{"total":118,"rows":[{"id":"2507.15219","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","created":"2025-07-21","cited_by_count":108,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2505.11717","title":"WebInject: Prompt Injection Attack to Web Agents","created":"2025-05-16","cited_by_count":51,"area":"agents"},{"id":"2602.16901","title":"AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks","created":"2026-02-18","cited_by_count":39,"area":"agents"},{"id":"2505.11154","title":"MPMA: Preference Manipulation Attack Against Model Context Protocol","created":"2025-05-16","cited_by_count":34,"area":"agents"},{"id":"2509.13782","title":"Who is Introducing the Failure? Automatically Attributing Failures of Multi-Agent Systems via Spectrum Analysis","created":"2025-09-17","cited_by_count":33,"area":"agents"},{"id":"2604.04989","title":"SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement","created":"2026-04-05","cited_by_count":30,"area":"agents"},{"id":"2510.09781","title":"Building a Foundational Guardrail for General Agentic Systems via Synthetic Data","created":"2025-10-10","cited_by_count":29,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","created":"2026-05-14","cited_by_count":27,"area":"agents"},{"id":"2510.02554","title":"ToolTweak: An Attack on Tool Selection in LLM-based Agents","created":"2025-10-02","cited_by_count":26,"area":"agents"},{"id":"2606.17573","title":"Cordon: Semantic Transactions for Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":22,"area":"agents"},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20,"area":"agents"},{"id":"2604.06550","title":"SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills","created":"2026-04-08","cited_by_count":20,"area":"agents"},{"id":"2604.03070","title":"How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study","created":"2026-04-03","cited_by_count":19,"area":"agents"},{"id":"2505.18135","title":"Tool Preferences in Agentic LLMs are Unreliable","created":"2025-05-23","cited_by_count":18,"area":"agents"},{"id":"2509.21011","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools","created":"2025-09-25","cited_by_count":18,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2602.14878","title":"Model Context Protocol (MCP) Tool Descriptions Are Smelly! Towards Improving AI Agent Efficiency with Augmented MCP Tool Descriptions","created":"2026-02-16","cited_by_count":17,"area":"agents"},{"id":"2606.00448","title":"When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems","created":"2026-05-30","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2601.07395","title":"MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP","created":"2026-01-12","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2605.28914","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","created":"2026-05-27","cited_by_count":13,"area":"agents"},{"id":"2606.15242","title":"Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems","created":"2026-06-13","cited_by_count":13,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2509.16330","title":"Generalizability of Large Language Model-Based Agents: A Comprehensive Survey","created":"2025-09-19","cited_by_count":10,"area":"agents"},{"id":"2609.28613","title":"Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions","created":"2026-09-23","cited_by_count":10,"area":"agents"},{"id":"2506.07524","title":"TAI3: Testing Agent Integrity in Interpreting User Intent","created":"2025-06-09","cited_by_count":9,"area":"agents"},{"id":"2510.23853","title":"Your LLM Agents are Temporally Blind: The Misalignment Between Tool Use Decisions and Human Time Perception","created":"2025-10-27","cited_by_count":9,"area":"agents"},{"id":"2602.03255","title":"LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarios","created":"2026-02-03","cited_by_count":9,"area":"agents"},{"id":"2605.26154","title":"MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning","created":"2026-05-24","cited_by_count":9,"area":"agents"},{"id":"2606.22504","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","created":"2026-06-21","cited_by_count":8,"area":"agents"},{"id":"2605.00314","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","created":"2026-05-01","cited_by_count":7,"area":"agents"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2605.11514","title":"FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2605.11770","title":"Behavioral