{"list":"closest","total":159,"rows":[{"id":"2604.12461","title":"CIA: Inferring the Communication Topology from LLM-based Multi-Agent Systems","created":"2026-04-14","cited_by_count":3},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27},{"id":"2604.10134","title":"PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification","created":"2026-04-11","cited_by_count":4},{"id":"2604.08407","title":"Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain","created":"2026-04-09","cited_by_count":13},{"id":"2604.08608","title":"Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines","created":"2026-04-08","cited_by_count":5},{"id":"2604.06811","title":"SkillTrojan: Backdoor Attacks on Skill-Based Agent Systems","created":"2026-04-08","cited_by_count":25},{"id":"2604.05432","title":"Your LLM Agent Can Leak Your Data: Data Exfiltration via Backdoored Tool Use","created":"2026-04-07","cited_by_count":10},{"id":"2604.04989","title":"SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement","created":"2026-04-05","cited_by_count":30},{"id":"2604.03870","title":"Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs","created":"2026-04-04","cited_by_count":4},{"id":"2604.02837","title":"Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis","created":"2026-04-03","cited_by_count":13},{"id":"2604.01438","title":"ClawSafety: \"Safe\" LLMs, Unsafe Agents","created":"2026-04-01","cited_by_count":17},{"id":"2604.01350","title":"No Attacker Needed: Unintentional Cross-User Contamination in Shared-State LLM Agents","created":"2026-04-01","cited_by_count":6},{"id":"2603.19469","title":"A Framework for Formalizing LLM Agent Security","created":"2026-03-19","cited_by_count":16},{"id":"2603.17673","title":"Towards Reliable Local Security Agents: Verifiable Post-Training for Linux Privilege Escalation","created":"2026-03-18","cited_by_count":1},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17},{"id":"2603.15125","title":"From Storage to Steering: Memory Control Flow Attacks on LLM Agents","created":"2026-03-16","cited_by_count":19},{"id":"2603.11853","title":"OpenClaw PRISM: A Zero-Fork, Defense-in-Depth Runtime Security Layer for Tool-Augmented LLM Agents","created":"2026-03-12","cited_by_count":11},{"id":"2603.11619","title":"Taming OpenClaw: Security Analysis and Mitigation of Autonomous LLM Agent Threats","created":"2026-03-12","cited_by_count":29},{"id":"2603.11132","title":"WebWeaver: Breaking Topology Confidentiality in LLM Multi-Agent Systems with Stealthy Context-Based Inference","created":"2026-03-11","cited_by_count":3},{"id":"2603.10749","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","created":"2026-03-11","cited_by_count":38},{"id":"2603.09134","title":"AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations","created":"2026-03-10","cited_by_count":2},{"id":"2603.07496","title":"From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents","created":"2026-03-08","cited_by_count":1},{"id":"2603.13325","title":"Auditing Cascading Risks in Multi-Agent Systems via Semantic-Geometric Co-evolution","created":"2026-03-04","cited_by_count":1},{"id":"2603.04469","title":"Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems","created":"2026-03-04","cited_by_count":3},{"id":"2602.22724","title":"AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purification","created":"2026-02-26","cited_by_count":29},{"id":"2602.22450","title":"Silent Egress: When Implicit Prompt Injection Makes LLM Agents Leak Without a Trace","created":"2026-02-25","cited_by_count":3},{"id":"2602.20720","title":"AdapTools: Adaptive Tool-based Indirect Prompt Injection Attacks on Agentic LLMs","created":"2026-02-24","cited_by_count":13},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10},{"id":"2602.20156","title":"Skill-Inject: Measuring Agent Vulnerability to Skill File Attacks","created":"2026-02-23","cited_by_count":90},{"id":"2602.19555","title":"SOK: A Taxonomy of Attack Vectors and Defense Strategies for Agentic Supply Chain Runtime","created":"2026-02-23","cited_by_count":8},{"id":"2602.16901","title":"AgentLAB: Benchmarking LLM Agents against Long-Horizon Attacks","created":"2026-02-18","cited_by_count":39},{"id":"2602.15654","title":"Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections","created":"2026-02-17","cited_by_count":48},{"id":"2602.14798","title":"Overthinking Loops in Agents: A Structural Risk via MCP Tools","created":"2026-02-16","cited_by_count":5},{"id":"2602.14211","title":"SkillJect: Effectively Automating Skill-Based Prompt Injection for Skill-Enabled