{"total":72,"rows":[{"id":"2602.15654","title":"Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections","created":"2026-02-17","cited_by_count":48,"area":"agents"},{"id":"2606.04329","title":"From Untrusted Input to Trusted Memory: A Systematic Study of Memory Poisoning Attacks in LLM Agents","created":"2026-06-03","cited_by_count":33,"area":"agents"},{"id":"2603.11619","title":"Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats","created":"2026-03-12","cited_by_count":29,"area":"agents"},{"id":"2604.16548","title":"A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecycle","created":"2026-04-17","cited_by_count":27,"area":"agents"},{"id":"2605.06716","title":"From Storage to Experience: A Survey on the Evolution of LLM Agent Memory Mechanisms","created":"2026-05-07","cited_by_count":21,"area":"agents"},{"id":"2606.24322","title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","created":"2026-06-23","cited_by_count":18,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2605.14421","title":"MemLineage: Lineage-Guided Enforcement for LLM Agent Memory","created":"2026-05-14","cited_by_count":16,"area":"agents"},{"id":"2605.25002","title":"MemMark: State-Evolution Attribution Watermarking for Agent Long-Term Memory Systems","created":"2026-05-24","cited_by_count":16,"area":"agents"},{"id":"2605.18930","title":"OEP: Poisoning Self-Evolving LLM Agents via Locally Correct but Non-Transferable Experiences","created":"2026-05-18","cited_by_count":14,"area":"agents"},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11,"area":"agents"},{"id":"2606.25115","title":"Forget to Improve: On-Device LLM-Agent Continual Learning via Budget-Curated Memory","created":"2026-06-23","cited_by_count":9,"area":"agents"},{"id":"2603.05520","title":"Information-Theoretic Privacy Control for Sequential Multi-Agent LLM Systems","created":"2026-02-13","cited_by_count":8,"area":"agents"},{"id":"2604.15367","title":"SoK: Security of Autonomous LLM Agents in Agentic Commerce","created":"2026-04-15","cited_by_count":8,"area":"agents"},{"id":"2606.23075","title":"Safety in Self-Evolving LLM Agent Systems: Threats, Amplification, and Case Studies","created":"2026-06-22","cited_by_count":8,"area":"agents"},{"id":"2607.05029","title":"Your Agent's Memories Are Not Its Own: Forged Reasoning Attacks on LLM Agent Memory and Defenses","created":"2026-07-06","cited_by_count":8,"area":"lr"},{"id":"2605.23723","title":"MemAudit: Post-hoc Auditing of Poisoned Agent Memory via Causal Attribution and Structural Anomaly Detection","created":"2026-05-22","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2607.14651","title":"MemPoison: Uncovering Persistent Memory Threats and Structural Blind Spots in LLM Agents","created":"2026-07-16","cited_by_count":7,"area":"agents"},{"id":"2605.17641","title":"Causal Intervention-Based Memory Selection for Long-Horizon LLM Agents","created":"2026-05-17","cited_by_count":6,"area":"agents"},{"id":"2607.01480","title":"Procedural Memory Distillation: Online Reflection for Self-Improving Language Models","created":"2026-07-01","cited_by_count":6,"area":"synth"},{"id":"2607.06595","title":"When Agents Remember Too Much: Memory Poisoning Attacks on Large Language Model Agents","created":"2026-07-06","cited_by_count":6,"area":"agents"},{"id":"2608.03509","title":"SkillJack: Persistent Skill Backdoors in Self-Evolving Agents","created":"2026-08-04","cited_by_count":6,"area":"safety"},{"id":"2603.23064","title":"Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution","created":"2026-03-24","cited_by_count":5,"area":null},{"id":"2604.16966","title":"Visual Inception: Compromising Long-term Planning in Agentic Recommenders via Multimodal Memory Poisoning","created":"2026-04-18","cited_by_count":5,"area":"agents"},{"id":"2605.08442","title":"Injection-Execution