{"as_of":"2026-08-09T22:06:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:3f539eb0f1af412c11efd131e9ff0ae62792c003328c70d940322239f48fe834","coverage":[{"denominator":27,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":27,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T04:37:28.867597Z","state":"measured"},{"denominator":51,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":51,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":24,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":24,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:34:34.815687Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-03T15:48:35.883148Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2503.21460","last_updated":"2025-03-27T12:50:17Z","snapshot_observed_at":"2026-07-06T20:59:35.694800Z","submitted_at":"2025-03-27T12:50:17Z","title":"Large Language Model Agent: A Survey on Methodology, Applications and Challenges","version":1},"reference_index":175,"source":"pdf_text","source_observed_at":"2026-05-22T21:51:34.309870Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2503.21460"},"observation_digest":"sha256:3286ae3ebeb59453ffff3bca1b49c3534d528a7c4c8206c51bf7c5c85f2c5370","observation_id":"253b84ab-1d66-4a3a-9997-cb0a75bd596f","resolution":{"observed_at":"2026-05-22T21:52:10.416569Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-07T14:34:34.815687Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18471","last_updated":"2025-05-24T02:26:49Z","snapshot_observed_at":"2026-08-07T21:54:09.971572Z","submitted_at":"2025-05-24T02:26:49Z","title":"Invisible Tokens, Visible Bills: The Urgent Need to Audit Hidden Operations in Opaque LLM Services","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-07T14:34:34.815687Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2505.18471"},"observation_digest":"sha256:605302a925a41ef9d9305d6a229a79c525b05b5633de11956c751635012c4e94","observation_id":"be51e42f-0e70-476d-9a6d-26463ffa2c86","resolution":{"observed_at":"2026-08-07T14:34:34.815687Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-07T11:42:33.151323Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.01616","last_updated":"2025-06-02T12:56:27Z","snapshot_observed_at":"2026-08-08T16:00:43.942253Z","submitted_at":"2025-06-02T12:56:27Z","title":"MLA-Trust: Benchmarking Trustworthiness of Multimodal LLM Agents in GUI Environments","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-07T11:42:33.151323Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2506.01616"},"observation_digest":"sha256:e74f23e37c9be6ac118426a7945713a057751b86fe74f9258d32581f90164312","observation_id":"4de0b938-f923-4b0a-8e57-4b32cf438f03","resolution":{"observed_at":"2026-08-07T11:42:33.151323Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-07T12:11:20.746079Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.05376","last_updated":"2025-06-09T05:48:22Z","snapshot_observed_at":"2026-08-07T12:39:09.825243Z","submitted_at":"2025-05-30T22:58:54Z","title":"A Red Teaming Roadmap Towards System-Level Safety","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-07T12:11:20.746079Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2506.05376"},"observation_digest":"sha256:ef6b3fd3b6c71ff229aa8555cce52b0aaceefd2b35e5f859a1e1c7556c2d8f20","observation_id":"5f9b130e-a6b8-4e84-a6b8-d2fa89e8e789","resolution":{"observed_at":"2026-08-07T12:11:20.746079Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-07T00:52:41.842278Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.12469","last_updated":"2025-07-28T16:25:18Z","snapshot_observed_at":"2026-08-08T00:15:13.784774Z","submitted_at":"2025-06-14T12:14:36Z","title":"Levels of Autonomy for AI Agents","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-07T00:52:41.842278Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2506.12469"},"observation_digest":"sha256:96ffa6784f63a9e50b3d621538ef2cbfbcaf7dc25d2739214c67a2869e361b3a","observation_id":"d2036883-0a11-4792-ba90-bc10698481e9","resolution":{"observed_at":"2026-08-07T00:52:41.842278Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-07T00:32:36.575227Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks.arXiv preprint arXiv:2502.08586, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.13666","last_updated":"2025-06-16T16:24:31Z","snapshot_observed_at":"2026-08-07T00:25:36.770856Z","submitted_at":"2025-06-16T16:24:31Z","title":"We Should Identify and Mitigate Third-Party Safety Risks in MCP-Powered Agent