{"total":54,"rows":[{"id":"2606.24322","title":"Securing LLM-Agent Long-Term Memory Against Poisoning: Non-Malleable, Origin-Bound Authority with Machine-Checked Guarantees","created":"2026-06-23","cited_by_count":18,"area":"agents"},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16,"area":"agents"},{"id":"2604.24026","title":"From Skill Text to Skill Structure: The Scheduling-Structural-Logical Representation for Agent Skills","created":"2026-04-27","cited_by_count":16,"area":"agents"},{"id":"2605.09163","title":"FORTIS: Benchmarking Over-Privilege in Agent Skills","created":"2026-05-09","cited_by_count":13,"area":"agents"},{"id":"2606.20023","title":"When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents","created":"2026-06-18","cited_by_count":13,"area":"agents"},{"id":"2605.11039","title":"The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck","created":"2026-05-11","cited_by_count":11,"area":"lr"},{"id":"2605.26542","title":"ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuation","created":"2026-05-26","cited_by_count":11,"area":null},{"id":"2607.02357","title":"Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware","created":"2026-07-02","cited_by_count":10,"area":"agents"},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9,"area":"agents"},{"id":"2602.19555","title":"SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime","created":"2026-02-23","cited_by_count":8,"area":"agents"},{"id":"2605.00314","title":"Semia: Auditing Agent Skills via Constraint-Guided Representation Synthesis","created":"2026-05-01","cited_by_count":7,"area":"agents"},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7,"area":"agents"},{"id":"2608.15888","title":"Bounded Agents: Delegation Security for Multi-Agent AI Systems","created":"2026-08-16","cited_by_count":7,"area":"agents"},{"id":"2604.04604","title":"AI Agents Under EU Law","created":"2026-04-06","cited_by_count":5,"area":null},{"id":"2605.13044","title":"No Attack Required: Semantic Fuzzing for Specification Violations in Agent Skills","created":"2026-05-13","cited_by_count":5,"area":"agents"},{"id":"2606.19464","title":"Deontic Policies for Runtime Governance of Agentic AI Systems","created":"2026-06-17","cited_by_count":5,"area":"agents"},{"id":"2608.21159","title":"AID-Guard: Stateful Authorization for Delegated Agent Effects","created":"2026-08-21","cited_by_count":5,"area":null},{"id":"2608.07556","title":"MasDrift: Benchmarking Authorization Preservation Across Multi-Agent Architectures","created":"2026-08-02","cited_by_count":4,"area":null},{"id":"2603.18377","title":"PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents","created":"2026-03-19","cited_by_count":3,"area":"agents"},{"id":"2604.02767","title":"SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems","created":"2026-04-03","cited_by_count":3,"area":"agents"},{"id":"2605.28071","title":"AgentGuard: An Attribute-Based Access Control Framework for Tool-Use LLM-Based Agent","created":"2026-05-27","cited_by_count":3,"area":"agents"},{"id":"2604.12986","title":"Parallax: Why AI Agents That Think Must Never Act","created":"2026-04-14","cited_by_count":2,"area":"safety"},{"id":"2606.00497","title":"\"I Strongly Suspect This Website Is a Scam\": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents","created":"2026-05-30","cited_by_count":2,"area":"agents"},{"id":"2607.11698","title":"Agent Hacks Agent: Autoresearch for Production-Agent Red-Teaming","created":"2026-07-13","cited_by_count":2,"area":"agents"},{"id":"2608.22868","title":"AgentFlow: A Flow-Centric Policy Language and Framework for Securing LLM Agent Systems","created":"2026-08-24","cited_by_count":2,"area":"agents"},{"id":"2608.30091","title":"VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows","created":"2026-08-30","cited_by_count":2,"area":null},{"id":"2605.18414","title":"Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control","created":"2026-05-18","cited_by_count":1,"area":null},{"id":"2605.29082","title":"The Importance of Out-of-Band Metadata for Safe Autonomous Agents: The Redpanda Agentic Data