Agents","created":"2026-02-15","cited_by_count":25},{"id":"2603.05520","title":"Information-Theoretic Privacy Control for Sequential Multi-Agent LLM Systems","created":"2026-02-13","cited_by_count":8},{"id":"2602.13477","title":"OMNI-LEAK: Orchestrator Multi-Agent Network Induced Data Leakage","created":"2026-02-13","cited_by_count":9},{"id":"2602.12194","title":"MalTool: Malicious Tool Attacks on LLM Agents","created":"2026-02-12","cited_by_count":20},{"id":"2602.10465","title":"Authenticated Workflows: A Systems Approach to Protecting Agentic AI","created":"2026-02-11","cited_by_count":4},{"id":"2602.08412","title":"From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent","created":"2026-02-09","cited_by_count":29},{"id":"2602.07398","title":"AgentSys: Secure and Dynamic LLM Agents Through Explicit Hierarchical Memory Management","created":"2026-02-07","cited_by_count":10},{"id":"2602.05523","title":"Capture the Flags: Family-Based Evaluation of Agentic LLMs via Semantics-Preserving Transformations","created":"2026-02-05","cited_by_count":3},{"id":"2602.05066","title":"Bypassing AI Control Protocols via Agent-as-a-Proxy Attacks","created":"2026-02-04","cited_by_count":1},{"id":"2602.01942","title":"Human Society-Inspired Approaches to Agentic AI Security: The 4C Framework","created":"2026-02-02","cited_by_count":2},{"id":"2601.17549","title":"Breaking the Protocol: Security Analysis of the Model Context Protocol Specification and Prompt Injection Vulnerabilities in Tool-Integrated LLM Agents","created":"2026-01-24","cited_by_count":19},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31},{"id":"2601.12449","title":"AgenTRIM: Tool Risk Mitigation for Agentic AI","created":"2026-01-18","cited_by_count":11},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54},{"id":"2601.10955","title":"Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents","created":"2026-01-16","cited_by_count":14},{"id":"2601.10156","title":"ToolSafe: Enhancing Tool Invocation Safety of LLM-based agents via Proactive Step-level Guardrail and Feedback","created":"2026-01-15","cited_by_count":72},{"id":"2601.10758","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","created":"2026-01-14","cited_by_count":3},{"id":"2601.09923","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","created":"2026-01-14","cited_by_count":17},{"id":"2601.07395","title":"MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP","created":"2026-01-12","cited_by_count":14},{"id":"2601.05504","title":"Memory Poisoning Attack and Defense on Memory Based LLM-Agents","created":"2026-01-09","cited_by_count":44},{"id":"2601.04795","title":"Defense Against Indirect Prompt Injection via Tool Result Parsing","created":"2026-01-08","cited_by_count":9},{"id":"2601.01241","title":"MCP-SandboxScan: WASM-based Secure Execution and Runtime Analysis for MCP Tools","created":"2026-01-03","cited_by_count":3},{"id":"2512.23557","title":"Toward Trustworthy Agentic AI: A Multimodal Framework for Preventing Prompt Injection Attacks","created":"2025-12-29","cited_by_count":8},{"id":"2512.16962","title":"MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval","created":"2025-12-18","cited_by_count":72},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11},{"id":"2512.04129","title":"Don't Trust Your Upstream: Exploiting LLM Multi-Agent System via Topology-Guided Adversarial Propagation","created":"2025-12-03","cited_by_count":5},{"id":"2511.18467","title":"Shadows in the Code: Exploring the Risks and Defenses of LLM-based Multi-Agent Software Development Systems","created":"2025-11-23","cited_by_count":9},{"id":"2511.10949","title":"Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting","created":"2025-11-14","cited_by_count":8},{"id":"2511.05269","title":"TAMAS: Benchmarking Adversarial Risks in Multi-Agent LLM Systems","created":"2025-11-07","cited_by_count":26},{"id":"2510.23675","title":"QueryIPI: Query-agnostic Indirect Prompt Injection on Coding Agents","created":"2025-10-27","cited_by_count":2},{"id":"2510.21236","title":"AgentBound: Securing Execution Boundaries of AI Agents","created":"2025-10-24","cited_by_count":23},{"id":"2510.14312","title":"Terrarium: Revisiting the Blackboard for Multi-Agent Safety, Privacy, and Security Studies","created":"2025-10-16","cited_by_count":10},{"id":"2510.15994","title":"MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents","created":"2025-10-14","cited_by_count":42},{"id":"2510.11246","title":"Collaborative Shadows: Distributed Backdoor Attacks in LLM-Based Multi-Agent Systems","created":"2025-10-13","cited_by_count":3},{"id":"2510.10073","title":"SecureWebArena: A Holistic Security Evaluation Benchmark for LVLM-based Web Agents","created":"2025-10-11","cited_by_count":19},{"id":"2510.04257","title":"AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents","created":"2025-10-05","cited_by_count":4},{"id":"2510.01354","title":"WAInjectBench: Benchmarking Prompt Injection Detections for Web Agents","created":"2025-10-01","cited_by_count":24},{"id":"2509.25926","title":"Preventing Prompt Injection with Type-Directed Privilege Separation","created":"2025-09-30","cited_by_count":9},{"id":"2509.25885","title":"SafeMind: Benchmarking and Mitigating Safety Risks in Embodied LLM Agents","created":"2025-09-30","cited_by_count":17},{"id":"2510.02373","title":"A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory","created":"2025-09-29","cited_by_count":67},{"id":"2509.22830","title":"ChatInject: Abusing Chat Templates for Prompt Injection in LLM Agents","created":"2025-09-26","cited_by_count":31},{"id":"2509.22040","title":"\"Your AI, My Shell\": Demystifying Prompt Injection Attacks on Agentic AI Coding Editors","created":"2025-09-26","cited_by_count":15},{"id":"2509.21011","title":"Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools","created":"2025-09-25","cited_by_count":18},{"id":"2509.14284","title":"The Sum Leaks More Than Its Parts: Compositional Privacy Risks and Mitigations in Multi-Agent Collaboration","created":"2025-09-16","cited_by_count":20},{"id":"2509.06572","title":"Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem","created":"2025-09-08","cited_by_count":16},{"id":"2509.05755","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","created":"2025-09-06","cited_by_count":5},{"id":"2508.18370","title":"Training Language Model Agents to Find Vulnerabilities with CTF-Dojo","created":"2025-08-25","cited_by_count":15},{"id":"2508.16481","title":"Benchmarking the Robustness of Agentic Systems to Adversarially-Induced Harms","created":"2025-08-22","cited_by_count":10},{"id":"2508.15310","title":"IPIGuard: A Novel Tool Dependency Graph-Based Defense Against Indirect Prompt Injection in LLM Agents","created":"2025-08-21","cited_by_count":54},{"id":"2508.13220","title":"MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols","created":"2025-08-17","cited_by_count":51},{"id":"2508.08127","title":"BlindGuard: Safeguarding LLM-based Multi-Agent Systems under Unknown Attacks","created":"2025-08-11","cited_by_count":38},{"id":"2508.03125","title":"Attack the Messages, Not the Agents: A Multi-round Adaptive Stealthy Tampering Framework for LLM-MAS","created":"2025-08-05","cited_by_count":17},{"id":"2508.01332","title":"BlockA2A: Towards Secure and Verifiable Agent-to-Agent Interoperability","created":"2025-08-02","cited_by_count":15},{"id":"2508.01249","title":"AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection","created":"2025-08-02","cited_by_count":46},{"id":"2507.06323","title":"Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms","created":"2025-07-08","cited_by_count":7},{"id":"2507.06134","title":"OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety","created":"2025-07-08","cited_by_count":75},{"id":"2507.05445","title":"A Systematization of Security Vulnerabilities in Computer Use Agents","created":"2025-07-07","cited_by_count":11},{"id":"2507.04724","title":"Who's the Mole? Modeling and Detecting Intention-Hiding Malicious Agents in LLM-Based Multi-Agent Systems","created":"2025-07-07","cited_by_count":13},{"id":"2506.23844","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","created":"2025-06-30","cited_by_count":29},{"id":"2506.23260","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows","created":"2025-06-29","cited_by_count":58},{"id":"2506.19676","title":"A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures","created":"2025-06-24","cited_by_count":57},{"id":"2506.15253","title":"RAS-Eval: A Comprehensive Benchmark for Security Evaluation of LLM Agents in Real-World Environments","created":"2025-06-18","cited_by_count":17},{"id":"2506.14866","title":"OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents","created":"2025-06-17","cited_by_count":111},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66},{"id":"2506.09600","title":"Effective Red-Teaming of Policy-Adherent Agents","created":"2025-06-11","cited_by_count":10},{"id":"2506.17266","title":"Securing Generative AI Agentic Workflows: Risks, Mitigation, and a Proposed Firewall Architecture","created":"2025-06-10","cited_by_count":2},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73}],"next_cursor":"100"}