{"total":34,"rows":[{"id":"2510.01354","title":"WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents","created":"2025-10-01","cited_by_count":24,"area":"agents"},{"id":"2601.05755","title":"VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit","created":"2026-01-09","cited_by_count":17,"area":"agents"},{"id":"2512.04864","title":"Are Your Agents Upward Deceivers?","created":"2025-12-04","cited_by_count":16,"area":"agents"},{"id":"2604.10577","title":"The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents","created":"2026-04-12","cited_by_count":12,"area":"agents"},{"id":"2602.03792","title":"WebSentinel: Detecting and Localizing Prompt Injection Attacks for Web Agents","created":"2026-02-03","cited_by_count":11,"area":"agents"},{"id":"2510.01670","title":"Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directedness","created":"2025-10-02","cited_by_count":9,"area":"agents"},{"id":"2604.09155","title":"CORA: Conformal Risk-Controlled Agents for Safeguarded Mobile GUI Automation","created":"2026-04-10","cited_by_count":7,"area":"agents"},{"id":"2606.07943","title":"Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents","created":"2026-06-06","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2606.05805","title":"From Risk Classification to Action Plan Remediation: A Guardrail Feedback Driven Framework for LLM Agents","created":"2026-06-04","cited_by_count":6,"area":"agents"},{"id":"2512.02321","title":"LeechHijack: Covert Computational Resource Exploitation in Intelligent Agent Systems","created":"2025-12-02","cited_by_count":5,"area":"agents"},{"id":"2601.12822","title":"MirrorGuard: Toward Secure Computer-Use Agents via Simulation-to-Real Reasoning Correction","created":"2026-01-19","cited_by_count":5,"area":"agents"},{"id":"2604.25562","title":"SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents","created":"2026-04-28","cited_by_count":4,"area":"agents"},{"id":"2605.15030","title":"WARD: Adversarially Robust Defense of Web Agents Against Prompt Injections","created":"2026-05-14","cited_by_count":4,"area":"agents"},{"id":"2604.12284","title":"WebAgentGuard: A Reasoning-Driven Guard Model for Detecting Prompt Injection Attacks in Web Agents","created":"2026-04-14","cited_by_count":3,"area":"agents"},{"id":"2608.06477","title":"StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection","created":"2026-08-06","cited_by_count":3,"area":"agents"},{"id":"2601.08406","title":"WebTrap Park: An Automated Platform for Systematic Security Evaluation of Web Agents","created":"2026-01-13","cited_by_count":2,"area":"agents"},{"id":"2605.19192","title":"Hallucination as Exploit: Evidence-Carrying Multimodal Agents","created":"2026-05-18","cited_by_count":2,"area":"agents"},{"id":"2604.07831","title":"Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection","created":"2026-04-09","cited_by_count":1,"area":"agents"},{"id":"2605.06393","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","created":"2026-05-07","cited_by_count":1,"area":"agents"},{"id":"2606.05233","title":"Domain-Conditioned Safety in Frontier Computer-Using Agents: A 793-Episode Browser Benchmark, a Coding-Domain Cross-Reference, and a Reproducibility Audit of Recent Red-Teaming","created":"2026-06-03","cited_by_count":1,"area":"agents"},{"id":"2607.12406","title":"Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions","created":"2026-07-14","cited_by_count":1,"area":"agents"},{"id":"2608.04741","title":"LoginTrap: Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2609.09404","title":"An Experimental Evaluation of Multimodal Prompt Injection Attacks on Agentic AI Frameworks","created":"2026-09-08","cited_by_count":1,"area":"agents"},{"id":"2605.07110","title":"Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability","created":"2026-05-08","cited_by_count":0,"area":"agents"},{"id":"2607.04334","title":"Do GUI Agents Believe Their Eyes? Diagnosing State-Belief Reliance on Pixels versus Structure","created":"2026-07-05","cited_by_count":0,"area":"agents"},{"id":"2608.10530","title":"On Understanding, Identifying, and Mitigating Vulnerabilities in Agentic Large Language Models","created":"2026-08-11","cited_by_count":0,"area":"agents"},{"id":"2608.17659","title":"MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps","created":"2026-08-18","cited_by_count":0,"area":"agents"},{"id":"2608.24017","title":"WebMCP-Phalanx: Enforcing and Characterizing Trust Boundaries for Browser-Integrated LLM Agents","created":"2026-08-25","cited_by_count":0,"area":"agents"},{"id":"2609.09212","title":"AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents","created":"2026-09-06","cited_by_count":0,"area":"agents"},{"id":"2609.14987","title":"ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.34463","title":"CoDeL: Co-Evolutionary Defense against Indirect Prompt Injection in LLM-based Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"}],"next_cursor":null}