{"total":141,"rows":[{"id":"2507.15219","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","created":"2025-07-21","cited_by_count":108,"area":"agents"},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54,"area":"agents"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2507.21206","title":"Agentic Web: Weaving the Next Web with AI Agents","created":"2025-07-28","cited_by_count":45,"area":"agents"},{"id":"2512.23738","title":"Enforcing Temporal Constraints for LLM Agents","created":"2025-12-25","cited_by_count":34,"area":"agents"},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31,"area":"agents"},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30,"area":"agents"},{"id":"2505.24019","title":"LLM Agents Should Employ Security Principles","created":"2025-05-29","cited_by_count":29,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2604.16548","title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","created":"2026-04-17","cited_by_count":27,"area":"agents"},{"id":"2508.17692","title":"LLM-based Agentic Reasoning Frameworks: A Survey from Methods to Scenarios","created":"2025-08-25","cited_by_count":26,"area":"lr"},{"id":"2511.20597","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","created":"2025-11-25","cited_by_count":24,"area":"safety"},{"id":"2510.06445","title":"A Survey on Agentic Security: Applications, Threats and Defenses","created":"2025-10-07","cited_by_count":20,"area":"agents"},{"id":"2510.14005","title":"PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Features","created":"2025-10-15","cited_by_count":20,"area":"safety"},{"id":"2510.05244","title":"Indirect Prompt Injections: Are Firewalls All You Need, or Stronger Benchmarks?","created":"2025-10-06","cited_by_count":18,"area":"safety"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2606.00448","title":"When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems","created":"2026-05-30","cited_by_count":17,"area":"agents"},{"id":"2512.12594","title":"ceLLMate: Sandboxing Browser AI Agents","created":"2025-12-14","cited_by_count":16,"area":"safety"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2602.07918","title":"CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution","created":"2026-02-08","cited_by_count":14,"area":"agents"},{"id":"2602.08235","title":"When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents","created":"2026-02-09","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2510.11203","title":"TraceAegis: Securing LLM-Based Agents via Hierarchical and Behavioral Anomaly Detection","created":"2025-10-13","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2605.01970","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","created":"2026-05-03","cited_by_count":12,"area":"agents"},{"id":"2507.08270","title":"Agent Safety Alignment via Reinforcement Learning","created":"2025-07-11","cited_by_count":11,"area":"agents"},{"id":"2509.22256","title":"Secure and Efficient Access Control for Computer-Use Agents via Context Space","created":"2025-09-26","cited_by_count":11,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2601.10440","title":"AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior","created":"2026-01-15","cited_by_count":11,"area":null},{"id":"2604.08499","title":"PIArena: A Platform for Prompt Injection Evaluation","created":"2026-04-09","cited_by_count":11,"area":"safety"},{"id":"2605.11039","title":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","created":"2026-05-11","cited_by_count":11,"area":"lr"},{"id":"2509.24967","title":"SecInfer: Preventing Prompt Injection via Inference-time Scaling","created":"2025-09-29","cited_by_count":10,"area":"lr"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2603.20625","title":"ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore","created":"2026-03-21","cited_by_count":10,"area":"agents"},{"id":"2606.03895","title":"Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents","created":"2026-06-02","cited_by_count":10,"area":"agents"},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2603.30016","title":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","created":"2026-03-31","cited_by_count":9,"area":"agents"},{"id":"2606.22504","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","created":"2026-06-21","cited_by_count":8,"area":"agents"},{"id":"2606.23075","title":"Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies","created":"2026-06-22","cited_by_count":8,"area":"agents"},{"id":"2603.02983","title":"Contextualized Privacy Defense for LLM Agents","created":"2026-03-03","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.15888","title":"Bounded Agents: Delegation Security for Multi-Agent AI Systems","created":"2026-08-16","cited_by_count":7,"area":"agents"},{"id":"2604.01194","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","created":"2026-04-01","cited_by_count":6,"area":"safety"},{"id":"2606.03024","title":"SkillGuard: A Permission-Centric Framework for Agent Skill Security","created":"2026-06-02","cited_by_count":6,"area":"agents"},{"id":"2608.09885","title":"SHE: Trajectory-driven Safety Harness Evolution for LLM Agents","created":"2026-08-10","cited_by_count":6,"area":"agents"},{"id":"2602.01129","title":"SMCP: Secure Model Context Protocol","created":"2026-02-01","cited_by_count":5,"area":"agents"},{"id":"2603.20933","title":"AC4A: Access Control for Agents","created":"2026-03-21","cited_by_count":5,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2606.22916","title":"Intent-Governed Tool Authorization for AI Agents","created":"2026-06-22","cited_by_count":5,"area":null},{"id":"2607.23586","title":"Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents","created":"2026-07-26","cited_by_count":5,"area":null},{"id":"2512.18027","title":"CoPE: A Small Language Model for Steerable and Scalable Content Labeling","created":"2025-12-19","cited_by_count":4,"area":null},{"id":"2512.22211","title":"With Great Capabilities Come Great Responsibilities: Introducing the Agentic Risk & Capability Framework for Governing Agentic AI Systems","created":"2025-12-22","cited_by_count":4,"area":"agents"},{"id":"2608.07556","title":"MasDrift: Benchmarking Authorization Preservation Across Multi-Agent Architectures","created":"2026-08-02","cited_by_count":4,"area":null},{"id":"2510.21057","title":"Soft Instruction De-escalation