{"total":79,"rows":[{"id":"2602.20156","title":"Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks","created":"2026-02-23","cited_by_count":90,"area":"agents"},{"id":"2606.04990","title":"From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents","created":"2026-06-03","cited_by_count":37,"area":"agents"},{"id":"2601.08012","title":"Towards Verifiably Safe Tool Use for LLM Agents","created":"2026-01-12","cited_by_count":36,"area":"agents"},{"id":"2602.16708","title":"Formal Policy Enforcement for Real-World Agentic Systems","created":"2026-02-18","cited_by_count":33,"area":"agents"},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30,"area":"agents"},{"id":"2512.09321","title":"ObliInjection: Order-Oblivious Prompt Injection Attack to LLM Agents with Multi-source Data","created":"2025-12-10","cited_by_count":18,"area":"agents"},{"id":"2606.24322","title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","created":"2026-06-23","cited_by_count":18,"area":"agents"},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17,"area":"agents"},{"id":"2605.14421","title":"MemLineage: Lineage-Guided Enforcement for LLM Agent Memory","created":"2026-05-14","cited_by_count":16,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2604.23374","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","created":"2026-04-25","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2510.08829","title":"CommandSans: Securing AI Agents with Surgical Precision Prompt Sanitization","created":"2025-10-09","cited_by_count":12,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11,"area":"agents"},{"id":"2606.03895","title":"Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents","created":"2026-06-02","cited_by_count":10,"area":"agents"},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2509.25926","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","created":"2025-09-30","cited_by_count":9,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2606.26524","title":"VIGIL: Runtime Enforcement of Behavioral Specifications in AI Agent Skills","created":"2026-06-25","cited_by_count":9,"area":"agents"},{"id":"2507.09329","title":"When Developer Aid Becomes Security Debt: A Systematic Analysis of Insecure Behaviors in LLM Coding Agents","created":"2025-07-12","cited_by_count":8,"area":"agents"},{"id":"2603.20933","title":"AC4A: Access Control for Agents","created":"2026-03-21","cited_by_count":5,"area":"agents"},{"id":"2604.08608","title":"Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines","created":"2026-04-08","cited_by_count":5,"area":"agents"},{"id":"2602.20064","title":"The LLMbda Calculus: AI Agents, Conversations, and Information Flow","created":"2026-02-23","cited_by_count":4,"area":"agents"},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2604.26274","title":"Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agents","created":"2026-04-29","cited_by_count":3,"area":"agents"},{"id":"2605.16976","title":"Securing LLM Agents Need Intent-to-Execution Integrity","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2605.22643","title":"Boiling the Frog: A Multi-Turn Benchmark for Agentic Safety","created":"2026-05-21","cited_by_count":3,"area":"agents"},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2605.11026","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","created":"2026-05-10","cited_by_count":2,"area":"agents"},{"id":"2605.17380","title":"ADR: An Agentic Detection System for Enterprise Agentic AI Security","created":"2026-05-17","cited_by_count":2,"area":"agents"},{"id":"2606.09549","title":"SecureClaw: Clawing Back Control of LLM Agents","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2608.16032","title":"Proof-of-Execution Memory: Defending LLM Agents Against Forged-Reasoning Attacks by Verifying What Actually Happened","created":"2026-08-17","cited_by_count":2,"area":"agents"},{"id":"2608.22868","title":"AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems","created":"2026-08-24","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2604.04035","title":"Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agents","created":"2026-04-05","cited_by_count":1,"area":"agents"},{"id":"2605.09822","title":"Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning","created":"2026-05-10","cited_by_count":1,"area":"agents"},{"id":"2605.12863","title":"Language-Based Agent Control","created":"2026-05-13","cited_by_count":1,"area":"agents"},{"id":"2605.22842","title":"The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems","created":"2026-05-12","cited_by_count":1,"area":"agents"},{"id":"2606.23277","title":"GIF: Locally Sound Geometric Information Flow Control for LLMs","created":"2026-06-22","cited_by_count":1,"area":"agents"},{"id":"2606.29788","title":"MemLeak: Diagnosing Information Leaks in Multimodal Agent Memory","created":"2026-06-29","cited_by_count":1,"area":"agents"},{"id":"2607.05120","title":"Agent Data Injection Attacks are Realistic Threats to AI