{"total":157,"rows":[{"id":"2506.14866","title":"OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents","created":"2025-06-17","cited_by_count":111,"area":"agents"},{"id":"2602.20156","title":"Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks","created":"2026-02-23","cited_by_count":90,"area":"agents"},{"id":"2601.10156","title":"ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback","created":"2026-01-15","cited_by_count":72,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2505.21936","title":"RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments","created":"2025-05-28","cited_by_count":46,"area":"agents"},{"id":"2602.16901","title":"AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks","created":"2026-02-18","cited_by_count":39,"area":"agents"},{"id":"2510.04885","title":"RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injection","created":"2025-10-06","cited_by_count":36,"area":"agents"},{"id":"2506.00618","title":"RiOSWorld: Benchmarking the Risk of Multimodal Computer-Use Agents","created":"2025-05-31","cited_by_count":35,"area":"mllm"},{"id":"2510.19207","title":"Defending Against Prompt Injection with DataFilter","created":"2025-10-22","cited_by_count":35,"area":"safety"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2602.10127","title":"\"Humans welcome to observe\": A First Look at the Agent Social Network Moltbook","created":"2026-02-02","cited_by_count":26,"area":"agents"},{"id":"2507.20526","title":"Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition","created":"2025-07-28","cited_by_count":24,"area":"lr"},{"id":"2510.01354","title":"WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents","created":"2025-10-01","cited_by_count":24,"area":"agents"},{"id":"2511.20597","title":"BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents","created":"2025-11-25","cited_by_count":24,"area":"safety"},{"id":"2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","created":"2026-04-03","cited_by_count":24,"area":"agents"},{"id":"2505.10924","title":"A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?","created":"2025-05-16","cited_by_count":23,"area":"agents"},{"id":"2601.05293","title":"A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes","created":"2026-01-08","cited_by_count":22,"area":"agents"},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2506.02040","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","created":"2025-05-31","cited_by_count":19,"area":"agents"},{"id":"2510.10073","title":"SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents","created":"2025-10-11","cited_by_count":19,"area":"agents"},{"id":"2605.12015","title":"SkillSafetyBench: Evaluating Agent Safety under Skill-Facing Attack Surfaces","created":"2026-05-12","cited_by_count":19,"area":"agents"},{"id":"2601.05755","title":"VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit","created":"2026-01-09","cited_by_count":17,"area":"agents"},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17,"area":"agents"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2604.01438","title":"ClawSafety: \"Safe\" LLMs, Unsafe Agents","created":"2026-04-01","cited_by_count":17,"area":"agents"},{"id":"2509.10723","title":"Dark Patterns Meet GUI Agents: LLM Agent Susceptibility to Manipulative Interfaces and the Role of Human Oversight","created":"2025-09-12","cited_by_count":16,"area":"agents"},{"id":"2510.03204","title":"FocusAgent: Simple Yet Effective Ways of Trimming the Large Context of Web Agents","created":"2025-10-03","cited_by_count":16,"area":"agents"},{"id":"2511.05359","title":"ConVerse: Benchmarking Contextual Safety in Agent-to-Agent Conversations","created":"2025-11-07","cited_by_count":16,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2602.01725","title":"SafePred: A Predictive Guardrail for Computer-Using Agents via World Models","created":"2026-02-02","cited_by_count":12,"area":"wm"},{"id":"2604.10577","title":"The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents","created":"2026-04-12","cited_by_count":12,"area":"agents"},{"id":"2602.03792","title":"WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents","created":"2026-02-03","cited_by_count":11,"area":"agents"},{"id":"2604.08499","title":"PIArena: A Platform for Prompt Injection Evaluation","created":"2026-04-09","cited_by_count":11,"area":"safety"},{"id":"2605.11039","title":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","created":"2026-05-11","cited_by_count":11,"area":"lr"},{"id":"2507.02735","title":"Meta SecAlign: A Secure Foundation LLM Against Prompt Injection Attacks","created":"2025-07-03","cited_by_count":10,"area":"agents"},{"id":"2508.04010","title":"HarmonyGuard: Toward