{"total":223,"rows":[{"id":"2603.25723","title":"Natural-Language Agent Harnesses","created":"2026-03-26","cited_by_count":61,"area":null},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2506.14697","title":"AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions","created":"2025-06-17","cited_by_count":38,"area":"mllm"},{"id":"2606.04990","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","created":"2026-06-03","cited_by_count":37,"area":"agents"},{"id":"2601.08012","title":"Towards Verifiably Safe Tool Use for LLM Agents","created":"2026-01-12","cited_by_count":36,"area":"agents"},{"id":"2604.02022","title":"ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis","created":"2026-04-02","cited_by_count":36,"area":"agents"},{"id":"2505.14590","title":"MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol","created":"2025-05-20","cited_by_count":34,"area":null},{"id":"2512.23738","title":"Enforcing Temporal Constraints for LLM Agents","created":"2025-12-25","cited_by_count":34,"area":"agents"},{"id":"2602.16708","title":"Formal Policy Enforcement for Real-World Agentic Systems","created":"2026-02-18","cited_by_count":33,"area":"agents"},{"id":"2505.18889","title":"Security Concerns for Large Language Models: A Survey","created":"2025-05-24","cited_by_count":29,"area":null},{"id":"2510.09781","title":"Building a Foundational Guardrail for General Agentic Systems via Synthetic Data","created":"2025-10-10","cited_by_count":29,"area":"agents"},{"id":"2508.00500","title":"ProbGuard: Proactive Runtime Monitoring for LLM Agent Safety via Probabilistic Prediction","created":"2025-08-01","cited_by_count":28,"area":"agents"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2604.16548","title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","created":"2026-04-17","cited_by_count":27,"area":"agents"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2603.16586","title":"Runtime Governance for AI Agents: Policies on Paths","created":"2026-03-17","cited_by_count":18,"area":"agents"},{"id":"2606.00448","title":"When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems","created":"2026-05-30","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2602.17037","title":"Wink: Recovering from Misbehaviors in Coding Agents","created":"2026-02-19","cited_by_count":15,"area":"agents"},{"id":"2604.05485","title":"Auditable Agents","created":"2026-04-07","cited_by_count":15,"area":"agents"},{"id":"2604.13630","title":"SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment","created":"2026-04-15","cited_by_count":15,"area":"agents"},{"id":"2512.21220","title":"RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic","created":"2025-12-24","cited_by_count":14,"area":"agents"},{"id":"2603.22862","title":"The Evolution of Tool Use in LLM Agents: From Single-Tool Call to Multi-Tool Orchestration","created":"2026-03-24","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2605.28914","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","created":"2026-05-27","cited_by_count":13,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2601.12449","title":"AgenTRIM: Tool Risk Mitigation for Agentic AI","created":"2026-01-18","cited_by_count":11,"area":"agents"},{"id":"2606.17546","title":"SEAGym: An Evaluation Environment for Self-Evolving LLM Agents","created":"2026-06-16","cited_by_count":11,"area":"agents"},{"id":"2512.03180","title":"AGENTSAFE: A Unified Framework for Ethical Assurance and Governance in Agentic AI","created":"2025-12-02","cited_by_count":10,"area":"agents"},{"id":"2603.20625","title":"ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore","created":"2026-03-21","cited_by_count":10,"area":"agents"},{"id":"2604.04978","title":"Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode","created":"2026-04-04","cited_by_count":10,"area":"agents"},{"id":"2604.16706","title":"Auditing Automated Evaluation, Error Propagation, and Runtime Mitigation in Tool-Using Language Agents","created":"2026-04-17","cited_by_count":10,"area":"agents"},{"id":"2606.03895","title":"Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents","created":"2026-06-02","cited_by_count":10,"area":"agents"},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2607.07405","title":"Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents","created":"2026-07-08","cited_by_count":10,"area":"lr"},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2606.26524","title":"VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills","created":"2026-06-25","cited_by_count":9,"area":"agents"},{"id":"2505.04799","title":"Maris: A Formally Verifiable Privacy Policy Enforcement Paradigm for Multi-Agent Collaboration Systems","created":"2025-05-07","cited_by_count":8,"area":"agents"},{"id":"2507.09329","title":"When