{"as_of":"2026-08-10T08:04:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:226fd8827cf6a2fff77fae91376f26c0d595f00b53c223c7792fa1b9f2b71408","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":24,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":24,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":24,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":24,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:15:39.937396Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-07T14:15:39.937396Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2505.19443","last_updated":"2025-05-26T03:00:21Z","snapshot_observed_at":"2026-08-07T14:11:48.229560Z","submitted_at":"2025-05-26T03:00:21Z","title":"Vibe Coding vs. Agentic Coding: Fundamentals and Practical Implications of Agentic AI","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-07T14:15:39.937396Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2505.19443"},"observation_digest":"sha256:45f8206f13a673d3609704fc434dc1502fbbf7c2c5347966ba71c1e22f9b72a6","observation_id":"c197dca4-1ded-407b-9300-75cd571f33d5","resolution":{"observed_at":"2026-08-07T14:15:39.937396Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-06T21:34:45.107075Z","title":"Multi-agent systems ex- ecute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.23844","last_updated":"2025-06-30T13:34:34Z","snapshot_observed_at":"2026-08-08T15:24:13.507722Z","submitted_at":"2025-06-30T13:34:34Z","title":"A Survey on Autonomy-Induced Security Risks in Large Model-Based Agents","version":1},"reference_index":126,"source":"pdf_text","source_observed_at":"2026-08-06T21:34:45.107075Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2506.23844"},"observation_digest":"sha256:2d7af19ea9721f89784e56da907d924091b12f5185af8f4f8e67287242faa99d","observation_id":"3620ff31-f342-40df-b6a4-aaba67997c8a","resolution":{"observed_at":"2026-08-06T21:34:45.107075Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-03T18:37:11.072760Z","title":"Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He","venue":null,"work_id":null,"year":1998},"citing_paper":{"arxiv_id":"2512.04668","last_updated":"2026-06-03T14:38:00Z","snapshot_observed_at":"2026-08-09T19:47:53.671406Z","submitted_at":"2025-12-04T11:00:49Z","title":"Topology Matters: Measuring Memory Leakage in Multi-Agent LLMs","version":4},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-03T18:37:11.072760Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2512.04668"},"observation_digest":"sha256:fb764229ba7d3d98eae234afbf67b8281020f505962f123c95d37ad531e759c7","observation_id":"15eeee1b-2e21-47db-b3d5-28f446e44253","resolution":{"observed_at":"2026-08-03T18:37:11.072760Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2601.03294","last_updated":"2026-04-24T09:00:38Z","snapshot_observed_at":"2026-08-04T12:40:05.079383Z","submitted_at":"2026-01-05T15:42:18Z","title":"AgentMark: Utility-Preserving Behavioral Watermarking for Agents","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-16T17:52:49.826217Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2601.03294"},"observation_digest":"sha256:8acb45b6d84c27a5238d3aa863c6ead2a345cd51d2f123baa5015aa7e90e25a4","observation_id":"3742b33d-12b7-4195-84da-40221f1006a7","resolution":{"observed_at":"2026-05-16T17:53:11.532827Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2603.04474","last_updated":"2026-05-11T15:41:00Z","snapshot_observed_at":"2026-07-06T22:47:50.848191Z","submitted_at":"2026-03-04T11:45:27Z","title":"From Spark to Fire: Modeling and Mitigating Error Cascades in LLM-Based Multi-Agent Collaboration","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-15T16:36:43.330447Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2603.04474"},"observation_digest":"sha256:cc656219b6fc515f737d820e9ed7ce87f63d1ba9b7432fa786e5230c550c64d3","observation_id":"5e16f565-d5b9-456b-895a-d2bd684ae017","resolution":{"observed_at":"2026-05-15T16:40:10.565595Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2603.09002","last_updated":"2026-04-26T14:13:48Z","snapshot_observed_at":"2026-07-06T22:48:26.306802Z","submitted_at":"2026-03-09T22:46:27Z","title":"Security