"agents"},{"id":"2608.16032","title":"Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened","created":"2026-08-17","cited_by_count":2,"area":"agents"},{"id":"2510.21524","title":"EU-Agent-Bench: Measuring Illegal Behavior of LLM Agents Under EU Law","created":"2025-10-24","cited_by_count":1,"area":"agents"},{"id":"2603.07496","title":"From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents","created":"2026-03-08","cited_by_count":1,"area":"agents"},{"id":"2604.24657","title":"AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents","created":"2026-04-27","cited_by_count":1,"area":"agents"},{"id":"2605.22842","title":"The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems","created":"2026-05-12","cited_by_count":1,"area":"agents"},{"id":"2606.10742","title":"MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents","created":"2026-06-09","cited_by_count":1,"area":"agents"},{"id":"2607.06807","title":"When Agents Go Rogue: Activation-Based Detection of Malicious Behaviors in Multi-Agent Systems","created":"2026-07-07","cited_by_count":1,"area":"agents"},{"id":"2607.13594","title":"SAFETY SENTRY: Context-Aware Human Intervention via EXECUTE-ASK-REFUSE Routing","created":"2026-07-15","cited_by_count":1,"area":"agents"},{"id":"2608.00747","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","created":"2026-08-01","cited_by_count":1,"area":"agents"},{"id":"2608.04053","title":"AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection","created":"2026-08-04","cited_by_count":1,"area":"agents"},{"id":"2608.08131","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","created":"2026-08-08","cited_by_count":1,"area":"agents"},{"id":"2608.20631","title":"Weighted Memory Tree: Remembering What Matters for Long-Horizon LLM Agents","created":"2026-08-21","cited_by_count":1,"area":"agents"},{"id":"2609.08258","title":"Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems","created":"2026-09-08","cited_by_count":1,"area":"agents"},{"id":"2610.07645","title":"SkillPoison: Progressive Skill Poisoning via Successful Experiences","created":"2026-10-06","cited_by_count":1,"area":"agents"},{"id":"2605.12535","title":"Ghost in the Context: Policy-Carriage Integrity in LLM Agents","created":"2026-05-02","cited_by_count":0,"area":"agents"},{"id":"2606.24496","title":"Red-Teaming the Agentic Red-Team","created":"2026-06-23","cited_by_count":0,"area":"agents"},{"id":"2606.29030","title":"Memory as an Attack Surface in LLM Agents: A Study on Multiple-Choice Question Answering","created":"2026-06-27","cited_by_count":0,"area":"agents"},{"id":"2606.30602","title":"MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems","created":"2026-06-29","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.28103","title":"MIND: Lightweight and Effective Memory Injection Defense for LLM Agents via Intent-Aware Information Bottleneck","created":"2026-07-30","cited_by_count":0,"area":"agents"},{"id":"2608.00426","title":"MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems","created":"2026-08-01","cited_by_count":0,"area":"agents"},{"id":"2608.01637","title":"Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw","created":"2026-08-03","cited_by_count":0,"area":"agents"},{"id":"2608.03844","title":"MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents","created":"2026-08-04","cited_by_count":0,"area":"agents"},{"id":"2608.07952","title":"Persistent Semantic Entities in Tool-Augmented LLM Systems","created":"2026-08-08","cited_by_count":0,"area":"agents"},{"id":"2608.08303","title":"Query-Only Backdoor Attacks on Self-Evolving Skills via Trajectory Poisoning","created":"2026-08-08","cited_by_count":0,"area":"agents"},{"id":"2608.09476","title":"ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents","created":"2026-08-10","cited_by_count":0,"area":"agents"},{"id":"2608.12172","title":"Rethinking Agent Security as a Networking Problem","created":"2026-08-12","cited_by_count":0,"area":"agents"},{"id":"2608.30441","title":"ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.02265","title":"CAPTURE: Disentangling Preference Drift from Memory Poisoning in Personalized LLM Agents","created":"2026-09-02","cited_by_count":0,"area":"agents"},{"id":"2609.08747","title":"MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI","created":"2026-09-08","cited_by_count":0,"area":"agents"},{"id":"2609.16694","title":"Toward Secure AI-Powered Penetration Testing Agents: Security Threats, Guardrails, and Architectural Perspectives","created":"2026-09-15","cited_by_count":0,"area":"agents"},{"id":"2609.18357","title":"Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents","created":"2026-09-16","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.23894","title":"Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.27857","title":"ChronosAttack: Adversarial Tool Scheduling Attacks on LLM Agents","created":"2026-08-20","cited_by_count":0,"area":"agents"},{"id":"2609.34132","title":"From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.34245","title":"Certified Multi-Source Integrity for Structured Agent Actions","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.35576","title":"Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.35596","title":"SEABench: Benchmarking Endogenous Misalignment In Self-Evolving Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.38275","title":"When Correct Memory Goes Wrong: Fuzzing Persistent Memory Use in LLM Agents","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2610.02569","title":"Pincer: Resource Authorization for Agents using a Digital Twin","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.04589","title":"StegoMemory: Agentic Memory Acts as Covert Steganographic Channel","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.13267","title":"Forgetting is Not Always Bad: A Neuro-Inspired Memory Repair Mechanism for Poisoned LLM Agents","created":"2026-10-09","cited_by_count":0,"area":"agents"},{"id":"2610.15244","title":"EvolvAttack: Backdooring self Evolving VLM Agents","created":"2026-10-11","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}