Defense","created":"2025-10-24","cited_by_count":3,"area":"agents"},{"id":"2602.15945","title":"From Tool Orchestration to Code Execution: A Study of MCP Design Choices","created":"2026-02-17","cited_by_count":3,"area":"agents"},{"id":"2603.26221","title":"Clawed and Dangerous: Can We Trust Open Agentic Systems?","created":"2026-03-27","cited_by_count":3,"area":"agents"},{"id":"2604.15505","title":"PolicyBank: Evolving Policy Understanding for LLM Agents","created":"2026-04-16","cited_by_count":3,"area":"agents"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2607.20121","title":"OpenSkillRisk: Benchmarking Agent Safety When Using Real-World Risky Third-Party Skills","created":"2026-07-22","cited_by_count":3,"area":"agents"},{"id":"2608.02670","title":"Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environments","created":"2026-08-02","cited_by_count":3,"area":"agents"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2609.05269","title":"CONTINUITY: Security-Context Contracts for Composable LLM Agent Controls","created":"2026-09-04","cited_by_count":3,"area":"agents"},{"id":"2609.22819","title":"Counterfactual Tool Ranking under Utility, Cost, and Privilege Constraints","created":"2026-09-19","cited_by_count":3,"area":null},{"id":"2507.02699","title":"Your Mailbox Is Mine: Prompt Injection Attacks Against Real-World LLM Email Agents","created":"2025-07-03","cited_by_count":2,"area":"agents"},{"id":"2603.13424","title":"Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection","created":"2026-03-13","cited_by_count":2,"area":"agents"},{"id":"2604.02375","title":"KAIJU: An Executive Kernel for Intent-Gated Execution of LLM Agents","created":"2026-03-31","cited_by_count":2,"area":"agents"},{"id":"2604.24920","title":"SUDP: Secret-Use Delegation Protocol for Agentic Systems","created":"2026-04-27","cited_by_count":2,"area":"agents"},{"id":"2606.09549","title":"SecureClaw: Clawing Back Control of LLM Agents","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2606.20510","title":"Efficient and Sound Probabilistic Verification for AI Agents","created":"2026-06-18","cited_by_count":2,"area":null},{"id":"2608.16032","title":"Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened","created":"2026-08-17","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.01595","title":"Mechanism Design for Alignment and Control","created":"2026-09-01","cited_by_count":2,"area":null},{"id":"2609.05903","title":"EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents","created":"2026-09-05","cited_by_count":2,"area":"agents"},{"id":"2609.07529","title":"CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2609.08062","title":"ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?","created":"2026-09-08","cited_by_count":2,"area":null},{"id":"2603.01564","title":"From Secure Agentic AI to Secure Agentic Web: Challenges, Threats, and Future Directions","created":"2026-03-02","cited_by_count":1,"area":"agents"},{"id":"2604.14723","title":"Bounded Autonomy for Enterprise AI: Typed Action Contracts and Consumer-Side Execution","created":"2026-04-16","cited_by_count":1,"area":null},{"id":"2605.06393","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","created":"2026-05-07","cited_by_count":1,"area":"agents"},{"id":"2606.15549","title":"One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents","created":"2026-06-14","cited_by_count":1,"area":"agents"},{"id":"2606.23277","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","created":"2026-06-22","cited_by_count":1,"area":"agents"},{"id":"2606.31174","title":"ClawArena-Team: Benchmarking Subagent Orchestration and Dynamic Workflows in Language-Model Agents","created":"2026-06-30","cited_by_count":1,"area":"agents"},{"id":"2607.21835","title":"ToolGuardian: Declarative Security for AI Agent-Tool Interactions","created":"2026-07-23","cited_by_count":1,"area":"agents"},{"id":"2607.23999","title":"ContainmentBench: Trace-Based Evaluation of Post-Exposure Containment in Tool-Using LLM Agents","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2608.01558","title":"Securing Agentic AI: From Per-Action Checks to Trajectory Assurance","created":"2026-08-03","cited_by_count":1,"area":"agents"},{"id":"2608.05430","title":"Robust Context-Aware Detection of Malicious Instructions in Text","created":"2026-08-05","cited_by_count":1,"area":"safety"},{"id":"2608.08131","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","created":"2026-08-08","cited_by_count":1,"area":"agents"},{"id":"2608.24022","title":"What Guides the Agent? Adjudicating Unauthorized Behavior via Localizing Behavior-Guiding Instructions","created":"2026-08-25","cited_by_count":1,"area":"agents"},{"id":"2608.30041","title":"Reachability-Based Capability Confinement for LLM Agents under Indirect Prompt Injection","created":"2026-08-30","cited_by_count":1,"area":"agents"},{"id":"2609.00267","title":"Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems","created":"2026-08-31","cited_by_count":1,"area":"agents"},{"id":"2609.05901","title":"From Review to Authorization: Key-Isolated Threshold Signing for LLM Agents","created":"2026-09-05","cited_by_count":1,"area":"agents"},{"id":"2609.24446","title":"ActGov: Governing LLM Agent Actions via Policy-Constrained Validation","created":"2026-09-21","cited_by_count":1,"area":"agents"},{"id":"2609.29543","title":"Safe Skill Retirement for Physical Agents","created":"2026-08-25","cited_by_count":1,"area":null},{"id":"2609.36580","title":"SafeCoEvo: Co-Evolving Safety Harnesses and Guards for LLM Agents at Test-Time","created":"2026-09-29","cited_by_count":1,"area":"agents"},{"id":"2508.17155","title":"Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents","created":"2025-08-23","cited_by_count":0,"area":"agents"},{"id":"2605.21694","title":"PocketAgents: A Manifest-Driven Library of Autonomous Defense Agents","created":"2026-05-20","cited_by_count":0,"area":"agents"},{"id":"2607.04613","title":"Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority","created":"2026-07-06","cited_by_count":0,"area":null},{"id":"2607.09489","title":"Ceci n'est pas une pipe: AI systems as semantic abstractions","created":"2026-07-10","cited_by_count":0,"area":null},{"id":"2608.27427","title":"Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit","created":"2026-08-27","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}