{"total":111,"rows":[{"id":"2602.20156","title":"Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks","created":"2026-02-23","cited_by_count":90,"area":"agents"},{"id":"2606.29537","title":"OSWorld 2.0: Benchmarking Computer Use Agents on Long-Horizon Real-World Tasks","created":"2026-06-28","cited_by_count":40,"area":"agents"},{"id":"2604.02022","title":"ATBench: A Diverse and Realistic Agent Trajectory Benchmark for Safety Evaluation and Diagnosis","created":"2026-04-02","cited_by_count":36,"area":"agents"},{"id":"2604.05172","title":"ClawsBench: Evaluating Capability and Safety of LLM Productivity Agents in Simulated Workspaces","created":"2026-04-06","cited_by_count":33,"area":"agents"},{"id":"2508.19461","title":"Reliable Weak-to-Strong Monitoring of LLM Agents","created":"2025-08-26","cited_by_count":31,"area":"agents"},{"id":"2510.24563","title":"OSWorld-MCP: Benchmarking MCP Tool Invocation In Computer-Use Agents","created":"2025-10-28","cited_by_count":29,"area":"lr"},{"id":"2510.23883","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","created":"2025-10-27","cited_by_count":28,"area":"agents"},{"id":"2602.09222","title":"MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks","created":"2026-02-09","cited_by_count":21,"area":"agents"},{"id":"2510.24411","title":"OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows","created":"2025-10-28","cited_by_count":19,"area":"agents"},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17,"area":"agents"},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17,"area":"agents"},{"id":"2512.04864","title":"Are Your Agents Upward Deceivers?","created":"2025-12-04","cited_by_count":16,"area":"agents"},{"id":"2512.20798","title":"A Benchmark for Evaluating Outcome-Driven Constraint Violations in Autonomous AI Agents","created":"2025-12-23","cited_by_count":13,"area":"agents"},{"id":"2604.03131","title":"A Systematic Security Evaluation of OpenClaw and Its Variants","created":"2026-04-03","cited_by_count":13,"area":null},{"id":"2510.20333","title":"GhostEI-Bench: Do Mobile Agents Resilience to Environmental Injection in Dynamic On-Device Environments?","created":"2025-10-23","cited_by_count":12,"area":"agents"},{"id":"2602.01725","title":"SafePred: A Predictive Guardrail for Computer-Using Agents via World Models","created":"2026-02-02","cited_by_count":12,"area":"wm"},{"id":"2604.10577","title":"The Blind Spot of Agent Safety: How Benign User Instructions Expose Critical Vulnerabilities in Computer-Use Agents","created":"2026-04-12","cited_by_count":12,"area":"agents"},{"id":"2606.20683","title":"From Question Answering to Task Completion: A Survey on Agent System and Harness Design","created":"2026-06-14","cited_by_count":12,"area":"agents"},{"id":"2605.14271","title":"Auditing Agent Harness Safety","created":"2026-05-14","cited_by_count":11,"area":"agents"},{"id":"2512.23128","title":"It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents","created":"2025-12-29","cited_by_count":10,"area":"agents"},{"id":"2601.06663","title":"SafePro: Evaluating the Safety of Professional-Level AI Agents","created":"2026-01-10","cited_by_count":10,"area":"agents"},{"id":"2510.01670","title":"Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directedness","created":"2025-10-02","cited_by_count":9,"area":"agents"},{"id":"2602.03255","title":"LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarios","created":"2026-02-03","cited_by_count":9,"area":"agents"},{"id":"2602.08995","title":"When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents","created":"2026-02-09","cited_by_count":8,"area":"agents"},{"id":"2603.12823","title":"Adaptive Vision-Language Model Routing for Computer Use Agents","created":"2026-03-13","cited_by_count":8,"area":"mllm"},{"id":"2605.29801","title":"AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security","created":"2026-05-28","cited_by_count":8,"area":"agents"},{"id":"2608.02352","title":"Qwen-CUA: Native Computer Use for (almost) Everything","created":"2026-08-03","cited_by_count":8,"area":null},{"id":"2603.14707","title":"Visual Confused Deputy: Exploiting and Defending Perception Failures in Computer-Using Agents","created":"2026-03-16","cited_by_count":7,"area":"safety"},{"id":"2604.09155","title":"CORA: Conformal Risk-Controlled Agents for Safeguarded Mobile GUI Automation","created":"2026-04-10","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.02657","title":"Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden States","created":"2026-08-01","cited_by_count":7,"area":"agents"},{"id":"2601.17722","title":"EntWorld: A Holistic Environment and Benchmark for Verifiable Enterprise GUI Agents","created":"2026-01-25","cited_by_count":6,"area":"agents"},{"id":"2605.14859","title":"Do Coding Agents Understand Least-Privilege Authorization?","created":"2026-05-14","cited_by_count":6,"area":"agents"},{"id":"2606.02540","title":"SkillHarm: Lifecycle-Aware Skill-Based Attacks via Automated Construction","created":"2026-06-01","cited_by_count":6,"area":"agents"},{"id":"2606.05805","title":"From Risk Classification to Action Plan Remediation: A Guardrail Feedback Driven Framework for LLM Agents","created":"2026-06-04","cited_by_count":6,"area":"agents"},{"id":"2510.06607","title":"Your Harness is Not Secure: Benchmarking Real-world Threat of Command Line Interface Agent","created":"2025-10-08","cited_by_count":5,"area":"agents"},{"id":"2601.12822","title":"MirrorGuard: Toward Secure Computer-Use Agents via Simulation-to-Real Reasoning Correction","created":"2026-01-19","cited_by_count":5,"area":"agents"},{"id":"2605.10779","title":"LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments","created":"2026-05-11","cited_by_count":5,"area":"agents"},{"id":"2508.20018","title":"SWIRL: A Staged Workflow for Interleaved Reinforcement Learning in Mobile GUI Control","created":"2025-08-27","cited_by_count":4,"area":"lr"},{"id":"2602.12285","title":"From Biased Chatbots to Biased Agents: Examining Role Assignment Effects on LLM Agent Robustness","created":"2026-01-21","cited_by_count":3,"area":"agents"},{"id":"2602.14281","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents","created":"2026-02-15","cited_by_count":3,"area":"agents"},{"id":"2604.08005","title":"Preference Redirection via Attention Concentration: An Attack on Computer Use Agents","created":"2026-04-09","cited_by_count":3,"area":"agents"},{"id":"2604.23459","title":"Architecture Matters for Multi-Agent Security","created":"2026-04-25","cited_by_count":3,"area":null},{"id":"2604.27955","title":"GUI Agents with Reinforcement Learning: Toward Digital Inhabitants","created":"2026-04-30","cited_by_count":3,"area":"agents"},{"id":"2605.03952","title":"MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents","created":"2026-05-05","cited_by_count":3,"area":"agents"},{"id":"2605.17169","title":"Responsible Agentic AI Requires Explicit Provenance","created":"2026-05-16","cited_by_count":3,"area":"agents"},{"id":"2605.17986","title":"LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection","created":"2026-05-18","cited_by_count":3,"area":"agents"},{"id":"2605.23055","title":"Decomposing and Measuring Evaluation Awareness","created":"2026-05-21","cited_by_count":3,"area":null},{"id":"2607.05277","title":"Untrusted Content Masking for Web Agents with Security Guarantees","created":"2026-07-06","cited_by_count":3,"area":"agents"},{"id":"2607.27294","title":"AgentS4D: Benchmarking Runtime Risks across the Execution Lifecycle of LLM-Based Workspace Agents","created":"2026-07-29","cited_by_count":3,"area":"agents"},{"id":"2608.06477","title":"StepJack: Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection","created":"2026-08-06","cited_by_count":3,"area":"agents"},{"id":"2602.04431","title":"MaMa: A Game-Theoretic Approach for Designing Safe Agentic Systems","created":"2026-02-04","cited_by_count":2,"area":"agents"},{"id":"2602.16346","title":"Helpful to a Fault: Measuring Illicit Assistance in Multi-Turn, Multilingual LLM Agents","created":"2026-02-18","cited_by_count":2,"area":"agents"},{"id":"2603.18245","title":"Who Tests the Testers? Systematic Enumeration and Coverage Audit of LLM Agent Tool Call Safety","created":"2026-03-18","cited_by_count":2,"area":"agents"},{"id":"2605.12233","title":"No More, No Less: Task Alignment in Terminal Agents","created":"2026-05-12","cited_by_count":2,"area":null},{"id":"2606.13385","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","created":"2026-06-11","cited_by_count":2,"area":"agents"},{"id":"2606.20408","title":"NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms","created":"2026-06-18","cited_by_count":2,"area":"agents"},{"id":"2606.20636","title":"SkillHarness: Harnessing Safe Skills for Computer-Use Agents","created":"2026-06-02","cited_by_count":2,"area":"agents"},{"id":"2609.00028","title":"UI-Venus-2 Technical Report","created":"2026-08-27","cited_by_count":2,"area":"agents"},{"id":"2512.11147","title":"MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents","created":"2025-12-11","cited_by_count":1,"area":"agents"},{"id":"2602.00785","title":"World Models as an Intermediary between Agents and the Real World","created":"2026-01-31","cited_by_count":1,"area":"wm"},{"id":"2602.02395","title":"David vs. Goliath: Verifiable Agent-to-Agent Jailbreaking via Reinforcement Learning","created":"2026-02-02","cited_by_count":1,"area":"agents"},{"id":"2604.06367","title":"WebSP-Eval: Evaluating Web Agents on Website Security and Privacy Tasks","created":"2026-04-07","cited_by_count":1,"area":"agents"},{"id":"2604.07831","title":"Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection","created":"2026-04-09","cited_by_count":1,"area":"agents"},{"id":"2604.18652","title":"From Craft to Kernel: A Governance-First Execution Architecture and Semantic ISA for Agentic Computers","created":"2026-04-20","cited_by_count":1,"area":"agents"},{"id":"2604.24657","title":"AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents","created":"2026-04-27","cited_by_count":1,"area":"agents"},{"id":"2605.06393","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","created":"2026-05-07","cited_by_count":1,"area":"agents"},{"id":"2605.09497","title":"Don't Click That: Teaching Web Agents to Resist Deceptive Interfaces","created":"2026-05-10","cited_by_count":1,"area":"agents"},{"id":"2605.24069","title":"When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents","created":"2026-05-22","cited_by_count":1,"area":"agents"},{"id":"2606.02644","title":"A New Framework for Cybersecurity Refusals in AI Agents","created":"2026-05-31","cited_by_count":1,"area":"agents"},{"id":"2606.10423","title":"WebChallenger: A Reliable and Efficient Generalist Web Agent","created":"2026-06-09","cited_by_count":1,"area":"lr"},{"id":"2607.03220","title":"CONTRA: Red-Teaming Configurations of Personalizable Agents","created":"2026-07-03","cited_by_count":1,"area":"agents"},{"id":"2607.10455","title":"ANCHOR: Automated Alignment Auditing for CLI Agents on Real-World Harm","created":"2026-07-11","cited_by_count":1,"area":null},{"id":"2607.18665","title":"SciHazard: A Benchmark for Measuring Scientific Safety Risks with Decomposed Harm Scoring","created":"2026-07-21","cited_by_count":1,"area":null},{"id":"2608.02018","title":"Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents","created":"2026-08-03","cited_by_count":1,"area":"agents"},{"id":"2608.05223","title":"Towards a Risk Assessment of Malicious Skill Files in Coding