{"total":158,"rows":[{"id":"2507.15219","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","created":"2025-07-21","cited_by_count":108,"area":"agents"},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2505.11717","title":"WebInject: Prompt Injection Attack to Web Agents","created":"2025-05-16","cited_by_count":51,"area":"agents"},{"id":"2602.16901","title":"AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks","created":"2026-02-18","cited_by_count":39,"area":"agents"},{"id":"2505.18333","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","created":"2025-05-23","cited_by_count":36,"area":"safety"},{"id":"2505.11154","title":"MPMA: Preference Manipulation Attack Against Model Context Protocol","created":"2025-05-16","cited_by_count":34,"area":"agents"},{"id":"2509.13782","title":"Who is Introducing the Failure? Automatically Attributing Failures of Multi-Agent Systems via Spectrum Analysis","created":"2025-09-17","cited_by_count":33,"area":"agents"},{"id":"2604.04989","title":"SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement","created":"2026-04-05","cited_by_count":30,"area":"agents"},{"id":"2510.09781","title":"Building a Foundational Guardrail for General Agentic Systems via Synthetic Data","created":"2025-10-10","cited_by_count":29,"area":"agents"},{"id":"2510.12252","title":"PromptLocate: Localizing Prompt Injection Attacks","created":"2025-10-14","cited_by_count":28,"area":"safety"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2604.09378","title":"BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning","created":"2026-04-10","cited_by_count":27,"area":"safety"},{"id":"2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","created":"2026-05-14","cited_by_count":27,"area":"agents"},{"id":"2510.02554","title":"ToolTweak: An Attack on Tool Selection in LLM-based Agents","created":"2025-10-02","cited_by_count":26,"area":"agents"},{"id":"2606.17573","title":"Cordon: Semantic Transactions for Tool-Using LLM Agents","created":"2026-06-16","cited_by_count":22,"area":"agents"},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20,"area":"agents"},{"id":"2603.24414","title":"ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers","created":"2026-03-25","cited_by_count":20,"area":null},{"id":"2604.06550","title":"SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills","created":"2026-04-08","cited_by_count":20,"area":"agents"},{"id":"2604.03070","title":"How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study","created":"2026-04-03","cited_by_count":19,"area":"agents"},{"id":"2505.18135","title":"Tool Preferences in Agentic LLMs are Unreliable","created":"2025-05-23","cited_by_count":18,"area":"agents"},{"id":"2509.21011","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools","created":"2025-09-25","cited_by_count":18,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2602.14878","title":"Model Context Protocol (MCP) Tool Descriptions Are Smelly! Towards Improving AI Agent Efficiency with Augmented MCP Tool Descriptions","created":"2026-02-16","cited_by_count":17,"area":"agents"},{"id":"2606.00448","title":"When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystems","created":"2026-05-30","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2601.07395","title":"MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP","created":"2026-01-12","cited_by_count":14,"area":"agents"},{"id":"2604.11806","title":"Detecting Safety Violations Across Many Agent Traces","created":"2026-04-13","cited_by_count":14,"area":null},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2605.28914","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","created":"2026-05-27","cited_by_count":13,"area":"agents"},{"id":"2606.15242","title":"Benign in Isolation, Harmful in Composition: Security Risks in Agent Skill Ecosystems","created":"2026-06-13","cited_by_count":13,"area":"agents"},{"id":"2510.00307","title":"BiasBusters: Uncovering and Mitigating Tool Selection Bias in Large Language Models","created":"2025-09-30","cited_by_count":11,"area":null},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2605.11039","title":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","created":"2026-05-11","cited_by_count":11,"area":"lr"},{"id":"2509.16330","title":"Generalizability of Large Language Model-Based Agents: A Comprehensive Survey","created":"2025-09-19","cited_by_count":10,"area":"agents"},{"id":"2609.28613","title":"Decision Hijacking: Prompt Injection Attacks on Jev's Typed Probabilistic Decisions","created":"2026-09-23","cited_by_count":10,"area":"agents"},{"id":"2506.07524","title":"TAI3: Testing Agent