{"total":55,"rows":[{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57,"area":"agents"},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46,"area":"agents"},{"id":"2601.05504","title":"Memory Poisoning Attack and Defense on Memory Based LLM-Agents","created":"2026-01-09","cited_by_count":44,"area":"agents"},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28,"area":"agents"},{"id":"2601.05755","title":"VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit","created":"2026-01-09","cited_by_count":17,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2603.22868","title":"Agent-Sentry: Bounding LLM Agents via Execution Provenance","created":"2026-03-24","cited_by_count":15,"area":"agents"},{"id":"2605.26497","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","created":"2026-05-26","cited_by_count":15,"area":"agents"},{"id":"2602.07918","title":"CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution","created":"2026-02-08","cited_by_count":14,"area":"agents"},{"id":"2605.03378","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","created":"2026-05-05","cited_by_count":14,"area":"agents"},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13,"area":"agents"},{"id":"2510.17276","title":"Breaking and Fixing Defenses Against Control-Flow Hijacking in Multi-Agent Systems","created":"2025-10-20","cited_by_count":12,"area":"agents"},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10,"area":"agents"},{"id":"2511.15203","title":"Taxonomy, Evaluation and Exploitation of IPI-Centric LLM Agent Defense Frameworks","created":"2025-11-19","cited_by_count":9,"area":"agents"},{"id":"2603.30016","title":"Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks","created":"2026-03-31","cited_by_count":9,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2605.03228","title":"Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memory","created":"2026-05-04","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2602.01129","title":"SMCP: Secure Model Context Protocol","created":"2026-02-01","cited_by_count":5,"area":"agents"},{"id":"2605.05868","title":"SkillScope: Toward Fine-Grained Least-Privilege Enforcement for Agent Skills","created":"2026-05-07","cited_by_count":5,"area":"agents"},{"id":"2606.15057","title":"AutoDojo: Adaptive Black-Box Attacks Reveal the Limits of IPI Defenses and Task-Specification Effects in LLM Agents","created":"2026-06-13","cited_by_count":5,"area":"agents"},{"id":"2607.13718","title":"How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement","created":"2026-07-15","cited_by_count":4,"area":"agents"},{"id":"2603.04469","title":"Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems","created":"2026-03-04","cited_by_count":3,"area":"agents"},{"id":"2605.16976","title":"Securing LLM Agents Need Intent-to-Execution Integrity","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2606.20922","title":"Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning","created":"2026-06-18","cited_by_count":3,"area":"agents"},{"id":"2512.08104","title":"AgentCrypt: Advancing Privacy and (Secure) Computation in AI Agent Collaboration","created":"2025-12-08","cited_by_count":2,"area":"agents"},{"id":"2605.11026","title":"AgentShield: Deception-based Compromise Detection for Tool-using LLM Agents","created":"2026-05-10","cited_by_count":2,"area":"agents"},{"id":"2606.09549","title":"SecureClaw: Clawing Back Control of LLM Agents","created":"2026-06-08","cited_by_count":2,"area":"agents"},{"id":"2608.04192","title":"Behavioral Skill Reconstruction: Reconstructing Hidden Functionality from LLM Agent Skills","created":"2026-08-04","cited_by_count":2,"area":"agents"},{"id":"2608.27496","title":"ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2609.05903","title":"EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents","created":"2026-09-05","cited_by_count":2,"area":"agents"},{"id":"2609.07529","title":"CoER: Defending against Adaptive Indirect Prompt Injection via Adversarial Co-Evolution and Refinement","created":"2026-09-07","cited_by_count":2,"area":"agents"},{"id":"2608.04053","title":"AgentAntibody: An Adaptive Immune System for Defending LLM Agents against Prompt Injection","created":"2026-08-04","cited_by_count":1,"area":"agents"},{"id":"2608.05108","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2609.24446","title":"ActGov: Governing LLM Agent Actions via Policy-Constrained Validation","created":"2026-09-21","cited_by_count":1,"area":"agents"},{"id":"2512.06716","title":"SIEVE: Selective Integrity Verification and Escalation for Defending LLM Agents against Indirect Prompt Injection","created":"2025-12-07","cited_by_count":0,"area":"agents"},{"id":"2601.09292","title":"Blue Teaming Function-Calling Agents","created":"2026-01-14","cited_by_count":0,"area":"agents"},{"id":"2605.29224","title":"Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents","created":"2026-05-28","cited_by_count":0,"area":"agents"},{"id":"2607.02857","title":"MOSAIC: Knowledge-Guided CLI Command Composition Attack in LLM Coding Agents","created":"2026-07-03","cited_by_count":0,"area":"agents"},{"id":"2607.03821","title":"DualView: Preventing Indirect Prompt Injection in Personal AI Agents","created":"2026-07-04","cited_by_count":0,"area":"agents"},{"id":"2607.18826","title":"Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents","created":"2026-07-21","cited_by_count":0,"area":"agents"},{"id":"2608.00426","title":"MAPLE-Guard: Memory-Aware Link Enforcement Against Memory-Link Poisoning in Multi-Agent Systems","created":"2026-08-01","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.16402","title":"A Policy Algebra for Trust-Preserving Agentic AI Execution","created":"2026-08-17","cited_by_count":0,"area":"agents"},{"id":"2609.06835","title":"Skynet: Workflow-Level Anomaly Detection for Agentic AI via Semantic and Structural Modeling","created":"2026-09-06","cited_by_count":0,"area":"agents"},{"id":"2609.14987","title":"ActGuard: Pre-execution Action Auditing against Indirect Prompt Injection in LLM Agents","created":"2026-09-14","cited_by_count":0,"area":"agents"},{"id":"2609.31301","title":"Beyond Approved Actions: Runtime Validation of Persistent Outcomes in Agent Workflows","created":"2026-09-25","cited_by_count":0,"area":"agents"},{"id":"2609.35807","title":"Environment Steering: Using Data Flow Control to Improve Agent Utility and Safety","created":"2026-09-19","cited_by_count":0,"area":"agents"},{"id":"2609.36570","title":"CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering","created":"2026-09-29","cited_by_count":0,"area":"agents"},{"id":"2609.39450","title":"ActionGuard: Tool Call Authorization under Poisoned Skills","created":"2026-09-30","cited_by_count":0,"area":"agents"},{"id":"2610.01349","title":"PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.02569","title":"Pincer: Resource Authorization for Agents using a Digital Twin","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.04269","title":"Self-Reflection Fine-Tuning: Enhancing Agent Security against Prompt Injection Attacks from Failure Experience","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.06966","title":"APEX: Active Protection at Execution Boundaries for LLM Agents","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.09469","title":"Secure-CUA: Controlling Untrusted Influence in Computer-Use Agents","created":"2026-10-07","cited_by_count":0,"area":"agents"}],"next_cursor":null}