Developer Aid Becomes Security Debt: A Systematic Analysis of Insecure Behaviors in LLM Coding Agents","created":"2025-07-12","cited_by_count":8,"area":"agents"},{"id":"2602.11749","title":"AIR: Improving Agent Safety through Incident Response","created":"2026-02-12","cited_by_count":8,"area":"agents"},{"id":"2605.27690","title":"TRACES: Proactive Safety Auditing for Multi-Turn LLM Agents via Trajectory-State Modeling","created":"2026-05-26","cited_by_count":8,"area":"agents"},{"id":"2606.22504","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","created":"2026-06-21","cited_by_count":8,"area":"agents"},{"id":"2601.22136","title":"StepShield: When, Not Whether to Intervene on Rogue Agents","created":"2026-01-29","cited_by_count":7,"area":"safety"},{"id":"2602.00612","title":"Lookahead-then-Verify: Reliable Constrained Decoding for Diffusion LLMs under Context-Free Grammars","created":"2026-01-31","cited_by_count":7,"area":null},{"id":"2605.00314","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","created":"2026-05-01","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2607.02599","title":"AgentLTL: A Trace-Verification Framework for Measuring, Enforcing, and Training Procedural Compliance in Tool-Using LLM Agents","created":"2026-07-01","cited_by_count":7,"area":"agents"},{"id":"2608.14380","title":"AgentRewind: Recoverable Execution for Long-Horizon LLM Agents","created":"2026-08-14","cited_by_count":7,"area":"agents"},{"id":"2509.24380","title":"Agentic Services Computing","created":"2025-09-29","cited_by_count":6,"area":"agents"},{"id":"2510.08623","title":"PARSE: LLM Driven Schema Optimization for Reliable Entity Extraction","created":"2025-10-08","cited_by_count":6,"area":"agents"},{"id":"2603.28807","title":"SafeClaw-R: Towards Safe and Secure Multi-Agent Personal Assistants","created":"2026-03-28","cited_by_count":6,"area":"agents"},{"id":"2605.14859","title":"Do Coding Agents Understand Least-Privilege Authorization?","created":"2026-05-14","cited_by_count":6,"area":"agents"},{"id":"2606.29225","title":"PolicyGuard: A Dialogue-Grounded Sub-Agent Verifier for Policy Adherence in LLM Agents","created":"2026-06-28","cited_by_count":6,"area":"agents"},{"id":"2607.01236","title":"Safeguarding LLM Agents from Misalignment through Provenance Analysis","created":"2026-05-01","cited_by_count":6,"area":"agents"},{"id":"2607.01456","title":"From Anatomy to Smells: An Empirical Study of SKILL.md in Agent Skills","created":"2026-07-01","cited_by_count":6,"area":"agents"},{"id":"2602.01129","title":"SMCP: Secure Model Context Protocol","created":"2026-02-01","cited_by_count":5,"area":"agents"},{"id":"2603.14367","title":"HomeGuard: VLM-based Embodied Safeguard for Identifying Contextual Risk in Household Task","created":"2026-03-15","cited_by_count":5,"area":"mllm"},{"id":"2603.15408","title":"TrinityGuard: A Unified Framework for Safeguarding Multi-Agent Systems","created":"2026-03-16","cited_by_count":5,"area":"agents"},{"id":"2604.22136","title":"Sovereign Agentic Loops: Decoupling AI Reasoning from Execution in Real-World Systems","created":"2026-04-24","cited_by_count":5,"area":"lr"},{"id":"2605.13044","title":"No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills","created":"2026-05-13","cited_by_count":5,"area":"agents"},{"id":"2606.13174","title":"Getting Better at Working With You: Compiling User Corrections into Runtime Enforcement for Coding Agents","created":"2026-06-11","cited_by_count":5,"area":"agents"},{"id":"2606.19464","title":"Deontic Policies for Runtime Governance of Agentic AI Systems","created":"2026-06-17","cited_by_count":5,"area":"agents"},{"id":"2606.22916","title":"Intent-Governed Tool Authorization for AI Agents","created":"2026-06-22","cited_by_count":5,"area":null},{"id":"2608.02464","title":"Real-Time Detection and Repair of LLM Agent Failures","created":"2026-08-03","cited_by_count":5,"area":"agents"},{"id":"2512.22211","title":"With Great Capabilities Come Great Responsibilities: Introducing the Agentic Risk & Capability Framework for Governing Agentic AI Systems","created":"2025-12-22","cited_by_count":4,"area":"agents"},{"id":"2603.29665","title":"Near-Miss: Latent Policy Failure Detection in Agentic Workflows","created":"2026-03-31","cited_by_count":4,"area":"agents"},{"id":"2604.10134","title":"PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2604.19657","title":"An AI Agent Execution Environment to Safeguard User Data","created":"2026-04-21","cited_by_count":4,"area":null},{"id":"2605.16282","title":"Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2607.13718","title":"How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement","created":"2026-07-15","cited_by_count":4,"area":"agents"},{"id":"2510.17862","title":"When \"Correct\" Is Not Safe: Can We Trust Functionally Correct Patches Generated by Code Agents?","created":"2025-10-15","cited_by_count":3,"area":"agents"},{"id":"2602.16943","title":"Mind the GAP: Text Safety Does Not Transfer to Tool-Call Safety in LLM Agents","created":"2026-02-18","cited_by_count":3,"area":"agents"},{"id":"2603.04469","title":"Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems","created":"2026-03-04","cited_by_count":3,"area":"agents"},{"id":"2603.26221","title":"Clawed and Dangerous: Can We Trust Open Agentic Systems?","created":"2026-03-27","cited_by_count":3,"area":"agents"},{"id":"2605.00424","title":"Skills as Verifiable Artifacts: A Trust Schema and a Biconditional Correctness Criterion for Human-in-the-Loop Agent Runtimes","created":"2026-05-01","cited_by_count":3,"area":"agents"},{"id":"2605.03034","title":"Stable Agentic Control: Tool-Mediated LLM Architecture for Autonomous Cyber Defense","created":"2026-05-04","cited_by_count":3,"area":"agents"},{"id":"2607.00041","title":"ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesis","created":"2026-06-29","cited_by_count":3,"area":"agents"},{"id":"2607.14166","title":"Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitives","created":"2026-07-15","cited_by_count":3,"area":"agents"},{"id":"2607.26313","title":"SARC-DQ: Runtime Data-Quality Gating for Agentic AI: Silent Evidence Defects, the Incompetence Shield, and Downstream-Only Remediation","created":"2026-07-28","cited_by_count":3,"area":"agents"},{"id":"2607.27267","title":"FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs","created":"2026-07-29","cited_by_count":3,"area":"lr"},{"id":"2607.28815","title":"Preventing Premature Commitment in Coding Agents with an Evidence-Conditioned Execution Layer","created":"2026-07-30","cited_by_count":3,"area":"agents"},{"id":"2608.19861","title":"PolicyGuide: From Guarding One Action to Guiding the Whole Workflow for Policy-Compliant LLM Agents","created":"2026-08-20","cited_by_count":3,"area":null},{"id":"2608.23623","title":"When May an Agent Stop? Evidence-Carrying Termination for Tool-Using LLMs","created":"2026-08-22","cited_by_count":3,"area":null},{"id":"2609.29095","title":"Where Does Exactly-Once Live? Model, Harness, and Tool-Contract Effects on Duplicate Side Effects in LLM Agents","created":"2026-09-24","cited_by_count":3,"area":"agents"},{"id":"2510.23245","title":"Multi-Stakeholder Alignment in LLM-Powered Collaborative AI Systems: A Multi-Agent Framework for Intelligent Tutoring","created":"2025-10-27","cited_by_count":2,"area":"agents"},{"id":"2602.19844","title":"LLM-enabled Applications Require System-Level Threat Monitoring","created":"2026-02-23","cited_by_count":2,"area":null},{"id":"2604.15579","title":"Don't Make Models Guess Security and Safety: Symbolic Guardrails for Domain-Specific AI Agents","created":"2026-04-16","cited_by_count":2,"area":"safety"},{"id":"2604.24920","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2605.10974","title":"Vertex-Softmax: Tight Transformer Verification via Exact Softmax Optimization","created":"2026-05-08","cited_by_count":2,"area":null},{"id":"2606.04296","title":"The Saturation Trap and the Subjectivity of Intervention Timing: Why Affect-Based Triggers and LLM Judges Fail to Time Interventions on Autonomous Agents","created":"2026-06-02","cited_by_count":2,"area":"agents"},{"id":"2606.20510","title":"Efficient and Sound Probabilistic Verification for AI Agents","created":"2026-06-18","cited_by_count":2,"area":null},{"id":"2606.31045","title":"LabGuard: Grounding Natural-Language Laboratory Rules into Runtime Guards for Embodied Laboratory Agents","created":"2026-06-30","cited_by_count":2,"area":null},{"id":"2607.00941","title":"From Runtime Records to Legal Findings: An Evidentiary-Adequacy Criterion for Agentic AI Oversight","created":"2026-07-01","cited_by_count":2,"area":"agents"},{"id":"2607.25364","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","created":"2026-07-28","cited_by_count":2,"area":null},{"id":"2608.12761","title":"Correct Is Not Governed: Provenance Integrity in Agentic Workflows","created":"2026-08-13","cited_by_count":2,"area":"agents"},{"id":"2608.19303","title":"Outcome Monitors: Recovery Affordances for Silent Tool Failures","created":"2026-08-19","cited_by_count":2,"area":null},{"id":"2608.21027","title":"Don't Solve, Just Compare: Tiny Advisors for Runtime Intervention in LLM Agents","created":"2026-08-21","cited_by_count":2,"area":"agents"},{"id":"2608.24570","title":"EviDx: Evidence-Aware Active Diagnosis with Scaffolded LLM Agents","created":"2026-08-25","cited_by_count":2,"area":"agents"}],"next_cursor":"100"}