Plane","created":"2026-05-27","cited_by_count":1,"area":"agents"},{"id":"2606.15549","title":"One Goal, Many Commands: Characterizing Denylist Fragility in AI Agents","created":"2026-06-14","cited_by_count":1,"area":"agents"},{"id":"2606.31174","title":"ClawArena-Team: Benchmarking Subagent Orchestration and Dynamic Workflows in Language-Model Agents","created":"2026-06-30","cited_by_count":1,"area":"agents"},{"id":"2607.25076","title":"Towards an Agent Operating System - Lessons from Classical and Cloud OS","created":"2026-07-27","cited_by_count":1,"area":"agents"},{"id":"2608.09828","title":"Multi-Agent AI Safety as an Institutional Design Problem","created":"2026-08-10","cited_by_count":1,"area":null},{"id":"2609.39050","title":"Covert Assistance: Helpful LLM Agents Evade Oversight in Multi-Agent Systems","created":"2026-09-30","cited_by_count":1,"area":"agents"},{"id":"2603.22869","title":"Chain-of-Authorization: Embedding authorization into large language models","created":"2026-03-24","cited_by_count":0,"area":null},{"id":"2606.24245","title":"AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming","created":"2026-06-23","cited_by_count":0,"area":"agents"},{"id":"2606.26627","title":"Agents That Know Too Much: A Data-Centric Survey of Privacy in LLM Agents","created":"2026-06-25","cited_by_count":0,"area":"agents"},{"id":"2606.28739","title":"Agent Safety Is Action Alignment","created":"2026-06-27","cited_by_count":0,"area":"agents"},{"id":"2607.05743","title":"The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities","created":"2026-07-07","cited_by_count":0,"area":"agents"},{"id":"2607.17986","title":"Self-State Attacks on Self-Hosted AI Agents: How Far Can OS Defenses Go?","created":"2026-07-20","cited_by_count":0,"area":null},{"id":"2608.04292","title":"Binding Biometrics with AI Agent Identifiers for Delegation of Authority","created":"2026-08-04","cited_by_count":0,"area":null},{"id":"2608.04755","title":"\"Allow\" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agents","created":"2026-08-05","cited_by_count":0,"area":"agents"},{"id":"2608.15108","title":"Beyond Direct Access: Resource Hijacking in LLM Agents","created":"2026-08-15","cited_by_count":0,"area":"agents"},{"id":"2608.27646","title":"If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary","created":"2026-08-27","cited_by_count":0,"area":"safety"},{"id":"2609.10181","title":"Can AI Agents Deliver Verifiable Network-Wide Outcomes Across Authority Boundaries?","created":"2026-09-09","cited_by_count":0,"area":null},{"id":"2609.18217","title":"Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines","created":"2026-09-16","cited_by_count":0,"area":"agents"},{"id":"2609.22949","title":"Beyond Single-Model Injection: A Threat Model and Defense Architecture for Prompt Injection in Multi-Agent Systems","created":"2026-09-19","cited_by_count":0,"area":"agents"},{"id":"2609.23700","title":"When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.23894","title":"Connecting the Dots in Agentic AI Security: A Cross-Dimensional Threat Taxonomy, Evaluation Maturity, and Open Challenges","created":"2026-09-20","cited_by_count":0,"area":"agents"},{"id":"2609.27336","title":"CART: Closed-Loop Adaptive Red Teaming for Large Language Models","created":"2026-09-23","cited_by_count":0,"area":"safety"},{"id":"2609.32378","title":"AuthorityLens: Rethinking LLM-Based Agent Systems Through the Lens of Authority","created":"2026-09-26","cited_by_count":0,"area":"lr"},{"id":"2610.01195","title":"Federated Agent Optimization","created":"2026-10-01","cited_by_count":0,"area":"agents"},{"id":"2610.06274","title":"What May an Agent Change About Itself? A Containment Floor for Self-Configuring Agent Runtimes","created":"2026-10-05","cited_by_count":0,"area":null},{"id":"2610.06966","title":"APEX: Active Protection at Execution Boundaries for LLM Agents","created":"2026-10-03","cited_by_count":0,"area":"agents"},{"id":"2610.15390","title":"From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agents","created":"2026-10-11","cited_by_count":0,"area":"agents"}],"next_cursor":null}