{"list":"closest","total":65,"rows":[{"id":"2606.30755","title":"Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens","created":"2026-06-29","cited_by_count":5},{"id":"2606.21842","title":"Agent-Assisted Side-Channel Attacks on Non-Prefix KV Cache in RAG","created":"2026-06-20","cited_by_count":2},{"id":"2606.21129","title":"AgenticOS: An Intent-Oriented Secure Operating System Architecture for Autonomous AI Agents","created":"2026-06-19","cited_by_count":2},{"id":"2606.10749","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","created":"2026-06-09","cited_by_count":7},{"id":"2606.01317","title":"SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces","created":"2026-05-31","cited_by_count":6},{"id":"2605.24309","title":"Reframing LLM Agent Security as an Agent-Human Interaction Problem","created":"2026-05-23","cited_by_count":9},{"id":"2605.22321","title":"ASEval: Automated Trajectory-Level Security Testing for Autonomous Agents","created":"2026-05-21","cited_by_count":2},{"id":"2605.17380","title":"ADR: An Agentic Detection System for Enterprise Agentic AI Security","created":"2026-05-17","cited_by_count":2},{"id":"2605.16626","title":"SLEIGHT-Bench: A Benchmark of Evasion Attacks Against Agent Monitors","created":"2026-05-15","cited_by_count":6},{"id":"2605.14932","title":"Toward Securing AI Agents Like Operating Systems","created":"2026-05-14","cited_by_count":5},{"id":"2605.14421","title":"MemLineage: Lineage-Guided Enforcement for LLM Agent Memory","created":"2026-05-14","cited_by_count":16},{"id":"2604.23338","title":"A Systematic Survey of Security Threats and Defenses in LLM-Based AI Agents: A Layered Attack Surface Framework","created":"2026-04-25","cited_by_count":11},{"id":"2604.11790","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","created":"2026-04-13","cited_by_count":27},{"id":"2604.08407","title":"Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain","created":"2026-04-09","cited_by_count":13},{"id":"2604.03081","title":"Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems","created":"2026-04-03","cited_by_count":45},{"id":"2603.22928","title":"SoK: The Attack Surface of Agentic AI - Tools and Autonomy","created":"2026-03-24","cited_by_count":16},{"id":"2603.15714","title":"How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition","created":"2026-03-16","cited_by_count":17},{"id":"2603.15125","title":"From Storage to Steering: Memory Control Flow Attacks on LLM Agents","created":"2026-03-16","cited_by_count":19},{"id":"2603.11088","title":"The Attack and Defense Landscape of Agentic AI: A Comprehensive Survey","created":"2026-03-11","cited_by_count":28},{"id":"2602.20708","title":"ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction","created":"2026-02-24","cited_by_count":10},{"id":"2602.15654","title":"Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections","created":"2026-02-17","cited_by_count":48},{"id":"2601.14660","title":"NeuroFilter: Activation-Based Guardrails for Privacy-Conscious LLM Agents","created":"2026-01-21","cited_by_count":1},{"id":"2601.11893","title":"Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework","created":"2026-01-17","cited_by_count":54},{"id":"2601.10955","title":"Beyond Max Tokens: Stealthy Resource Amplification via Tool Calling Chains in LLM Agents","created":"2026-01-16","cited_by_count":14},{"id":"2512.16962","title":"MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval","created":"2025-12-18","cited_by_count":72},{"id":"2512.06914","title":"SoK: Trust-Authorization Mismatch in LLM Agent Interactions","created":"2025-12-07","cited_by_count":11},{"id":"2510.11108","title":"A Vision for Access Control in LLM-based Agent Systems","created":"2025-10-13","cited_by_count":14},{"id":"2510.09462","title":"Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols","created":"2025-10-10","cited_by_count":30},{"id":"2511.02841","title":"AI Agents with Decentralized Identifiers and Verifiable Credentials","created":"2025-10-01","cited_by_count":18},{"id":"2510.02373","title":"A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory","created":"2025-09-29","cited_by_count":67},{"id":"2508.14925","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","created":"2025-08-19","cited_by_count":66},{"id":"2508.02736","title":"AgentSight: System-Level Observability for AI Agents Using