Agents","created":"2026-07-06","cited_by_count":1,"area":"agents"},{"id":"2607.08147","title":"Prismata: Confining Cross-Site Prompt Injection in Web Agents","created":"2026-07-09","cited_by_count":1,"area":"agents"},{"id":"2608.24957","title":"ToolMinimize: Auditing and Rewriting LLM Agent Tool Calls to Minimize Privacy Exposure","created":"2026-08-25","cited_by_count":1,"area":"agents"},{"id":"2609.00267","title":"Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems","created":"2026-08-31","cited_by_count":1,"area":"agents"},{"id":"2609.14631","title":"LLM Agent Capabilities Should Follow Task Intent and Context Source","created":"2026-09-13","cited_by_count":1,"area":"agents"},{"id":"2609.32701","title":"Despite Instructions: Frontier Agents Improvise Covert Channels at Test Time","created":"2026-09-26","cited_by_count":1,"area":"agents"},{"id":"2606.04141","title":"Caught in the Act(ivation): Toward Pre-Output and Multi-Turn Detection of Credential Exfiltration by LLM Agents","created":"2026-06-02","cited_by_count":0,"area":"agents"},{"id":"2606.26627","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","created":"2026-06-25","cited_by_count":0,"area":"agents"},{"id":"2607.02857","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","created":"2026-07-03","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.18847","title":"Data Leakage Prevention in Agentic Applications via Preemptive Hardening","created":"2026-07-21","cited_by_count":0,"area":"agents"},{"id":"2607.19595","title":"Twin Agent: Context Residual Compression for Privilege Separated Agents","created":"2026-07-21","cited_by_count":0,"area":"agents"},{"id":"2607.26314","title":"StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents","created":"2026-07-28","cited_by_count":0,"area":"agents"},{"id":"2608.12172","title":"Rethinking Agent Security as a Networking Problem","created":"2026-08-12","cited_by_count":0,"area":"agents"},{"id":"2608.21126","title":"TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents","created":"2026-08-21","cited_by_count":0,"area":"agents"},{"id":"2608.27427","title":"Persona-Execution Separation: An Architecture Pattern for Evolving LLM Agents under Execution Audit","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.30686","title":"Beyond the Payload: How User Invocation Shapes Coding Agent Vulnerability to Repository Poisoning","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.05911","title":"Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents","created":"2026-09-05","cited_by_count":0,"area":"agents"},{"id":"2609.14003","title":"Confuse the Model, Control the Flow: Understanding and Mitigating Privacy Leakage from LLM Agents with Information Flow Control","created":"2026-09-12","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.31301","title":"Beyond Approved Actions: Runtime Validation of Persistent Outcomes in Agent Workflows","created":"2026-09-25","cited_by_count":0,"area":"agents"},{"id":"2609.32428","title":"Authorization Closure Graph: Minimal Repair for LLM Agents with Evolving User Instructions","created":"2026-09-26","cited_by_count":0,"area":"agents"},{"id":"2609.34245","title":"Certified Multi-Source Integrity for Structured Agent Actions","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.35937","title":"PrivacySkills: How Privacy Guidance Shapes Source Selection in LLM Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2610.00430","title":"Memetic Trojans: Social Contagions as Carriers of Adversarial Payloads in Agent Networks","created":"2026-09-30","cited_by_count":0,"area":"agents"},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.03089","title":"Securing Computer-Use Agents Against Branch Steering Attacks","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.03902","title":"When Evidence Changes: Evaluating Memory Repair and Re-reading in Language-Model Agents","created":"2026-10-02","cited_by_count":0,"area":"agents"},{"id":"2610.06966","title":"APEX: Active Protection at Execution Boundaries for LLM Agents","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.07359","title":"Evaluate the Stack, Not the Layer: Do Deterministic and LLM Gates for Agent Actions Fail Independently?","created":"2026-10-05","cited_by_count":0,"area":"agents"},{"id":"2610.09469","title":"Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents","created":"2026-10-07","cited_by_count":0,"area":"agents"},{"id":"2610.12813","title":"VEPA: Verified Evolving Formal Policy for Lifelong LLM Agent Guardrails","created":"2026-10-08","cited_by_count":0,"area":"agents"},{"id":"2610.18457","title":"Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents","created":"2026-10-13","cited_by_count":0,"area":"agents"},{"id":"2610.19507","title":"Structure Before Intelligence: Gating What Agentic Scientific Workflows Release","created":"2026-10-14","cited_by_count":0,"area":"agents"},{"id":"2610.19591","title":"L3M: A Verifiable Harness and Runtime for Self-Extending and Self-Improving Agents","created":"2026-10-14","cited_by_count":0,"area":"agents"}],"next_cursor":null}