Dissociation: A Mechanistic Evaluation of Persistent Memory Attacks and Defenses in Stateful LLM Agents","created":"2026-05-08","cited_by_count":5,"area":"agents"},{"id":"2604.19657","title":"An AI Agent Execution Environment to Safeguard User Data","created":"2026-04-21","cited_by_count":4,"area":null},{"id":"2605.29960","title":"Hijacking Agent Memory: Stealthy Trojan Attacks Through Conversational Interaction","created":"2026-05-28","cited_by_count":4,"area":"agents"},{"id":"2606.12703","title":"SMSR: Certified Defence Against Runtime Memory Poisoning in Persistent LLM Agent Systems","created":"2026-06-10","cited_by_count":4,"area":"rag"},{"id":"2603.26221","title":"Clawed and Dangerous: Can We Trust Open Agentic Systems?","created":"2026-03-27","cited_by_count":3,"area":"agents"},{"id":"2604.21131","title":"Cross-Session Threats in AI Agents: Benchmark, Evaluation, and Algorithms","created":"2026-04-22","cited_by_count":3,"area":"agents"},{"id":"2605.03482","title":"MEMSAD: Gradient-Coupled Anomaly Detection for Memory Poisoning in Retrieval-Augmented Agents","created":"2026-05-05","cited_by_count":3,"area":"rag"},{"id":"2605.28201","title":"Plant, Persist, Trigger: Sleeper Attack on Large Language Model Agents","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2602.21447","title":"Adversarial Intent is a Latent Variable: Stateful Trust Inference for Securing Multimodal Agentic RAG","created":"2026-02-24","cited_by_count":2,"area":"agents"},{"id":"2604.08304","title":"Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions","created":"2026-04-09","cited_by_count":2,"area":"rag"},{"id":"2605.22321","title":"ASEval: Automated Trajectory-Level Security Testing for Autonomous Agents","created":"2026-05-21","cited_by_count":2,"area":"agents"},{"id":"2607.05189","title":"When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents","created":"2026-07-06","cited_by_count":2,"area":"agents"},{"id":"2608.01759","title":"Benign Alone, Harmful Together: Exploiting Experience Composition in Self-Evolving LLM Agents","created":"2026-08-03","cited_by_count":2,"area":"agents"},{"id":"2604.15774","title":"MemEvoBench: Benchmarking Safety Risks from Memory Misevolution in LLM Agents","created":"2026-04-17","cited_by_count":1,"area":"agents"},{"id":"2604.16358","title":"SaFeR-Steer: Evolving Multi-Turn MLLMs via Synthetic Bootstrapping and Feedback Dynamics","created":"2026-03-18","cited_by_count":1,"area":"alignment"},{"id":"2604.24657","title":"AgentWard: A Lifecycle Security Architecture for Autonomous AI Agents","created":"2026-04-27","cited_by_count":1,"area":"agents"},{"id":"2605.09033","title":"ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflicts","created":"2026-05-09","cited_by_count":1,"area":"lr"},{"id":"2605.22842","title":"The Misattribution Gap: When Memory Poisoning Looks Like Model Failure in Agentic AI Systems","created":"2026-05-12","cited_by_count":1,"area":"agents"},{"id":"2606.10742","title":"MemVenom: Triggered Poisoning of Multimodal Memories in Web Agents","created":"2026-06-09","cited_by_count":1,"area":"agents"},{"id":"2608.08131","title":"Compositional Threat Analysis of Latent Compromise in LLM Agent Systems: The Order 66 Scenario","created":"2026-08-08","cited_by_count":1,"area":"agents"},{"id":"2608.17148","title":"Authorization Before Context: A Model-Neutral Audience Boundary Against Cross-Audience Memory Leakage in Agentic Systems","created":"2026-08-17","cited_by_count":1,"area":"agents"},{"id":"2608.20631","title":"Weighted Memory Tree: Remembering What Matters for Long-Horizon LLM Agents","created":"2026-08-21","cited_by_count":1,"area":"agents"},{"id":"2609.08258","title":"Revoked but Still Authoritative: An Empirical Study of Revocation Enforcement in Agent-Memory