Integrity in Interpreting User Intent","created":"2025-06-09","cited_by_count":9,"area":"agents"},{"id":"2510.23853","title":"Your LLM Agents are Temporally Blind: The Misalignment Between Tool Use Decisions and Human Time Perception","created":"2025-10-27","cited_by_count":9,"area":"agents"},{"id":"2602.03255","title":"LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarios","created":"2026-02-03","cited_by_count":9,"area":"agents"},{"id":"2605.26154","title":"MemMorph: Tool Hijacking in LLM Agents via Memory Poisoning","created":"2026-05-24","cited_by_count":9,"area":"agents"},{"id":"2606.22504","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","created":"2026-06-21","cited_by_count":8,"area":"agents"},{"id":"2605.00314","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","created":"2026-05-01","cited_by_count":7,"area":"agents"},{"id":"2605.02900","title":"Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses","created":"2026-03-28","cited_by_count":7,"area":"safety"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2605.11514","title":"FlowSteer: Prompt-Only Workflow Steering Exposes Planning-Time Vulnerabilities in Multi-Agent LLM Systems","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2605.11770","title":"Behavioral Integrity Verification for AI Agent Skills","created":"2026-05-12","cited_by_count":7,"area":"agents"},{"id":"2605.14038","title":"Model-Adaptive Tool Necessity Reveals the Knowing-Doing Gap in LLM Tool Use","created":"2026-05-13","cited_by_count":7,"area":"agents"},{"id":"2606.10525","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2606.16287","title":"Dynamic Malicious Skills in Agentic AI","created":"2026-06-15","cited_by_count":7,"area":"agents"},{"id":"2510.05159","title":"Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chain","created":"2025-10-03","cited_by_count":6,"area":"agents"},{"id":"2512.00520","title":"Toward a Safe Internet of Agents","created":"2025-11-29","cited_by_count":6,"area":"agents"},{"id":"2604.27202","title":"Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives","created":"2026-04-29","cited_by_count":6,"area":"safety"},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5,"area":"agents"},{"id":"2510.16558","title":"A First Look at the Security Issues in the Model Context Protocol Ecosystem","created":"2025-10-18","cited_by_count":5,"area":"agents"},{"id":"2602.13597","title":"AlignSentinel: Alignment-Aware Detection of Prompt Injection Attacks","created":"2026-02-14","cited_by_count":5,"area":"safety"},{"id":"2605.13044","title":"No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills","created":"2026-05-13","cited_by_count":5,"area":"agents"},{"id":"2605.28999","title":"Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening","created":"2026-05-27","cited_by_count":5,"area":"safety"},{"id":"2606.14154","title":"SkillMutator: Benchmarking and Defending Language-and-Code Cross-modal Attacks on LLM Agent Skills","created":"2026-06-12","cited_by_count":5,"area":"agents"},{"id":"2606.22916","title":"Intent-Governed Tool Authorization for AI Agents","created":"2026-06-22","cited_by_count":5,"area":null},{"id":"2508.03864","title":"Evo-MARL: Co-Evolutionary Multi-Agent Reinforcement Learning for Internalized Safety","created":"2025-08-05","cited_by_count":4,"area":"agents"},{"id":"2510.04257","title":"AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents","created":"2025-10-05","cited_by_count":4,"area":"mllm"},{"id":"2605.27593","title":"Voluntary Collusion with Secret Tools in Competing LLM Agents","created":"2026-05-26","cited_by_count":4,"area":"agents"},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3,"area":"agents"},{"id":"2604.10286","title":"STARS: Skill-Triggered Audit for Request-Conditioned Invocation Safety in Agent Systems","created":"2026-04-11","cited_by_count":3,"area":"agents"},{"id":"2607.18485","title":"Trusted Credentials, Untrusted Behavior: Benchmarking LLM-Agent Security in High-Performance Computing","created":"2026-07-20","cited_by_count":3,"area":"agents"},{"id":"2608.25776","title":"EVOMAL: Self-Poisoning in Self-Evolving Coding Agents","created":"2026-08-26","cited_by_count":3,"area":"agents"},{"id":"2510.23675","title":"QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents","created":"2025-10-27","cited_by_count":2,"area":"agents"},{"id":"2605.05271","title":"IntraGuard: Committee-Side Defenses Against Review Outsourcing to Commercial Chatbots","created":"2026-05-06","cited_by_count":2,"area":null},{"id":"2606.00925","title":"Benchmarking Security Risk Detection and Verification in Open Agentic Skill