Considerations for Multi-agent Systems","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-15T14:12:14.160789Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2603.09002"},"observation_digest":"sha256:f0eafe9ab91d0f9f88555cbbd0ac74c7fe0403a291586052b323816579930cf1","observation_id":"0d282159-c660-4f7c-ba60-34383c20e469","resolution":{"observed_at":"2026-05-15T14:15:54.993562Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-07-15T12:11:00.253650Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2603.09133","last_updated":"2026-07-10T10:10:02Z","snapshot_observed_at":"2026-08-09T13:37:51.039968Z","submitted_at":"2026-03-10T03:13:24Z","title":"Detailed analysis of possible new-physics effects in the semileptonic decay $B_s \\to D_s^{(*)}\\tau\\bar{\\nu}$","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-15T12:11:00.253650Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2603.09133"},"observation_digest":"sha256:7b8e8cf534a2c8da712641266773e5d0c62f5a79b14334a22e936ab03190a944","observation_id":"1c562f6c-9c5b-47df-86e4-deec4ffaa155","resolution":{"observed_at":"2026-07-15T12:11:00.253650Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2604.08608","last_updated":"2026-04-20T18:30:51Z","snapshot_observed_at":"2026-08-08T15:27:48.651466Z","submitted_at":"2026-04-08T18:19:03Z","title":"Semantic Intent Fragmentation: A Single-Shot Compositional Attack on Multi-Agent AI Pipelines","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-10T17:40:23.128451Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2604.08608"},"observation_digest":"sha256:abc0b122b0bc4b60163d32dbb60e6c29bddf28e5c7e133e85d458be1480d55a8","observation_id":"24514df3-5749-4d33-b456-1943513c1426","resolution":{"observed_at":"2026-05-11T06:20:58.889968Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2604.14317","last_updated":"2026-04-15T18:20:07Z","snapshot_observed_at":"2026-07-06T23:02:09.426599Z","submitted_at":"2026-04-15T18:20:07Z","title":"Challenges and Future Directions in Agentic Reverse Engineering Systems","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-10T12:49:31.238578Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2604.14317"},"observation_digest":"sha256:86dde618f678a5fa99f03e999fc84502c8a2dcf0247959b89968ce18f18df2a2","observation_id":"b42ec855-08af-42e0-869a-d5354dc48013","resolution":{"observed_at":"2026-05-10T12:50:24.701927Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2604.16543","last_updated":"2026-04-17T02:31:09Z","snapshot_observed_at":"2026-07-06T23:03:52.631613Z","submitted_at":"2026-04-17T02:31:09Z","title":"Conjunctive Prompt Attacks in Multi-Agent LLM Systems","version":1},"reference_index":38,"source":"arxiv_source","source_observed_at":"2026-05-10T08:13:42.401992Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2604.16543"},"observation_digest":"sha256:8989c57200a1493f464877fab4a490ab9127b55a736419aecb686152b804c9da","observation_id":"0fb10241-542c-443f-b80f-116eddf20081","resolution":{"observed_at":"2026-05-10T08:17:37.696855Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2605.03378","last_updated":"2026-07-08T15:04:28Z","snapshot_observed_at":"2026-08-02T02:34:38.609069Z","submitted_at":"2026-05-05T05:37:00Z","title":"ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection","version":1},"reference_index":143,"source":"arxiv_source","source_observed_at":"2026-05-07T15:59:49.513500Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2605.03378"},"observation_digest":"sha256:3a69e5dd35419d1f77e42f372e7b24a4453dca8e5f22182ff7c02a0c18084391","observation_id":"db670ae1-ae40-4b94-841e-24d0ca0445f0","resolution":{"observed_at":"2026-05-11T23:56:13.834033Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2605.08460","last_updated":"2026-05-08T20:27:23Z","snapshot_observed_at":"2026-07-06T23:20:43.010758Z","submitted_at":"2026-05-08T20:27:23Z","title":"When Child Inherits: Modeling and Exploiting Subagent Spawn in Multi-Agent