{"total":66,"rows":[{"id":"2510.15994","title":"MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents","created":"2025-10-14","cited_by_count":42,"area":"agents"},{"id":"2512.15163","title":"MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real-World MCP Servers","created":"2025-12-17","cited_by_count":34,"area":"agents"},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27,"area":"agents"},{"id":"2603.00195","title":"Formal Analysis and Supply Chain Security for Agentic AI Skills","created":"2026-02-27","cited_by_count":25,"area":"agents"},{"id":"2604.04759","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","created":"2026-04-06","cited_by_count":20,"area":"agents"},{"id":"2601.05755","title":"VIGIL: Defending LLM Agents Against Tool Stream Injection via Verify-Before-Commit","created":"2026-01-09","cited_by_count":17,"area":"agents"},{"id":"2512.08290","title":"Systematization of Knowledge: Security and Safety in the Model Context Protocol Ecosystem","created":"2025-12-09","cited_by_count":16,"area":"agents"},{"id":"2604.07223","title":"TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories","created":"2026-04-08","cited_by_count":16,"area":"agents"},{"id":"2601.07395","title":"MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP","created":"2026-01-12","cited_by_count":14,"area":"agents"},{"id":"2512.06556","title":"Semantic Attacks on Tool-Augmented LLMs: Securing the Model Context Protocol Against Descriptor-Level Manipulation","created":"2025-12-06","cited_by_count":13,"area":"agents"},{"id":"2604.03131","title":"A Systematic Security Evaluation of OpenClaw and Its Variants","created":"2026-04-03","cited_by_count":13,"area":null},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2603.22489","title":"Model Context Protocol Threat Modeling and Analyzing Vulnerabilities to Prompt Injection with Tool Poisoning","created":"2026-03-23","cited_by_count":10,"area":"safety"},{"id":"2605.20530","title":"AgentAtlas: Beyond Outcome Leaderboards for LLM Agents","created":"2026-05-19","cited_by_count":10,"area":"agents"},{"id":"2602.03255","title":"LPS-Bench: Benchmarking Safety Awareness of Computer-Use Agents in Long-Horizon Planning under Benign and Adversarial Scenarios","created":"2026-02-03","cited_by_count":9,"area":"agents"},{"id":"2603.12614","title":"ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents","created":"2026-03-13","cited_by_count":9,"area":"agents"},{"id":"2606.22504","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","created":"2026-06-21","cited_by_count":8,"area":"agents"},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5,"area":"agents"},{"id":"2602.01129","title":"SMCP: Secure Model Context Protocol","created":"2026-02-01","cited_by_count":5,"area":"agents"},{"id":"2602.14798","title":"Overthinking Loops in Agents: A Structural Risk via MCP Tools","created":"2026-02-16","cited_by_count":5,"area":"lr"},{"id":"2604.01532","title":"PHMForge: Evaluating LLM Agents on Industrial Prognostics through MCP-Native, Algorithm-Grounded Tools","created":"2026-04-02","cited_by_count":4,"area":"agents"},{"id":"2602.14281","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents","created":"2026-02-15","cited_by_count":3,"area":"agents"},{"id":"2602.15945","title":"From Tool Orchestration to Code Execution: A Study of MCP Design Choices","created":"2026-02-17","cited_by_count":3,"area":"agents"},{"id":"2604.05969","title":"A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms","created":"2026-04-07","cited_by_count":3,"area":"agents"},{"id":"2605.28201","title":"Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2606.20922","title":"Think Twice Before You Act: Protecting LLM Agents Against Tool Description Poisoning via Isolated Planning","created":"2026-06-18","cited_by_count":3,"area":"agents"},{"id":"2510.23675","title":"QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents","created":"2025-10-27","cited_by_count":2,"area":"agents"},{"id":"2512.14166","title":"IntentMiner: Intent Inversion Attack via Tool Call Analysis in the Model Context Protocol","created":"2025-12-16","cited_by_count":2,"area":"agents"},{"id":"2602.19844","title":"LLM-enabled Applications Require System-Level Threat Monitoring","created":"2026-02-23","cited_by_count":2,"area":null},{"id":"2603.13417","title":"Bridging Protocol and Production: Design Patterns for Deploying AI Agents with Model Context Protocol","created":"2026-03-12","cited_by_count":2,"area":"agents"},{"id":"2604.07551","title":"MCP-DPT: A Defense-Placement Taxonomy and Coverage Analysis for Model Context Protocol Security","created":"2026-04-08","cited_by_count":2,"area":"agents"},{"id":"2605.17453","title":"Trust No Tool: Evaluating and Defending LLM Agents under Untrusted Tool Feedback","created":"2026-05-17","cited_by_count":2,"area":"agents"},{"id":"2606.04769","title":"Description-Code Inconsistency in Real-world MCP Servers: Measurement, Detection, and Security Implications","created":"2026-06-03","cited_by_count":2,"area":"agents"},{"id":"2608.29381","title":"Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback","created":"2026-08-29","cited_by_count":2,"area":null},{"id":"2604.04426","title":"ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems","created":"2026-04-06","cited_by_count":1,"area":"agents"},{"id":"2604.17125","title":"CASCADE: A Component Ablation and Corpus Audit of a Layered Local Defense for MCP-Based Systems","created":"2026-04-18","cited_by_count":1,"area":"agents"},{"id":"2605.09822","title":"Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoning","created":"2026-05-10","cited_by_count":1,"area":"agents"},{"id":"2605.11053","title":"Content-Aware Attack Detection in LLM Agent Tool-Call Traffic: An Empirical Study of Features, Architectures, and Evaluation Protocols","created":"2026-05-11","cited_by_count":1,"area":"agents"},{"id":"2605.24069","title":"When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents","created":"2026-05-22","cited_by_count":1,"area":"agents"},{"id":"2606.15822","title":"TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AI","created":"2026-06-14","cited_by_count":1,"area":"agents"},{"id":"2608.19901","title":"MaliciousSkillBench: A Comprehensive Benchmark for Malicious Agent Skill Detection","created":"2026-08-20","cited_by_count":1,"area":"agents"},{"id":"2608.28411","title":"LongPIBench: A Long-Context Benchmark for Prompt Injection","created":"2026-08-28","cited_by_count":1,"area":"safety"},{"id":"2609.14631","title":"LLM Agent Capabilities Should Follow Task Intent and Context Source","created":"2026-09-13","cited_by_count":1,"area":"agents"},{"id":"2604.10534","title":"Machine Learning-Based Detection of MCP Attacks","created":"2026-04-12","cited_by_count":0,"area":null},{"id":"2605.16471","title":"From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI","created":"2026-05-15","cited_by_count":0,"area":"agents"},{"id":"2606.00566","title":"Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models","created":"2026-05-30","cited_by_count":0,"area":"agents"},{"id":"2607.04146","title":"!Imperio, smolVLA: The Implications of Data Poisoning on Open Source Robotics","created":"2026-07-05","cited_by_count":0,"area":"safety"},{"id":"2607.05744","title":"Unicode TAG-Block Concealment of Tool-Metadata Payloads in the Model Context Protocol: An Approval-View Fidelity Gap Across Three Independent Server Implementations","created":"2026-07-07","cited_by_count":0,"area":"agents"},{"id":"2608.06130","title":"Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture","created":"2026-08-06","cited_by_count":0,"area":"agents"},{"id":"2608.07952","title":"Persistent Semantic Entities in Tool-Augmented LLM Systems","created":"2026-08-08","cited_by_count":0,"area":"agents"},{"id":"2608.09476","title":"ActBench: Self-Evolving Benchmark of Behavioral Safety in Cowork Agents","created":"2026-08-10","cited_by_count":0,"area":"agents"},{"id":"2608.12977","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","created":"2026-08-13","cited_by_count":0,"area":"agents"},{"id":"2608.14876","title":"Workspace Topology as an Attack Vector in Agentic Coding Assistants","created":"2026-08-14","cited_by_count":0,"area":"agents"},{"id":"2608.17275","title":"When Agents Act on Web3: An Attack-Surface Survey of MCP, Skills, and Tool Calling","created":"2026-08-18","cited_by_count":0,"area":"agents"},{"id":"2608.20481","title":"AEGIS: Preventing Cross-Domain Resource Abuse in MCP","created":"2026-08-20","cited_by_count":0,"area":"agents"},{"id":"2608.23763","title":"TrustShiftProbe: Characterizing, Benchmarking, and Defending Staged Trust Attacks on MCP Servers","created":"2026-08-24","cited_by_count":0,"area":"agents"},{"id":"2609.01677","title":"Skill-as-API: Confidential Multi-Agent Coordination for Agentic Software Engineering","created":"2026-09-01","cited_by_count":0,"area":"agents"},{"id":"2609.22961","title":"When Agentic Trust Crosses Organizational Boundaries: Structural Externalization and a Reference Model for Trust Evidence","created":"2026-09-19","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.27336","title":"CART: Closed-Loop Adaptive Red Teaming for Large Language Models","created":"2026-09-23","cited_by_count":0,"area":"safety"},{"id":"2609.28915","title":"On the Effectiveness of Kernel-Level Evidence for Agent Security","created":"2026-09-24","cited_by_count":0,"area":"agents"},{"id":"2609.32635","title":"Trust the Brand, Lose Control: How Identity Hijacks LLM Agent Orchestration","created":"2026-09-26","cited_by_count":0,"area":"agents"},{"id":"2609.33371","title":"API Secrets Should Never Become Tokens in the LLM's Vocabulary: A Threat Analysis of API Credential Handling in LLM Agent Systems and an Empirical Evaluation of a Vault-Mediated Execution Boundary","created":"2026-09-27","cited_by_count":0,"area":"agents"},{"id":"2609.35889","title":"SINGED: Correct Outputs Do Not Certify Safe Execution in LLM Agents","created":"2026-09-27","cited_by_count":0,"area":"agents"},{"id":"2610.04378","title":"COPEX: Benchmarking LLM Robustness to Adversarial Context Across Model Context Protocol Layers","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.06401","title":"RAISED: Self-Distillation for Robustness to Prompt Injection in LLM Agents","created":"2026-10-05","cited_by_count":0,"area":"agents"}],"next_cursor":null}