Ecosystems","created":"2026-05-30","cited_by_count":2,"area":"agents"},{"id":"2606.09549","title":"SecureClaw: Clawing Back Control of LLM Agents","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2606.13385","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","created":"2026-06-11","cited_by_count":2,"area":"agents"},{"id":"2607.21824","title":"Protocol-Level Attacks on Agentic Commerce Platforms: A Cross-Platform Taxonomy, AIP-Bench, and Unified Defense","created":"2026-07-23","cited_by_count":2,"area":"agents"},{"id":"2607.22024","title":"Agent Security Needs Redefinition through a Holistic Framework","created":"2026-07-24","cited_by_count":2,"area":"safety"},{"id":"2607.25364","title":"Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales","created":"2026-07-28","cited_by_count":2,"area":null},{"id":"2608.12273","title":"Convergent Detour Hijacking: Task-Preserving Resource Amplification in Skill-Based LLM Agents","created":"2026-08-12","cited_by_count":2,"area":"agents"},{"id":"2608.22868","title":"AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems","created":"2026-08-24","cited_by_count":2,"area":"agents"},{"id":"2609.01736","title":"Harness Engineering in LLM Tool Use via Agent-Native Reusable Tool Primitives","created":"2026-09-01","cited_by_count":2,"area":"agents"},{"id":"2505.17106","title":"RRTL: Red Teaming Reasoning Large Language Models in Tool Learning","created":"2025-05-21","cited_by_count":1,"area":"lr"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2601.01584","title":"Steerability of Instrumental-Convergence Tendencies in LLMs","created":"2026-01-04","cited_by_count":1,"area":null},{"id":"2603.13950","title":"ToolFlood: Beyond Selection -- Hiding Valid Tools from LLM Agents via Semantic Covering","created":"2026-03-14","cited_by_count":1,"area":"agents"},{"id":"2604.00430","title":"Secure Forgetting: A Framework for Privacy-Driven Unlearning in Large Language Model (LLM)-Based Agents","created":"2026-04-01","cited_by_count":1,"area":"lr"},{"id":"2604.04426","title":"ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems","created":"2026-04-06","cited_by_count":1,"area":"agents"},{"id":"2604.16762","title":"CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution","created":"2026-04-18","cited_by_count":1,"area":null},{"id":"2605.07135","title":"Demystifying and Detecting Agentic Workflow Injection Vulnerabilities in GitHub Actions","created":"2026-05-08","cited_by_count":1,"area":"agents"},{"id":"2605.13213","title":"Hierarchical Attacks for Multi-Modal Multi-Agent Reasoning","created":"2026-05-13","cited_by_count":1,"area":null},{"id":"2605.18414","title":"Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control","created":"2026-05-18","cited_by_count":1,"area":null},{"id":"2605.25435","title":"Security of OpenClaw Agents: Fundamentals, Attacks, and Countermeasures","created":"2026-05-25","cited_by_count":1,"area":"agents"},{"id":"2606.02302","title":"SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agents","created":"2026-06-01","cited_by_count":1,"area":"agents"},{"id":"2606.10173","title":"Beyond Locality: Feature-Boundary Auditing for OS-Integrated AI","created":"2026-06-08","cited_by_count":1,"area":null},{"id":"2606.15549","title":"One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents","created":"2026-06-14","cited_by_count":1,"area":"agents"},{"id":"2606.22613","title":"SkillAudit: From Fixed-Suite Benchmarking to Skill-Centered Assessment","created":"2026-06-21","cited_by_count":1,"area":"agents"},{"id":"2606.28649","title":"RIPA: Sensory-Vector Prompt Injection Attacks on LLM-Controlled ROS 2 Robots","created":"2026-06-26","cited_by_count":1,"area":"safety"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2607.12406","title":"Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions","created":"2026-07-14","cited_by_count":1,"area":"agents"},{"id":"2607.21835","title":"ToolGuardian: Declarative Security for AI Agent-Tool Interactions","created":"2026-07-23","cited_by_count":1,"area":"agents"},{"id":"2608.00747","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","created":"2026-08-01","cited_by_count":1,"area":"agents"},{"id":"2608.01558","title":"Securing Agentic AI: From Per-Action Checks to Trajectory Assurance","created":"2026-08-03","cited_by_count":1,"area":"agents"},{"id":"2608.04626","title":"Blockchain Empowered Trustworthy Agent Networks: Foundations, Taxonomy, and Future Directions","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.04741","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","created":"2026-08-05","cited_by_count":1,"area":"agents"}],"next_cursor":"100"}