Safety and Utility in Web Agents via Adaptive Policy Enhancement and Dual-Objective Optimization","created":"2025-08-06","cited_by_count":10,"area":"agents"},{"id":"2602.11416","title":"Optimizing Agent Planning for Security and Autonomy","created":"2026-02-11","cited_by_count":10,"area":"safety"},{"id":"2604.04978","title":"Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode","created":"2026-04-04","cited_by_count":10,"area":"agents"},{"id":"2510.01670","title":"Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directedness","created":"2025-10-02","cited_by_count":9,"area":"agents"},{"id":"2602.03255","title":"LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarios","created":"2026-02-03","cited_by_count":9,"area":"agents"},{"id":"2510.22620","title":"Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents","created":"2025-10-26","cited_by_count":8,"area":"agents"},{"id":"2512.20806","title":"Safety Alignment of LMs via Non-cooperative Games","created":"2025-12-23","cited_by_count":8,"area":"alignment"},{"id":"2602.08995","title":"When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents","created":"2026-02-09","cited_by_count":8,"area":"agents"},{"id":"2603.18096","title":"A Trace-Based Assurance Framework for Agentic AI Orchestration: Contracts, Testing, and Governance","created":"2026-03-18","cited_by_count":8,"area":"agents"},{"id":"2606.28679","title":"Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks","created":"2026-06-27","cited_by_count":8,"area":"agents"},{"id":"2510.00507","title":"Graph2Eval: Automatic Multimodal Task Generation for Agents via Knowledge Graphs","created":"2025-10-01","cited_by_count":7,"area":"mllm"},{"id":"2601.07263","title":"When Bots Take the Bait: Exposing and Mitigating the Emerging Social Engineering Attack in Web Automation Agent","created":"2026-01-12","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2507.10610","title":"LaSM: Layer-wise Scaling Mechanism for Defending Pop-up Attack on GUI Agents","created":"2025-07-13","cited_by_count":6,"area":"mllm"},{"id":"2604.01194","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","created":"2026-04-01","cited_by_count":6,"area":"safety"},{"id":"2606.02540","title":"SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction","created":"2026-06-01","cited_by_count":6,"area":"agents"},{"id":"2605.02801","title":"Reinforcement Learning for LLM-based Multi-Agent Systems through Orchestration Traces","created":"2026-05-04","cited_by_count":5,"area":"agents"},{"id":"2605.10779","title":"LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments","created":"2026-05-11","cited_by_count":5,"area":"agents"},{"id":"2601.21961","title":"How do Visual Attributes Influence Web Agents? A Comprehensive Evaluation of User Interface Design Factors","created":"2026-01-29","cited_by_count":4,"area":"agents"},{"id":"2603.18382","title":"From Weak Cues to Real Identities: Evaluating Inference-Driven De-Anonymization in LLM Agents","created":"2026-03-19","cited_by_count":4,"area":"agents"},{"id":"2604.25562","title":"SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents","created":"2026-04-28","cited_by_count":4,"area":"agents"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2605.15030","title":"WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2605.16282","title":"Taxonomy and Consistency Analysis of Safety Benchmarks for AI Agents","created":"2026-04-11","cited_by_count":4,"area":"agents"},{"id":"2605.25707","title":"AgentHijack: Benchmarking Computer Use Agent Robustness to Common Environment Corruptions","created":"2026-05-25","cited_by_count":4,"area":"agents"},{"id":"2506.23978","title":"LLM Agents Are the Antidote to Walled Gardens","created":"2025-06-30","cited_by_count":3,"area":"agents"},{"id":"2512.00742","title":"On the Regulatory Potential of User Interfaces for AI Agent Governance","created":"2025-11-30","cited_by_count":3,"area":null},{"id":"2602.13516","title":"SPILLage: Agentic Oversharing on the Web","created":"2026-02-13","cited_by_count":3,"area":"agents"},{"id":"2603.18762","title":"ClawTrap: A MITM-Based Red-Teaming Framework for Real-World OpenClaw Security Evaluation","created":"2026-03-19","cited_by_count":3,"area":"agents"},{"id":"2603.26221","title":"Clawed and Dangerous: Can We Trust Open Agentic Systems?","created":"2026-03-27","cited_by_count":3,"area":"agents"},{"id":"2604.08005","title":"Preference Redirection via Attention Concentration: An Attack on Computer Use Agents","created":"2026-04-09","cited_by_count":3,"area":"agents"},{"id":"2604.12284","title":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","created":"2026-04-14","cited_by_count":3,"area":"agents"},{"id":"2605.08828","title":"When