Systems","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-07T00:32:36.575227Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2506.13666"},"observation_digest":"sha256:73c34799c36b98533bd6d51d2887b7126a09332f90781c1ab74efb1c4ec998d9","observation_id":"4a01d0f6-66ab-4bb4-bdc9-77680eb4f755","resolution":{"observed_at":"2026-08-07T00:32:36.575227Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-06T21:34:41.058806Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.23844","last_updated":"2025-06-30T13:34:34Z","snapshot_observed_at":"2026-08-08T15:24:13.507722Z","submitted_at":"2025-06-30T13:34:34Z","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-06T21:34:41.058806Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2506.23844"},"observation_digest":"sha256:86e202e3e56405ffbf58270427b85fe3cd11432d82e1b6d37e303f8ac15103c3","observation_id":"26006061-4145-4732-9dd9-8613a9c4af73","resolution":{"observed_at":"2026-08-06T21:34:41.058806Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-05T12:28:04.262824Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.01619","last_updated":"2025-09-01T16:56:16Z","snapshot_observed_at":"2026-08-09T15:31:01.550843Z","submitted_at":"2025-09-01T16:56:16Z","title":"Throttling Web Agents Using Reasoning Gates","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-05T12:28:04.262824Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2509.01619"},"observation_digest":"sha256:ffc5731f57c841927a4ca758d25979dc81f663952f20d101347acd4d45c6e8a4","observation_id":"f34403d8-64b3-4b77-bb38-3907e4f94c74","resolution":{"observed_at":"2026-08-05T12:28:04.262824Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-04T08:06:11.330207Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks.arXiv preprint arXiv:2502.08586, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.22963","last_updated":"2026-06-19T20:25:06Z","snapshot_observed_at":"2026-08-04T08:06:05.944327Z","submitted_at":"2025-10-27T03:37:41Z","title":"When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents","version":4},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-04T08:06:11.330207Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2510.22963"},"observation_digest":"sha256:0681b6f29ee324263550f29e04181f694afa9589281f38f4fb5e8ac14b67efa9","observation_id":"f01aec10-85e1-4790-83b8-2ae442ff8fba","resolution":{"observed_at":"2026-08-04T08:06:11.330207Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2510.23883","last_updated":"2026-04-03T16:27:34Z","snapshot_observed_at":"2026-08-02T13:42:34.526072Z","submitted_at":"2025-10-27T21:48:11Z","title":"Agentic AI Security: Threats, Defenses, Evaluation, and Open Challenges","version":3},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-18T03:42:10.703369Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2510.23883"},"observation_digest":"sha256:ec82b4a01990b520a6af6b0fd3d3966d821265996d0613f336c80bcca4b735b4","observation_id":"0f547531-39aa-44f7-bad3-35e3f742389d","resolution":{"observed_at":"2026-05-18T03:42:22.464757Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-04T07:06:38.041872Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks.arXiv preprint arXiv:2502.08586, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.27140","last_updated":"2026-07-07T02:18:26Z","snapshot_observed_at":"2026-08-07T23:25:01.868478Z","submitted_at":"2025-10-31T03:35:59Z","title":"Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels","version":3},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-04T07:06:38.041872Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2510.27140"},"observation_digest":"sha256:aba8589669404d082b92cc3a05cef44d47b6c41dcf026a538f0cb6fbda3783a4","observation_id":"e36b5551-e79c-4033-9e44-68fbdd28bc08","resolution":{"observed_at":"2026-08-04T07:06:38.041872Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-03T10:32:31.300703Z","title":"Raghuram, Tom Goldstein, and Micah Goldblum","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2601.09923","last_updated":"2026-06-04T15:38:02Z","snapshot_observed_at":"2026-08-06T13:01:48.994450Z","submitted_at":"2026-01-14T23:06:35Z","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","version":3},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-03T10:32:31.300703Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2601.09923"},"observation_digest":"sha256:7cd569ed0e5cee50c16ad85c1e0692a81529c5e0f1b243a6e8b1dd1960736927","observation_id":"eae352de-994f-46ac-b9b6-3eb072c67fb0","resolution":{"observed_at":"2026-08-03T10:32:31.300703Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-03T10:45:18.132433Z","title":"arXiv preprint arXiv:2502.08586 (2025)","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2601.10758","last_updated":"2026-07-07T04:20:13Z","snapshot_observed_at":"2026-08-06T11:00:52.802245Z","submitted_at":"2026-01-14T03:29:13Z","title":"Agents at Risk: How Users Unwittingly Undermine LLM Safety","version":3},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-03T10:45:18.132433Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2601.10758"},"observation_digest":"sha256:de9254ce0f0672c57a460064e6f30449b4711a311d7fc31b35fa3aad460f644a","observation_id":"98b32e61-f9b1-48ef-955d-d23a9baee00c","resolution":{"observed_at":"2026-08-03T10:45:18.132433Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2601.20375","last_updated":"2026-05-07T02:38:44Z","snapshot_observed_at":"2026-07-30T12:44:01.703494Z","submitted_at":"2026-01-28T08:37:34Z","title":"LLM-AutoDP: Automatic Data Processing via LLM Agents for Model Fine-tuning","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-16T10:54:22.183741Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2601.20375"},"observation_digest":"sha256:08350dad967874006e21f57f4d68c7552af279768570c91649153460ee891870","observation_id":"74e5a25f-89fd-455c-b8cd-06a8e35d706f","resolution":{"observed_at":"2026-05-16T10:57:46.854305Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2604.24348","last_updated":"2026-04-27T11:44:26Z","snapshot_observed_at":"2026-07-31T20:25:37.534799Z","submitted_at":"2026-04-27T11:44:26Z","title":"OS-SPEAR: A Toolkit for the Safety, Performance,Efficiency, and Robustness Analysis of OS Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-08T03:51:54.310805Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2604.24348"},"observation_digest":"sha256:9735db505446dbe15c7edb0d49f0af2cea8874df9c6dfb227578c0e77aa729ed","observation_id":"6353e071-8de9-4ae8-bddb-063f71c72e15","resolution":{"observed_at":"2026-05-11T21:56:11.842563Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2605.23989","last_updated":"2026-05-17T10:26:37Z","snapshot_observed_at":"2026-07-06T23:34:08.786038Z","submitted_at":"2026-05-17T10:26:37Z","title":"Towards trustworthy agentic AI: a comprehensive survey of safety, robustness, privacy, and system security","version":1},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-06-30T19:18:40.244556Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2605.23989"},"observation_digest":"sha256:e9170f68c2f7579c78e3d986584851dc2591d8dc9e66b2e1a21ebaaab70a197a","observation_id":"b563fa63-c81c-4092-865f-be3c916bf6c8","resolution":{"observed_at":"2026-06-30T19:45:01.661562Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2605.24069","last_updated":"2026-05-22T08:34:48Z","snapshot_observed_at":"2026-08-02T10:17:43.608511Z","submitted_at":"2026-05-22T08:34:48Z","title":"When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-06-30T16:22:23.857438Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2605.24069"},"observation_digest":"sha256:06f08dbaee6870e17093b1261b092653eba8ab964425d7b296714e32f0ad2255","observation_id":"28206dc5-9048-4a28-8234-857c0250edde","resolution":{"observed_at":"2026-06-30T16:24:55.140269Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2606.13385","last_updated":"2026-06-11T14:12:43Z","snapshot_observed_at":"2026-08-01T15:55:04.725190Z","submitted_at":"2026-06-11T14:12:43Z","title":"Who Pays the Price? Stakeholder-Centric Prompt Injection Benchmarking for Real-world Web Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-06-27T06:20:04.789341Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2606.13385"},"observation_digest":"sha256:ec4e75382879881d6e7f1735522c9a07aae1fb70013462ee6fce71c572c117c0","observation_id":"feca9d20-b067-4135-afa2-fb5e6e604f1d","resolution":{"observed_at":"2026-07-03T15:48:35.884551Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":"2502.08586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-03T15:48:35.883148Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":"5cfa141e-b5d8-4c19-bc39-255d473ea954","year":2025},"citing_paper":{"arxiv_id":"2606.28666","last_updated":"2026-06-27T01:00:39Z","snapshot_observed_at":"2026-08-03T00:28:12.886471Z","submitted_at":"2026-06-27T01:00:39Z","title":"Why Trust Your Agent? Empirical Security Gains from TRiSM-Guided Agentic Workflows in Healthcare","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-06-30T10:17:02.425849Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2606.28666"},"observation_digest":"sha256:2120dcfc630b536560efeb60b923c622641eb32ccf8cbb5d1ff73f2268e22b89","observation_id":"88883738-429d-418b-9449-9a44d034f077","resolution":{"observed_at":"2026-06-30T12:44:39.617898Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-01T06:04:46.602164Z","title":"arXiv