Networks","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-12T01:20:55.221345Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2605.08460"},"observation_digest":"sha256:64fdc4f086aceb6388b1a69e7c3014bd1e5c23c8b19fba6fa76c5d54bdfbfbe4","observation_id":"57b6b7a0-0f37-459a-b02e-371e0f602ca3","resolution":{"observed_at":"2026-05-12T08:01:33.144109Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2605.11036","last_updated":"2026-05-11T02:28:34Z","snapshot_observed_at":"2026-08-07T01:00:05.011499Z","submitted_at":"2026-05-11T02:28:34Z","title":"Sequential Behavioral Watermarking for LLM Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-13T01:44:13.564389Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2605.11036"},"observation_digest":"sha256:89618a51a09f3365a8d38ce922dd6757bb6497febb901070844bad3cb910e20b","observation_id":"acbc91a1-d7bc-4e26-89c6-d5b153928cbb","resolution":{"observed_at":"2026-05-13T01:47:04.099933Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.00497","last_updated":"2026-05-30T03:00:28Z","snapshot_observed_at":"2026-07-31T17:49:49.063236Z","submitted_at":"2026-05-30T03:00:28Z","title":"\"I Strongly Suspect This Website Is a Scam\": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents","version":1},"reference_index":151,"source":"arxiv_source","source_observed_at":"2026-06-28T18:53:41.420255Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.00497"},"observation_digest":"sha256:0c494d6ba9826656eb94ea1ac7d19aa48de7867965c6a11b56199cf69aa75dfc","observation_id":"6921c6f5-e747-47fa-8a68-3abb9750f62a","resolution":{"observed_at":"2026-06-28T19:42:36.133114Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.10749","last_updated":"2026-06-09T12:01:07Z","snapshot_observed_at":"2026-07-31T21:35:18.696472Z","submitted_at":"2026-06-09T12:01:07Z","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","version":1},"reference_index":169,"source":"pdf_text","source_observed_at":"2026-06-27T12:55:22.831264Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.10749"},"observation_digest":"sha256:5fcb8b62ce6351bcfc019da6a0dcde1baa75527fa7558f5076aed1c1e1ae78cf","observation_id":"4c55f5ff-b7b2-49e0-b5ae-bf31ba288518","resolution":{"observed_at":"2026-06-27T13:20:56.861621Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.12797","last_updated":"2026-06-11T01:46:26Z","snapshot_observed_at":"2026-07-06T23:51:40.528967Z","submitted_at":"2026-06-11T01:46:26Z","title":"The Containment Gap: How Deployed Agentic AI Frameworks Fail Public-Facing Safety Requirements","version":1},"reference_index":46,"source":"arxiv_source","source_observed_at":"2026-06-27T07:25:32.556071Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.12797"},"observation_digest":"sha256:5898c27af57908b498297dc8f5943b31c3c2913feb7f938421cdf63ec8b604fd","observation_id":"01c9d6af-ab45-478f-b192-6a0bd6206d97","resolution":{"observed_at":"2026-07-03T13:58:21.480844Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2606.30602","last_updated":"2026-06-29T17:40:45Z","snapshot_observed_at":"2026-08-03T17:51:38.702679Z","submitted_at":"2026-06-29T17:40:45Z","title":"MESA: Prioritizing Vulnerable Communication Channels for Securing Multi-Agent Systems","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-06-30T04:48:51.748711Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2606.30602"},"observation_digest":"sha256:49e92ae2bd02a0be5549fd22a70b1e9d0576953679a6a596627ce383710fae81","observation_id":"93786acb-87e0-40fb-b858-9a70b705906b","resolution":{"observed_at":"2026-06-30T16:14:53.967870Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":"2503.12188","doi":"10.48550/arxiv.2503.12188","metadata_source":"pith","pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Lei Wang, Jingsen Zhang, Hao Yang, Zhi-Yuan Chen, Jiakai Tang, Zeyu Zhang, Xu Chen, Yankai Lin, Hao Sun, Ruihua Song, and 1 others","venue":"cs.CR","work_id":"4b6792e0-3106-45e4-9b98-fbb6884a7a1a","year":2025},"citing_paper":{"arxiv_id":"2607.07097","last_updated":"2026-07-08T07:31:37Z","snapshot_observed_at":"2026-08-09T06:04:04.401991Z","submitted_at":"2026-07-08T07:31:37Z","title":"Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safety","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-09T20:14:36.433937Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2607.07097"},"observation_digest":"sha256:6f5b2014c63267aca66fc71f1a370290bd85f276733641713b22be985fa80d0b","observation_id":"dedaafb1-0aa6-45b0-97d2-3ca92045901b","resolution":{"observed_at":"2026-07-09T20:16:29.367118Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-01T14:16:00.056317Z","title":"arXiv