Agents Overtrust Environmental Evidence: An Extensible Agentic Framework for Benchmarking Evidence-Grounding Defects in LLM Agents","created":"2026-05-09","cited_by_count":3,"area":"agents"},{"id":"2605.10481","title":"Safe Multi-Agent Behavior Must Be Maintained, Not Merely Asserted: Constraint Drift in LLM-Based Multi-Agent Systems","created":"2026-05-11","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2605.28201","title":"Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2606.13686","title":"Benchmarking Web Agent Safety under E-commerce Deceptive Interfaces","created":"2026-04-26","cited_by_count":3,"area":"agents"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2607.27294","title":"AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents","created":"2026-07-29","cited_by_count":3,"area":"agents"},{"id":"2608.06477","title":"StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection","created":"2026-08-06","cited_by_count":3,"area":"agents"},{"id":"2510.12200","title":"HackWorld: Evaluating Computer-Use Agents on Exploiting Web Application Vulnerabilities","created":"2025-10-14","cited_by_count":2,"area":"agents"},{"id":"2601.08406","title":"WebTrap Park: An Automated Platform for Systematic Security Evaluation of Web Agents","created":"2026-01-13","cited_by_count":2,"area":"agents"},{"id":"2601.13612","title":"PINA: Prompt Injection Attack against Navigation Agents","created":"2026-01-20","cited_by_count":2,"area":"agents"},{"id":"2605.08310","title":"WebTrap: Stealthy Mid-Task Hijacking of Browser Agents During Navigation","created":"2026-05-08","cited_by_count":2,"area":null},{"id":"2606.02240","title":"AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations","created":"2026-06-01","cited_by_count":2,"area":"agents"},{"id":"2606.09549","title":"SecureClaw: Clawing Back Control of LLM Agents","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2606.13385","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","created":"2026-06-11","cited_by_count":2,"area":"agents"},{"id":"2606.20636","title":"SkillHarness: Harnessing Safe Skills for Computer-Use Agents","created":"2026-06-02","cited_by_count":2,"area":"agents"},{"id":"2606.30783","title":"Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense","created":"2026-06-29","cited_by_count":2,"area":"safety"},{"id":"2607.22024","title":"Agent Security Needs Redefinition through a Holistic Framework","created":"2026-07-24","cited_by_count":2,"area":"safety"},{"id":"2608.11878","title":"ToolHazard: Scaling Adversarial Environments for Security Evaluation and Alignment of LLM-based Agents","created":"2026-08-12","cited_by_count":2,"area":"agents"},{"id":"2608.22868","title":"AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems","created":"2026-08-24","cited_by_count":2,"area":"agents"},{"id":"2609.06972","title":"AgentDrift: A Step-Labeled Benchmark of Injection-Hijacked LLM Agent Trajectories","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2601.18113","title":"MalURLBench: A Benchmark Evaluating Agents' Vulnerabilities When Processing Web URLs","created":"2026-01-26","cited_by_count":1,"area":"agents"},{"id":"2602.05386","title":"Spider-Sense: Intrinsic Risk Sensing for Efficient Agent Defense with Hierarchical Adaptive Screening","created":"2026-02-05","cited_by_count":1,"area":"agents"},{"id":"2602.07104","title":"Extended to Reality: Prompt Injection in 3D Environments","created":"2026-02-06","cited_by_count":1,"area":"mllm"},{"id":"2604.06367","title":"WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks","created":"2026-04-07","cited_by_count":1,"area":"agents"},{"id":"2604.07831","title":"Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection","created":"2026-04-09","cited_by_count":1,"area":"agents"},{"id":"2605.06393","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","created":"2026-05-07","cited_by_count":1,"area":"agents"},{"id":"2605.11868","title":"IPI-proxy: An Intercepting Proxy for Red-Teaming Web-Browsing AI Agents Against Indirect Prompt Injection","created":"2026-05-12","cited_by_count":1,"area":"agents"},{"id":"2606.02302","title":"SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents","created":"2026-06-01","cited_by_count":1,"area":"agents"},{"id":"2606.05233","title":"Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming","created":"2026-06-03","cited_by_count":1,"area":"agents"},{"id":"2606.10742","title":"MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents","created":"2026-06-09","cited_by_count":1,"area":"agents"},{"id":"2606.14027","title":"Same-Origin Policy for Agentic Browsers","created":"2026-06-12","cited_by_count":1,"area":"agents"}],"next_cursor":"100"}