{"list":"other","total":53,"rows":[{"id":"2304.03442","title":"Generative Agents: Interactive Simulacra of Human Behavior","created":"2023-04-07","cited_by_count":3568},{"id":"2302.12173","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","created":"2023-02-23","cited_by_count":1443},{"id":"2310.08560","title":"MemGPT: Towards LLMs as Operating Systems","created":"2023-10-12","cited_by_count":1389},{"id":"2211.09527","title":"Ignore Previous Prompt: Attack Techniques For Language Models","created":"2022-11-17","cited_by_count":832},{"id":"2402.17753","title":"Evaluating Very Long-Term Conversational Memory of LLM Agents","created":"2024-02-27","cited_by_count":830},{"id":"2404.13501","title":"A Survey on the Memory Mechanism of Large Language Model based Agents","created":"2024-04-21","cited_by_count":634},{"id":"2403.02691","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","created":"2024-03-05","cited_by_count":538},{"id":"2404.13208","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","created":"2024-04-19","cited_by_count":493},{"id":"2407.12784","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","created":"2024-07-17","cited_by_count":429},{"id":"2402.06363","title":"StruQ: Defending Against Prompt Injection with Structured Queries","created":"2024-02-09","cited_by_count":375},{"id":"2410.02644","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","created":"2024-10-03","cited_by_count":369},{"id":"2310.12815","title":"Formalizing and Benchmarking Prompt Injection Attacks and Defenses","created":"2023-10-19","cited_by_count":364},{"id":"2503.18813","title":"Defeating Prompt Injections by Design","created":"2025-03-24","cited_by_count":297},{"id":"2403.14720","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","created":"2024-03-20","cited_by_count":267},{"id":"2410.05451","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","created":"2024-10-07","cited_by_count":210},{"id":"2503.03704","title":"Memory Injection Attacks on LLM Agents via Query-Only Interaction","created":"2025-03-05","cited_by_count":144},{"id":"2504.11703","title":"Progent: Securing AI Agents with Privilege Control","created":"2025-04-16","cited_by_count":141},{"id":"2403.04960","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems","created":"2024-03-08","cited_by_count":130},{"id":"2602.16313","title":"MemoryArena: Benchmarking Agent Memory in Interdependent Multi-Session Agentic Tasks","created":"2026-02-18","cited_by_count":84},{"id":"2506.08837","title":"Design Patterns for Securing LLM Agents against Prompt Injections","created":"2025-06-10","cited_by_count":73},{"id":"2512.16962","title":"MemoryGraft: Persistent Compromise of LLM Agents via Poisoned Experience Retrieval","created":"2025-12-18","cited_by_count":72},{"id":"2510.02373","title":"A-MemGuard: A Proactive Defense Framework for LLM-Based Agent Memory","created":"2025-09-29","cited_by_count":67},{"id":"2506.12104","title":"DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents","created":"2025-06-13","cited_by_count":66},{"id":"2501.17070","title":"Contextual Agent Security: A Policy for Every Purpose","created":"2025-01-28","cited_by_count":59},{"id":"2602.03117","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","created":"2026-02-03","cited_by_count":59},{"id":"2504.20984","title":"ACE: A Security Architecture for LLM-Integrated App Systems","created":"2025-04-29","cited_by_count":55},{"id":"2602.22769","title":"AMA-Bench: Evaluating Long-Horizon Memory for Agentic Applications","created":"2026-02-26","cited_by_count":53},{"id":"2602.15654","title":"Zombie Agents: Persistent Control of Self-Evolving LLM Agents via Self-Reinforcing Injections","created":"2026-02-17","cited_by_count":48},{"id":"2502.15851","title":"Control Illusion: The Failure of Instruction Hierarchies in Large Language Models","created":"2025-02-21","cited_by_count":33},{"id":"2601.17548","title":"Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems","created":"2026-01-24","cited_by_count":31},{"id":"2602.10453","title":"The Landscape of Prompt Injection Threats in LLM Agents: From Taxonomy to Analysis","created":"2026-02-11","cited_by_count":30},{"id":"2602.08412","title":"From Assistant to Double Agent: Formalizing and Benchmarking Attacks on OpenClaw for Personalized Local AI Agent","created":"2026-02-09","cited_by_count":29},{"id":"2605.15338","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","created":"2026-05-14","cited_by_count":27},{"id":"2604.02623","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","created":"2026-04-03","cited_by_count":24},{"id":"2502.14642","title":"How Far are LLMs from Being Our Digital Twins? A Benchmark for Persona-Based Behavior Chain Simulation","created":"2025-02-20","cited_by_count":22},{"id":"2511.17959","title":"Towards Automating Data Access Permissions in AI Agents","created":"2025-11-22","cited_by_count":21},{"id":"2603.15125","title":"From Storage to Steering: Memory Control Flow Attacks on LLM Agents","created":"2026-03-16","cited_by_count":19},{"id":"2510.07925","title":"Enabling Personalized Long-term Interactions in LLM-based Agents through Persistent Memory and User Profiles","created":"2025-10-09","cited_by_count":17},{"id":"2603.12277","title":"Prompt Injection as Role Confusion","created":"2026-02-22","cited_by_count":17},{"id":"2510.25536","title":"TwinVoice: A Multi-dimensional Benchmark Towards Digital Twins via LLM Persona Simulation","created":"2025-10-29","cited_by_count":15},{"id":"2403.16809","title":"An LLM-Based Digital Twin for Optimizing Human-in-the Loop Systems","created":"2024-03-25","cited_by_count":13},{"id":"2512.01295","title":"Systems Security Foundations for Agentic Computing","created":"2025-12-01","cited_by_count":13},{"id":"2605.28914","title":"AIRGuard: Guarding Agent Actions with Runtime Authority Control","created":"2026-05-27","cited_by_count":13},{"id":"2506.17318","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","created":"2025-06-18","cited_by_count":12},{"id":"2604.04978","title":"Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode","created":"2026-04-04","cited_by_count":10},{"id":"2505.18907","title":"Stronger Enforcement of Instruction Hierarchy via Augmented Intermediate Representations","created":"2025-05-25","cited_by_count":9},{"id":"2606.22504","title":"Lingering Authority: Revocable Resource-and-Effect Capabilities for Coding Agents","created":"2026-06-21","cited_by_count":8},{"id":"2605.14859","title":"Do Coding Agents Understand Least-Privilege Authorization?","created":"2026-05-14","cited_by_count":6},{"id":"2606.01317","title":"SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces","created":"2026-05-31","cited_by_count":6},{"id":"2605.11360","title":"Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization","created":"2026-05-12","cited_by_count":5},{"id":"2604.10134","title":"PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency Verification","created":"2026-04-11","cited_by_count":4},{"id":"2605.14290","title":"Web Agents Should Adopt the Plan-Then-Execute Paradigm","created":"2026-05-14","cited_by_count":4},{"id":"2506.23826","title":"Towards the \"Digital Me\": A vision of authentic Conversational Agents powered by personal Human Digital Twins","created":"2025-06-30","cited_by_count":1}],"next_cursor":null}