eBPF","created":"2025-08-02","cited_by_count":21},{"id":"2507.14799","title":"Manipulating LLM Web Agents with Indirect Prompt Injection Attack via HTML Accessibility Tree","created":"2025-07-20","cited_by_count":14},{"id":"2507.06850","title":"The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise","created":"2025-07-09","cited_by_count":4},{"id":"2507.06134","title":"OpenAgentSafety: A Comprehensive Framework for Evaluating Real-World AI Agent Safety","created":"2025-07-08","cited_by_count":75},{"id":"2506.15740","title":"SHADE-Arena: Evaluating Sabotage and Monitoring in LLM Agents","created":"2025-06-17","cited_by_count":71},{"id":"2506.14866","title":"OS-Harm: A Benchmark for Measuring Safety of Computer Use Agents","created":"2025-06-17","cited_by_count":111},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73},{"id":"2506.02456","title":"VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agents","created":"2025-06-03","cited_by_count":45},{"id":"2506.02040","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","created":"2025-05-31","cited_by_count":19},{"id":"2505.21936","title":"RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments","created":"2025-05-28","cited_by_count":46},{"id":"2505.19301","title":"A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control","created":"2025-05-25","cited_by_count":28},{"id":"2505.11717","title":"WebInject: Prompt Injection Attack to Web Agents","created":"2025-05-16","cited_by_count":51},{"id":"2505.03574","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","created":"2025-05-06","cited_by_count":127},{"id":"2504.19793","title":"Prompt Injection Attack to Tool Selection in LLM Agents","created":"2025-04-28","cited_by_count":158},{"id":"2504.21034","title":"SAGA: A Security Architecture for Governing AI Agentic Systems","created":"2025-04-27","cited_by_count":45},{"id":"2504.18575","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","created":"2025-04-22","cited_by_count":157},{"id":"2504.11703","title":"Progent: Securing AI Agents with Privilege Control","created":"2025-04-16","cited_by_count":141},{"id":"2503.18813","title":"Defeating Prompt Injections by Design","created":"2025-03-24","cited_by_count":297},{"id":"2503.18666","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","created":"2025-03-24","cited_by_count":223},{"id":"2503.15547","title":"Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents","created":"2025-03-17","cited_by_count":87},{"id":"2503.09780","title":"AgentDAM: Privacy Leakage Evaluation for Autonomous Web Agents","created":"2025-03-12","cited_by_count":82},{"id":"2503.04392","title":"AgentSafe: Safeguarding Large Language Model-based Multi-agent Systems via Hierarchical Data Management","created":"2025-03-06","cited_by_count":38},{"id":"2503.03704","title":"Memory Injection Attacks on LLM Agents via Query-Only Interaction","created":"2025-03-05","cited_by_count":144},{"id":"2502.14847","title":"Red-Teaming LLM Multi-Agent Systems via Communication Attacks","created":"2025-02-20","cited_by_count":122},{"id":"2412.14470","title":"Agent-SafetyBench: Evaluating the Safety of LLM Agents","created":"2024-12-19","cited_by_count":306},{"id":"2410.09024","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","created":"2024-10-11","cited_by_count":437},{"id":"2410.07283","title":"Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems","created":"2024-10-09","cited_by_count":133},{"id":"2410.02644","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","created":"2024-10-03","cited_by_count":369},{"id":"2409.11295","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","created":"2024-09-17","cited_by_count":150},{"id":"2407.12784","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","created":"2024-07-17","cited_by_count":429},{"id":"2407.07791","title":"Flooding Spread of Manipulated Knowledge in LLM-Based Multi-Agent Communities","created":"2024-07-10","cited_by_count":86},{"id":"2403.04960","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems","created":"2024-03-08","cited_by_count":130},{"id":"2401.05566","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training","created":"2024-01-10","cited_by_count":529},{"id":"2309.15817","title":"Identifying the Risks of LM Agents with an LM-Emulated Sandbox","created":"2023-09-25","cited_by_count":548}],"next_cursor":null}