preprint arXiv:2503.12188 , year =","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.18826","last_updated":"2026-07-21T08:01:51Z","snapshot_observed_at":"2026-08-07T10:01:48.281554Z","submitted_at":"2026-07-21T08:01:51Z","title":"Cross-Agent Campaign Attribution: Linking Asynchronous Attacks Across LLM Agents","version":1},"reference_index":14,"source":"arxiv_source","source_observed_at":"2026-08-01T14:16:00.056317Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2607.18826"},"observation_digest":"sha256:91e8c4b3b7bce80747ff2903e4f0823accf2915c43099738ed33606120ba2197","observation_id":"d976e7ac-341b-42cd-8b2c-dcb1a89582dc","resolution":{"observed_at":"2026-08-01T14:16:00.056317Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-01T00:51:17.583274Z","title":"arXiv preprint arXiv:2503.12188 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.26120","last_updated":"2026-07-28T17:48:54Z","snapshot_observed_at":"2026-08-07T12:54:18.789385Z","submitted_at":"2026-07-28T17:48:54Z","title":"Even More Deception: Objective Misalignment in Mixed-Motive LLM Multi-Agent Systems","version":1},"reference_index":47,"source":"arxiv_source","source_observed_at":"2026-08-01T00:51:17.583274Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2607.26120"},"observation_digest":"sha256:00689b5b2b6f9e6ff0004441a6fdafce4ffab9bbc1e88c93fa4da2c8faeff844","observation_id":"773b3310-e45e-4e2a-bada-1eed7cd2b555","resolution":{"observed_at":"2026-08-01T00:51:17.583274Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-04T01:03:46.926679Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00202","last_updated":"2026-07-31T18:27:12Z","snapshot_observed_at":"2026-08-07T03:19:41.307598Z","submitted_at":"2026-07-31T18:27:12Z","title":"From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-04T01:03:46.926679Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00202"},"observation_digest":"sha256:f03adca25cee64479fecc3d78a23928ac30dd8d70f867d8054c4c6f5503560f5","observation_id":"541b6dc2-c999-481c-a71c-6655196b1abf","resolution":{"observed_at":"2026-08-04T01:03:46.926679Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T00:25:59.475710Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T00:25:59.475710Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:1ac22539376a524cf5fc8aafcb054b4d8bc307f5a3d8c92a5bf7e88dc71ca363","observation_id":"6ea42930-0465-4304-98ea-353cd51db98b","resolution":{"observed_at":"2026-08-05T00:25:59.475710Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T04:17:02.535609Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.535609Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:76b95d390a08f6783a67403cdc30692f1ca3dcdda3b95e02535bc86e5dd39825","observation_id":"df05d453-c18f-46f1-af60-291b8c858210","resolution":{"observed_at":"2026-08-05T04:17:02.535609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T22:07:42.214656Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.03272","last_updated":"2026-08-04T07:49:58Z","snapshot_observed_at":"2026-08-08T22:52:38.078964Z","submitted_at":"2026-08-04T07:49:58Z","title":"Attacking and Defending Multi-Agent Collaborative Filtering Systems Through Connectivity","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-05T22:07:42.214656Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.03272"},"observation_digest":"sha256:e26ccfe191a5644c5712f0cb4d0c46eead6a3052911f7152219df6b32ca6ce9e","observation_id":"e69bc127-7d6e-4261-86b0-333670b84d27","resolution":{"observed_at":"2026-08-05T22:07:42.214656Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2503.12188/citation-record","integrity":"/paper/2503.12188/integrity","json":"/paper/2503.12188/citation-record.json","paper":"/paper/2503.12188"},"outbound":[],"paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 24 inbound Pith citation observations for arXiv:2503.12188."}