preprint arXiv:2502.08586 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.22024","last_updated":"2026-07-24T06:43:09Z","snapshot_observed_at":"2026-08-08T12:54:01.031419Z","submitted_at":"2026-07-24T06:43:09Z","title":"Agent Security Needs Redefinition through a Holistic Framework","version":1},"reference_index":268,"source":"arxiv_source","source_observed_at":"2026-08-01T06:04:46.602164Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2607.22024"},"observation_digest":"sha256:f39efeb3b52fd2246a35245999c48241e85cb1ed8b3d10b74ef21bb223bce584","observation_id":"82e558c9-e23d-48c4-ae91-8a16c5ac1b37","resolution":{"observed_at":"2026-08-01T06:04:46.602164Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-07-31T23:07:37.594638Z","title":"arXiv preprint arXiv:2502.08586 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.27917","last_updated":"2026-07-30T09:30:03Z","snapshot_observed_at":"2026-08-07T15:15:58.184585Z","submitted_at":"2026-07-30T09:30:03Z","title":"One Anchor for All: Unified Multilingual and Multimodal Safety Alignment for LVLMs","version":1},"reference_index":17,"source":"arxiv_source","source_observed_at":"2026-07-31T23:07:37.594638Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2607.27917"},"observation_digest":"sha256:0161c67803cdbb349636e0ed67f27417dc059980a15ab5169711f7d526848f9f","observation_id":"6c261576-7405-40f9-bbb1-2588d573b740","resolution":{"observed_at":"2026-07-31T23:07:37.594638Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-04T16:36:53.593030Z","title":"arXiv:2502.08586","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.02018","last_updated":"2026-08-06T02:33:08Z","snapshot_observed_at":"2026-08-09T21:09:50.702912Z","submitted_at":"2026-08-03T10:16:53Z","title":"Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-04T16:36:53.593030Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2608.02018"},"observation_digest":"sha256:6d3b98719e537896dd544c8bc3e8155a28607badb3e74e2b47f5e194d605ba23","observation_id":"b5d24510-d72f-4e28-a4a8-9a1a0f87e169","resolution":{"observed_at":"2026-08-04T16:36:53.593030Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-07T00:59:39.874950Z","title":"arXiv:2502.08586","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.02018","last_updated":"2026-08-06T02:33:08Z","snapshot_observed_at":"2026-08-09T21:09:50.702912Z","submitted_at":"2026-08-03T10:16:53Z","title":"Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-07T00:59:39.874950Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2608.02018"},"observation_digest":"sha256:74fc3994e57b8bb7b1f86bcdda7184811d7eae7c9dd4c65b55429ffe38b03db6","observation_id":"f9c7f59c-9fc1-4e6e-b474-ad1fb264f142","resolution":{"observed_at":"2026-08-07T00:59:39.874950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08586","snapshot_observed_at":"2026-08-05T00:54:57.371881Z","title":"Commercial llm agents are already vulnerable to simple yet dangerous attacks","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.02657","last_updated":"2026-08-01T12:00:33Z","snapshot_observed_at":"2026-08-08T03:54:53.309499Z","submitted_at":"2026-08-01T12:00:33Z","title":"Your Agentic LLMs Secretly Encode Latent Signals of Indirect Prompt-Injection Exposure","version":1},"reference_index":48,"source":"arxiv_source","source_observed_at":"2026-08-05T00:54:57.371881Z"},"links":{"cited_paper":"/paper/2502.08586","citing_paper":"/paper/2608.02657"},"observation_digest":"sha256:c84fbba609ae29d1720eddb10d7116d9ae672c2eacee5603024ed3f85d7e9b32","observation_id":"39a8ec91-4374-48f9-80f7-73e24dbbf8c2","resolution":{"observed_at":"2026-08-05T00:54:57.371881Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2502.08586/citation-record","integrity":"/paper/2502.08586/integrity","json":"/paper/2502.08586/citation-record.json","paper":"/paper/2502.08586"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2404.02151","last_updated":"2025-04-17T18:55:45Z","snapshot_observed_at":"2026-08-08T01:18:53.200448Z","submitted_at":"2024-04-02T17:58:27Z","title":"Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.02151","snapshot_observed_at":"2026-08-08T04:37:28.268054Z","title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.268054Z"},"links":{"cited_paper":"/paper/2404.02151","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:5deeb7dd0d39c0aedb4c5d05e099b5fb2820499d19a057c156e7b13bd31d4dac","observation_id":"c7440ac4-45e3-4bb7-a91f-820a2aed8b14","resolution":{"observed_at":"2026-08-08T04:37:28.268054Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T04:37:28.368156Z","title":"Tianyu