Agents","created":"2026-08-05","cited_by_count":1,"area":"agents"},{"id":"2608.06663","title":"The Horizon Gap: Planning, Memory, Execution, Training, and Evaluation for Long-Horizon LLM Agents","created":"2026-08-07","cited_by_count":1,"area":"lr"},{"id":"2609.04298","title":"Harbor Adapters and Harbor-Index: Infrastructure and a Curated Meta-Dataset for Large-Scale Agentic Evaluation","created":"2026-09-03","cited_by_count":1,"area":"agents"},{"id":"2609.33658","title":"AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents","created":"2026-09-27","cited_by_count":1,"area":"agents"},{"id":"2507.15885","title":"ADEPTS: A Capability Framework for Human-Centered Agent Design","created":"2025-07-18","cited_by_count":0,"area":"agents"},{"id":"2604.18847","title":"Human-Guided Harm Recovery for Computer Use Agents","created":"2026-04-20","cited_by_count":0,"area":"agents"},{"id":"2604.18860","title":"Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agents","created":"2026-04-20","cited_by_count":0,"area":null},{"id":"2604.24348","title":"OS-SPEAR: A Toolkit for the Safety, Performance,Efficiency, and Robustness Analysis of OS Agents","created":"2026-04-27","cited_by_count":0,"area":"mllm"},{"id":"2605.07110","title":"Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability","created":"2026-05-08","cited_by_count":0,"area":"agents"},{"id":"2605.10754","title":"The Agent Use of Agent Beings: Agent Cybernetics Is the Missing Science of Foundation Agents","created":"2026-05-11","cited_by_count":0,"area":"lr"},{"id":"2606.08531","title":"ForesightSafety-SAGE:A Fully Automated Scenario Generation and Safety Evaluation Framework for LLM Agents","created":"2026-06-07","cited_by_count":0,"area":"agents"},{"id":"2606.15034","title":"OSGuard: A Benchmark for Safety in Computer-Use Agents","created":"2026-06-13","cited_by_count":0,"area":"agents"},{"id":"2606.27944","title":"It Lied to a Doctor to Buy Poison Ingredients: Quantifying Real-World Misuse of Phone-use Agents","created":"2026-06-26","cited_by_count":0,"area":null},{"id":"2607.04334","title":"Do GUI Agents Believe Their Eyes? Diagnosing State-Belief Reliance on Pixels versus Structure","created":"2026-07-05","cited_by_count":0,"area":"agents"},{"id":"2608.09476","title":"ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents","created":"2026-08-10","cited_by_count":0,"area":"agents"},{"id":"2608.17659","title":"MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps","created":"2026-08-18","cited_by_count":0,"area":"agents"},{"id":"2608.26204","title":"ADeptS-Bench: Measuring the Trustworthiness of Computer Use Agents Across Devices","created":"2026-08-25","cited_by_count":0,"area":"agents"},{"id":"2608.27009","title":"The Guard That Cried Wolf: How Scary Words Make Agent Guardrails Refuse Legitimate Actions","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2608.30441","title":"ECLIPSE: Self-Evolving Stealthy Prompt Injection Attack against Long-Horizon Agentic Systems","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.09212","title":"AgentHijack: Visual Patch Attacks on Multimodal Computer-Use Agents","created":"2026-09-06","cited_by_count":0,"area":"agents"},{"id":"2609.22178","title":"Beyond Task Completion: Training Capable and Safe Computer-Use Agents","created":"2026-08-27","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.28197","title":"PASTABench: Proactive Assessment of Sequential Trajectories for Agent Safety","created":"2026-09-23","cited_by_count":0,"area":"agents"},{"id":"2609.29647","title":"AgentKernel: The Trust-Native Agentic Operating System","created":"2026-08-29","cited_by_count":0,"area":"agents"},{"id":"2609.32378","title":"AuthorityLens: Rethinking LLM-Based Agent Systems Through the Lens of Authority","created":"2026-09-26","cited_by_count":0,"area":"lr"}],"next_cursor":"100"}