Integrity Verification for AI Agent Skills","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2605.14038","title":"Model-Adaptive Tool Necessity Reveals the Knowing-Doing Gap in LLM Tool Use","created":"2026-05-13","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.16287","title":"Dynamic Malicious Skills in Agentic AI","created":"2026-06-15","cited_by_count":7,"area":"agents"},{"id":"2510.05159","title":"Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain","created":"2025-10-03","cited_by_count":6,"area":"agents"},{"id":"2512.00520","title":"Toward a Safe Internet of Agents","created":"2025-11-29","cited_by_count":6,"area":"agents"},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5,"area":"agents"},{"id":"2510.16558","title":"A First Look at the Security Issues in the Model Context Protocol Ecosystem","created":"2025-10-18","cited_by_count":5,"area":"agents"},{"id":"2605.13044","title":"No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills","created":"2026-05-13","cited_by_count":5,"area":"agents"},{"id":"2606.14154","title":"SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills","created":"2026-06-12","cited_by_count":5,"area":"agents"},{"id":"2508.03864","title":"Evo-MARL: Co-Evolutionary Multi-Agent Reinforcement Learning for Internalized Safety","created":"2025-08-05","cited_by_count":4,"area":"agents"},{"id":"2605.27593","title":"Voluntary Collusion with Secret Tools in Competing LLM Agents","created":"2026-05-26","cited_by_count":4,"area":"agents"},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3,"area":"agents"},{"id":"2604.10286","title":"STARS: Skill-Triggered Audit for Request-Conditioned Invocation Safety in Agent Systems","created":"2026-04-11","cited_by_count":3,"area":"agents"},{"id":"2607.18485","title":"Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing","created":"2026-07-20","cited_by_count":3,"area":"agents"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2510.23675","title":"QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents","created":"2025-10-27","cited_by_count":2,"area":"agents"},{"id":"2606.00925","title":"Benchmarking Security Risk Detection and Verification in Open Agentic Skill Ecosystems","created":"2026-05-30","cited_by_count":2,"area":"agents"},{"id":"2606.09549","title":"SecureClaw: Clawing Back Control of LLM Agents","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2606.13385","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","created":"2026-06-11","cited_by_count":2,"area":"agents"},{"id":"2607.21824","title":"Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense","created":"2026-07-23","cited_by_count":2,"area":"agents"},{"id":"2608.12273","title":"Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents","created":"2026-08-12","cited_by_count":2,"area":"agents"},{"id":"2608.22868","title":"AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems","created":"2026-08-24","cited_by_count":2,"area":"agents"},{"id":"2609.01736","title":"Harness Engineering in LLM Tool Use via Agent-Native Reusable Tool Primitives","created":"2026-09-01","cited_by_count":2,"area":"agents"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2603.13950","title":"ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Covering","created":"2026-03-14","cited_by_count":1,"area":"agents"},{"id":"2604.04426","title":"ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems","created":"2026-04-06","cited_by_count":1,"area":"agents"},{"id":"2605.07135","title":"Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions","created":"2026-05-08","cited_by_count":1,"area":"agents"},{"id":"2605.25435","title":"Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures","created":"2026-05-25","cited_by_count":1,"area":"agents"},{"id":"2606.02302","title":"SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents","created":"2026-06-01","cited_by_count":1,"area":"agents"},{"id":"2606.15549","title":"One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents","created":"2026-06-14","cited_by_count":1,"area":"agents"},{"id":"2606.22613","title":"SkillAudit: From Fixed-Suite Benchmarking to Skill-Centered Assessment","created":"2026-06-21","cited_by_count":1,"area":"agents"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2607.12406","title":"Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions","created":"2026-07-14","cited_by_count":1,"area":"agents"},{"id":"2607.21835","title":"ToolGuardian: Declarative Security for AI Agent-Tool Interactions","created":"2026-07-23","cited_by_count":1,"area":"agents"},{"id":"2608.00747","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","created":"2026-08-01","cited_by_count":1,"area":"agents"},{"id":"2608.01558","title":"Securing Agentic AI: From Per-Action Checks to Trajectory Assurance","created":"2026-08-03","cited_by_count":1,"area":"agents"},{"id":"2608.04626","title":"Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.04741","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.07639","title":"SkillConsist: Detecting Inconsistencies in Agent Skills via Bidirectional Graph Alignment","created":"2026-08-07","cited_by_count":1,"area":"agents"},{"id":"2608.16891","title":"Runtime Governance for Agentic AI: Action-Boundary Control with Trusted Provenance and Fail-Closed Execution","created":"2026-05-17","cited_by_count":1,"area":"agents"},{"id":"2609.03588","title":"KC-Bench: A Dynamic Interactive Benchmark for Evaluating Knowledge Conflicts in LLM Agents","created":"2026-09-03","cited_by_count":1,"area":"agents"},{"id":"2609.15516","title":"Misleading the Planner through Deceptive Resumes: Registration-Time Injection in Centralized Multi-Agent Systems","created":"2026-09-14","cited_by_count":1,"area":"agents"},{"id":"2510.03495","title":"AgentHub: A Registry for Discoverable, Verifiable, and Reproducible AI Agents","created":"2025-10-03","cited_by_count":0,"area":"agents"},{"id":"2602.21127","title":"\"Are You Sure?\": An Empirical Study of Human Perception Vulnerability in LLM-Driven Agentic Systems","created":"2026-02-24","cited_by_count":0,"area":"agents"},{"id":"2604.27464","title":"Security Attack and Defense Strategies for Autonomous Agent Frameworks: A Layered Review with OpenClaw as a Case Study","created":"2026-04-30","cited_by_count":0,"area":"agents"},{"id":"2605.10763","title":"MATRA: Modeling the Attack Surface of Agentic AI Systems -- OpenClaw Case Study","created":"2026-05-11","cited_by_count":0,"area":"agents"},{"id":"2605.21392","title":"VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers","created":"2026-05-20","cited_by_count":0,"area":"agents"},{"id":"2605.23916","title":"Agent-Facing Information Design in LLM Tool Registries","created":"2026-04-12","cited_by_count":0,"area":"agents"},{"id":"2605.28515","title":"Do LLMs Favor Their Providers? Measuring Vertical Integration Bias in Code Generation","created":"2026-05-27","cited_by_count":0,"area":"agents"},{"id":"2605.30454","title":"The Surface You Test Is Not the Surface That Breaks","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2606.00566","title":"Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models","created":"2026-05-30","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.12340","title":"Skills That Don't Exist: A Large-Scale Study of Hallucinated Skill Recommendation in LLM Agents","created":"2026-07-14","cited_by_count":0,"area":"agents"},{"id":"2607.23624","title":"Where Is the Tradeoff in Using Third-Party API Routers for Agentic Software Development?","created":"2026-07-26","cited_by_count":0,"area":"agents"},{"id":"2607.28165","title":"Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents","created":"2026-07-30","cited_by_count":0,"area":"agents"},{"id":"2608.09577","title":"ElasticBack: Stealthy Conditional Backdoor in LLM-Agent Skills via Coupled Trigger-Rule Optimization","created":"2026-08-10","cited_by_count":0,"area":"agents"},{"id":"2608.17659","title":"MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps","created":"2026-08-18","cited_by_count":0,"area":"agents"},{"id":"2608.20658","title":"The Claws in Plain Sight: Unauthorized Context Disclosure through LLM Agent Tool Calls","created":"2026-08-21","cited_by_count":0,"area":"agents"},{"id":"2608.27234","title":"SPA: Securing Persistent LLM Agents Across Queries with Plan-First Information-Flow Control","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.27800","title":"ContextLeak: Exfiltrating LLM Agent Context via Malicious Tools","created":"2026-08-28","cited_by_count":0,"area":"agents"},{"id":"2608.30441","title":"ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.02035","title":"Implicit Manipulation for Skill Selection in LLM Agents with Semantic Matching","created":"2026-09-02","cited_by_count":0,"area":"agents"}],"next_cursor":"100"}