Cui, Yanling Wang, Chuanpu Fu, Yong Xiao, Sijia Li, Xinhao Deng, Yunpeng Liu, Qinglin Zhang, Ziyi Qiu, Peiyang Li, et al","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.368156Z"},"links":{"citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:2c44b1d9481db05b4cb688ad3795dab772a5f285485f825c80376941f73df2e4","observation_id":"e852125b-d6ff-4489-a04b-a77da23ae6c3","resolution":{"observed_at":"2026-08-08T04:37:28.368156Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.00888","last_updated":"2024-11-14T22:20:49Z","snapshot_observed_at":"2026-07-06T17:23:55.166594Z","submitted_at":"2024-01-30T04:00:54Z","title":"Security and Privacy Challenges of Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.00888","snapshot_observed_at":"2026-08-08T04:37:28.371361Z","title":"Edoardo Debenedetti, Jie Zhang, Mislav Balunovi´c, Luca Beurer-Kellner, Marc Fischer, and Florian Tram`er","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.371361Z"},"links":{"cited_paper":"/paper/2402.00888","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:912be72205057210297b63012b6040185ee01d740c67e16afd0dafeb9e0df30f","observation_id":"9480e77a-efff-4347-abae-590188524f7c","resolution":{"observed_at":"2026-08-08T04:37:28.371361Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-08T04:37:28.375477Z","title":"org/abs/2406.13352","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.375477Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:337b43638b32729c2b72776970881dcc35b624cfebbe2869ad719fdc05c7ece4","observation_id":"bbfe858a-5d44-41c9-b60b-bc90690c4f1b","resolution":{"observed_at":"2026-08-08T04:37:28.375477Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2205.12548","last_updated":"2022-10-22T15:21:46Z","snapshot_observed_at":"2026-08-04T09:47:52.854204Z","submitted_at":"2022-05-25T07:50:31Z","title":"RLPrompt: Optimizing Discrete Text Prompts with Reinforcement Learning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2205.12548","snapshot_observed_at":"2026-08-08T04:37:28.378324Z","title":"Rlprompt: Optimizing discrete text prompts with reinforcement learning","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.378324Z"},"links":{"cited_paper":"/paper/2205.12548","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:7a09e6b4997c5f2de3957a4057982da95d4a2a71230f5cab5a86d9c38ddcad91","observation_id":"bc7e9b01-f2a8-4054-9ba0-f5b095ca68cf","resolution":{"observed_at":"2026-08-08T04:37:28.378324Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T04:37:28.385457Z","title":"Feng He, Tianqing Zhu, Dayong Ye, Bo Liu, Wanlei Zhou, and Philip S Yu","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.385457Z"},"links":{"citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:af646ac5c1cb7a998129fe4af0dd950cfc9fa5a1bbb3e9dbba9b3d411c15a0c9","observation_id":"684061cc-aec2-4e2a-b6d7-3144133a965a","resolution":{"observed_at":"2026-08-08T04:37:28.385457Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-07-06T17:00:00.321552Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-08T04:37:28.388533Z","title":"Llama guard: Llm- based input-output safeguard for human-ai conversations","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.388533Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:0ed00f9f28ff54bcee0c2d1a3c3c3c3207b0756452aa2149e7e8bab3306a1eb5","observation_id":"98431140-7e89-4d59-ab0a-9a96b91afff6","resolution":{"observed_at":"2026-08-08T04:37:28.388533Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.13860","last_updated":"2024-03-10T13:58:08Z","snapshot_observed_at":"2026-07-06T15:31:18.144952Z","submitted_at":"2023-05-23T09:33:38Z","title":"Jailbreaking ChatGPT via Prompt Engineering: An Empirical Study","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.13860","snapshot_observed_at":"2026-08-08T04:37:28.391836Z","title":"Jailbreaking chatgpt via prompt engineering: An empirical study","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.391836Z"},"links":{"cited_paper":"/paper/2305.13860","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:147020d13714441f6a814bb34c3c7bb267695e49f6d63d1fd97dbc6935a301d3","observation_id":"7a1455d9-0caa-4766-8dd8-7b9a09263566","resolution":{"observed_at":"2026-08-08T04:37:28.391836Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2202.03286","last_updated":"2022-02-07T15:22:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-02-07T15:22:17Z","title":"Red Teaming Language Models with Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2202.03286","snapshot_observed_at":"2026-08-08T04:37:28.406491Z","title":"Red teaming language models with language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.406491Z"},"links":{"cited_paper":"/paper/2202.03286","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:20175773860ea5f37092b521ea9fd002bd88ff90cf6456bab2f643b75f7c79f8","observation_id":"a1327166-0d8e-46ff-ab58-1c332a735972","resolution":{"observed_at":"2026-08-08T04:37:28.406491Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.07199","last_updated":"2024-08-13T20:52:13Z","snapshot_observed_at":"2026-08-01T22:07:45.419539Z","submitted_at":"2024-08-13T20:52:13Z","title":"Agent Q: Advanced Reasoning and Learning for Autonomous AI Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.07199","snapshot_observed_at":"2026-08-08T04:37:28.463591Z","title":"Agent q: Advanced reasoning and learning for au- tonomous ai agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.463591Z"},"links":{"cited_paper":"/paper/2408.07199","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:20b966b78849bcd5a0cb9322be81fa908e9b85b94d6c14f26773e862b69a66b1","observation_id":"7334860c-ab06-4cda-ae72-f58a63806e3b","resolution":{"observed_at":"2026-08-08T04:37:28.463591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10844","last_updated":"2023-10-16T21:37:24Z","snapshot_observed_at":"2026-08-07T21:21:24.962049Z","submitted_at":"2023-10-16T21:37:24Z","title":"Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10844","snapshot_observed_at":"2026-08-08T04:37:28.522854Z","title":"do anything now","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.522854Z"},"links":{"cited_paper":"/paper/2310.10844","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:06c49a1eab867f14876f23188bb3f6a7840b054c6de06291ec41b393d9f38339","observation_id":"8cde1543-df87-4c5d-817a-1cfe0574c2f7","resolution":{"observed_at":"2026-08-08T04:37:28.522854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.13740","last_updated":"2024-09-26T15:27:08Z","snapshot_observed_at":"2026-08-08T08:44:06.036202Z","submitted_at":"2024-09-10T16:37:58Z","title":"Language agents achieve superhuman synthesis of scientific knowledge","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.13740","snapshot_observed_at":"2026-08-08T04:37:28.580674Z","title":"Skarlinski, Sam Cox, Jon M","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.580674Z"},"links":{"cited_paper":"/paper/2409.13740","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:01c699c856bab77e9695d1bdc1667bb9dd806da458ec569b6842dcb96fbb106c","observation_id":"0d2695b8-6189-4fba-a967-dad5b534717a","resolution":{"observed_at":"2026-08-08T04:37:28.580674Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.11855","last_updated":"2024-02-02T08:28:01Z","snapshot_observed_at":"2026-08-07T01:32:12.754339Z","submitted_at":"2023-11-20T15:50:09Z","title":"Evil Geniuses: Delving into the Safety of LLM-based Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.11855","snapshot_observed_at":"2026-08-08T04:37:28.636620Z","title":"Evil geniuses: Delving into the safety of llm- based agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.636620Z"},"links":{"cited_paper":"/paper/2311.11855","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:4ba24bc3917e60f8f91dfb1606ea6c9f0de41e59daecd2d4299a871b651ac7af","observation_id":"eda3da75-5be5-4065-9e7c-fa974e876269","resolution":{"observed_at":"2026-08-08T04:37:28.636620Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T04:37:29.226539Z","title":"Data poisoning attacks against federated learn- ing systems","venue":null,"work_id":"350b1346-f029-477d-9823-6c6940be3931","year":2020},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.666591Z"},"links":{"citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:4e873208e1f735304d406588fe6b5ab21592de1c2bf9fd4ab3ee433361ebfe1d","observation_id":"0d3f6b33-8f2f-4906-9e14-19c0ec4db78b","resolution":{"observed_at":"2026-08-08T04:37:29.230122Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T04:37:29.215702Z","title":"Jiaqi Xue, Mengxin Zheng, Ting Hua, Yilin Shen, Yepeng Liu, Ladislau B¨ol¨oni, and Qian Lou","venue":null,"work_id":"355bed09-cd0e-43ae-8952-92fb3af3c8b7","year":2023},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.734617Z"},"links":{"citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:aa92f1236bf9bc3f452987e46d5851602033e2c8bf3c2d3200a55dec083d0743","observation_id":"662ad39e-bce8-4c2a-9cfd-0c3fe35e30f1","resolution":{"observed_at":"2026-08-08T04:37:29.220363Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.11208","last_updated":"2024-10-29T15:32:04Z","snapshot_observed_at":"2026-08-09T15:25:31.415915Z","submitted_at":"2024-02-17T06:48:45Z","title":"Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.11208","snapshot_observed_at":"2026-08-08T04:37:28.771627Z","title":"Watch