Systems","created":"2026-09-08","cited_by_count":1,"area":"agents"},{"id":"2610.07645","title":"SkillPoison: Progressive Skill Poisoning via Successful Experiences","created":"2026-10-06","cited_by_count":1,"area":"agents"},{"id":"2610.11183","title":"RAG-Stress: Probing the Limits of Evidence Reliance in Retrieval-Augmented Generation","created":"2026-10-08","cited_by_count":1,"area":"rag"},{"id":"2605.08463","title":"Behavioral Determinants of Deployed AI Agents in Social Networks: A Multi-Factor Study of Personality, Model, and Guardrail Specification","created":"2026-05-08","cited_by_count":0,"area":"agents"},{"id":"2605.08468","title":"PYTHALAB-MERA: Validation-Grounded Memory, Retrieval, and Acceptance Control for Frozen-LLM Coding Agents","created":"2026-05-08","cited_by_count":0,"area":"agents"},{"id":"2605.12535","title":"Ghost in the Context: Policy-Carriage Integrity in LLM Agents","created":"2026-05-02","cited_by_count":0,"area":"agents"},{"id":"2605.13471","title":"Sleeper Channels and Provenance Gates: Persistent Prompt Injection in Always-on Autonomous AI Agents","created":"2026-05-13","cited_by_count":0,"area":"safety"},{"id":"2606.24402","title":"Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agents","created":"2026-06-23","cited_by_count":0,"area":"rag"},{"id":"2608.00677","title":"OpenART: Scaling Agent Red Teaming via Open-Ended Environment Evolution","created":"2026-08-01","cited_by_count":0,"area":"safety"},{"id":"2608.01637","title":"Salami Attack: Stealthy Collusive Memory Poisoning against OpenClaw","created":"2026-08-03","cited_by_count":0,"area":"agents"},{"id":"2608.03844","title":"MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents","created":"2026-08-04","cited_by_count":0,"area":"agents"},{"id":"2608.17665","title":"GraphWake: Group Polarization via Memory-Mediated Polarization Cascade in LLM-Agent Communities","created":"2026-08-18","cited_by_count":0,"area":"agents"},{"id":"2608.22061","title":"MEMORY Wins All: Indirect Bias Injection Attacks via Social Media Feeds","created":"2026-08-22","cited_by_count":0,"area":"safety"},{"id":"2608.30177","title":"Understanding Stage-Wise Utility-Risk Trade-offs in LLM Agent Memory","created":"2026-08-31","cited_by_count":0,"area":"agents"},{"id":"2609.08747","title":"MemSentry: A Framework for Detecting Persistent Memory Poisoning in Agentic AI","created":"2026-09-08","cited_by_count":0,"area":"agents"},{"id":"2609.18460","title":"Collective Loss of Control in LLM Agent Systems: An Epidemic Account of Mutation, Contagion, and Recovery","created":"2026-09-16","cited_by_count":0,"area":"agents"},{"id":"2609.22961","title":"When Agentic Trust Crosses Organizational Boundaries: Structural Externalization and a Reference Model for Trust Evidence","created":"2026-09-19","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.23894","title":"Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.34132","title":"From Attack Success to Attack Severity: Counterfactual Memory Attacks on LLM Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.34245","title":"Certified Multi-Source Integrity for Structured Agent Actions","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2609.35576","title":"Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents","created":"2026-09-28","cited_by_count":0,"area":"agents"},{"id":"2610.02569","title":"Pincer: Resource Authorization for Agents using a Digital Twin","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.02920","title":"HASTE: Evolving Agent Harnesses Against Emerging Attacks Using Sparse Evidence","created":"2026-10-02","cited_by_count":0,"area":null},{"id":"2610.06274","title":"What May an Agent Change About Itself? A Containment Floor for Self-Configuring Agent Runtimes","created":"2026-10-05","cited_by_count":0,"area":null}],"next_cursor":null}