out for your agents! investigat- ing backdoor threats to llm-based agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.771627Z"},"links":{"cited_paper":"/paper/2402.11208","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:c841b4ebc808948288320765dbc550d28895b35a5cdb7652ad0ec7dd94da5d22","observation_id":"1f68dc76-45a4-4ecf-8a2c-213780f94de8","resolution":{"observed_at":"2026-08-08T04:37:28.771627Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16893","last_updated":"2024-02-23T18:35:15Z","snapshot_observed_at":"2026-08-09T00:18:43.208790Z","submitted_at":"2024-02-23T18:35:15Z","title":"The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16893","snapshot_observed_at":"2026-08-08T04:37:28.809380Z","title":"The good and the bad: Exploring pri- vacy issues in retrieval-augmented generation (rag).arXiv preprint arXiv:2402.16893,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.809380Z"},"links":{"cited_paper":"/paper/2402.16893","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:ff718f6cbe764fc4cca404e7b01461dc66f541398f4bd5917d1009ce05524395","observation_id":"7efd6251-11e5-49d5-8b67-2007d2b53ac3","resolution":{"observed_at":"2026-08-08T04:37:28.809380Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-08-08T04:37:28.833682Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.833682Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:9a838d5753435208f9b4ce3867d59c488242f842d91d963f53ba13af231d6dc3","observation_id":"75e283ae-38ba-4953-92f4-67cd737699ad","resolution":{"observed_at":"2026-08-08T04:37:28.833682Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.13854","last_updated":"2024-04-16T15:13:18Z","snapshot_observed_at":"2026-08-06T12:47:01.809185Z","submitted_at":"2023-07-25T22:59:32Z","title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.13854","snapshot_observed_at":"2026-08-08T04:37:28.861187Z","title":"Webarena: A realistic web envi- ronment for building autonomous agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.861187Z"},"links":{"cited_paper":"/paper/2307.13854","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:719d78ca4c096f77285be9c4c5310cb094db8fcb6562f22d8f4991f7149a4d5c","observation_id":"eaaceb16-a8fe-4fb8-8a94-57705e2572ee","resolution":{"observed_at":"2026-08-08T04:37:28.861187Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-08T04:37:28.864419Z","title":"Universal and transferable adversarial attacks on aligned language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.864419Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:38df0d488ccdd9fca4e02705068b22582ac23f39cd90fe32881e30afd3e19319","observation_id":"1f195015-f753-4464-a947-6a6c78bc07e5","resolution":{"observed_at":"2026-08-08T04:37:28.864419Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.07867","last_updated":"2024-08-13T01:55:06Z","snapshot_observed_at":"2026-07-06T17:29:05.185768Z","submitted_at":"2024-02-12T18:28:36Z","title":"PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.07867","snapshot_observed_at":"2026-08-08T04:37:28.867597Z","title":"Poisonedrag: Knowledge poisoning attacks to retrieval- augmented generation of large language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.867597Z"},"links":{"cited_paper":"/paper/2402.07867","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:6b13482910a9069b70db26b1922a8c9907f9d3da766a2b88af78cc45cd9d4e78","observation_id":"e82cbe66-f7fa-4f7e-89ff-287c47565931","resolution":{"observed_at":"2026-08-08T04:37:28.867597Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.12784","last_updated":"2024-07-17T17:59:47Z","snapshot_observed_at":"2026-08-09T05:58:40.075515Z","submitted_at":"2024-07-17T17:59:47Z","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.12784","snapshot_observed_at":"2026-08-08T04:37:28.364091Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":2017,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.364091Z"},"links":{"cited_paper":"/paper/2407.12784","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:1de62ad7911d97cc1cdce5504f984736fcf294c79b8b6bfd167de99551fa97b7","observation_id":"7d3be1a2-b8fb-4a6e-849c-808561abf87a","resolution":{"observed_at":"2026-08-08T04:37:28.364091Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.03007","last_updated":"2024-06-05T07:14:28Z","snapshot_observed_at":"2026-07-06T18:25:44.620682Z","submitted_at":"2024-06-05T07:14:28Z","title":"BadAgent: Inserting and Activating Backdoor Attacks in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.03007","snapshot_observed_at":"2026-08-08T04:37:28.696356Z","title":"Rlhfpoison: Reward poison- ing attack for reinforcement learning with human feed- back in large language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":2020,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.696356Z"},"links":{"cited_paper":"/paper/2406.03007","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:dfc2e887fed434b0d951cbd310dde800abc6b464635d42da939ecdecea9b79e5","observation_id":"6b8f9803-dfee-4eb5-832e-dde61e6a10e5","resolution":{"observed_at":"2026-08-08T04:37:28.696356Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.12856","last_updated":"2024-02-25T16:17:43Z","snapshot_observed_at":"2026-07-06T15:57:53.178833Z","submitted_at":"2023-07-24T14:56:30Z","title":"A Real-World WebAgent with Planning, Long Context Understanding, and Program Synthesis","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.12856","snapshot_observed_at":"2026-08-08T04:37:28.381640Z","title":"A real-world webagent with planning, long context un- derstanding, and program synthesis","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.381640Z"},"links":{"cited_paper":"/paper/2307.12856","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:edaacbc1381eb5c7f29fdff92cabce12a2ee43563d0943240c58a0a827f9b048","observation_id":"71d462d9-5a9b-43a1-aea4-39010fe76e3e","resolution":{"observed_at":"2026-08-08T04:37:28.381640Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1712.05526","last_updated":"2017-12-15T04:26:26Z","snapshot_observed_at":"2026-07-06T06:14:30.795326Z","submitted_at":"2017-12-15T04:26:26Z","title":"Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1712.05526","snapshot_observed_at":"2026-08-08T04:37:28.330264Z","title":"Targeted backdoor attacks on deep learn- ing systems using data poisoning","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.330264Z"},"links":{"cited_paper":"/paper/1712.05526","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:60254391e1ad221b99d0ab08d196954157bde6b939bae43fedda8fddab2055a4","observation_id":"c78bb0e7-56c5-4300-8fbf-19f51297f658","resolution":{"observed_at":"2026-08-08T04:37:28.330264Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2304.05376","last_updated":"2023-10-02T17:03:01Z","snapshot_observed_at":"2026-07-06T15:14:32.823996Z","submitted_at":"2023-04-11T17:41:13Z","title":"ChemCrow: Augmenting large-language models with chemistry tools","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.05376","snapshot_observed_at":"2026-08-08T04:37:28.294013Z","title":"Bran, Sam Cox, Oliver Schilter, Andrew D","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.294013Z"},"links":{"cited_paper":"/paper/2304.05376","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:240e0b349577f400b4cb1f930f4114cd25825cb45e85b4c2146e197b2e3b4ca8","observation_id":"86005911-1a78-45d4-baa8-42fdf1046c33","resolution":{"observed_at":"2026-08-08T04:37:28.294013Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.17035","last_updated":"2023-11-28T18:47:03Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-11-28T18:47:03Z","title":"Scalable Extraction of Training Data from (Production) Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.17035","snapshot_observed_at":"2026-08-08T04:37:28.394855Z","title":"Scalable extraction of training data from (production) language models","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-08T04:37:28.394855Z"},"links":{"cited_paper":"/paper/2311.17035","citing_paper":"/paper/2502.08586"},"observation_digest":"sha256:f9d580d080a4ca13fe0ddebbe0fd1b10fe45e3ac9fbc4442d562af7cbbc47d33","observation_id":"b0ddb43a-d175-449f-ae19-ea1f7c0025f3","resolution":{"observed_at":"2026-08-08T04:37:28.394855Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2502.08586","last_updated":"2025-02-12T17:19:36Z","latest_version":1,"primary_category":"cs.LG","snapshot_observed_at":"2026-08-08T23:24:16.398221Z","submitted_at":"2025-02-12T17:19:36Z","title":"Commercial LLM Agents Are Already Vulnerable to Simple Yet Dangerous Attacks"},"reference_resolution":{"displayed":27,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":25,"verified_exact":0,"verified_fuzzy":2},"total_outbound_references":27},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 27 of 27 outbound references and 24 inbound Pith citation observations for arXiv:2502.08586."}