{"as_of":"2026-08-13T22:23:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:36122907238ef59d9c7351a6d6a5293b083200126d121dcb7835d167e571c539","coverage":[{"denominator":0,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":18,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":18,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-13T06:32:02.005865+00:00","state":"measured"},{"denominator":18,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":18,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-07T14:34:34.867377Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"arxiv_reference","source_observed_at":"2026-07-04T10:09:45.177863Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-08-12T23:26:44.716922Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-05-22T21:09:51.782808Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2504.11703"},"observation_digest":"sha256:209457182c095c0f8e6b9abf9e4bd2c03abe303d7bb4110c47172bda5304ce25","observation_id":"1b69edd8-c974-46b4-8663-438abb005067","resolution":{"observed_at":"2026-05-22T21:12:08.484176Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-08-07T14:34:34.867377Z","title":"Agentxploit: End-to-end redteaming of black-box ai agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2505.18471","last_updated":"2025-05-24T02:26:49Z","snapshot_observed_at":"2026-08-13T07:44:36.929674Z","submitted_at":"2025-05-24T02:26:49Z","title":"Invisible Tokens, Visible Bills: The Urgent Need to Audit Hidden Operations in Opaque LLM Services","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-07T14:34:34.867377Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2505.18471"},"observation_digest":"sha256:542d6fb1434418277347433284e8ffc7bc33ff7d1d581b301f92d0d6bbc1ca38","observation_id":"36d40690-2b23-4e58-aca1-4e32eff4c2b1","resolution":{"observed_at":"2026-08-07T14:34:34.867377Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-08-07T12:11:24.967328Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.05376","last_updated":"2025-06-09T05:48:22Z","snapshot_observed_at":"2026-08-10T02:41:13.540113Z","submitted_at":"2025-05-30T22:58:54Z","title":"A Red Teaming Roadmap Towards System-Level Safety","version":2},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-07T12:11:24.967328Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2506.05376"},"observation_digest":"sha256:6e5fd7c7be7619da46458f19b1f49d2cf5961725c78451b4c5235395d694597d","observation_id":"60f33eb7-2813-4eeb-88e6-64af5737e63e","resolution":{"observed_at":"2026-08-07T12:11:24.967328Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-08-06T15:42:01.058771Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-08-06T15:35:31.690602Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"reference_index":41,"source":"arxiv_source","source_observed_at":"2026-08-06T15:42:01.058771Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2507.15219"},"observation_digest":"sha256:8a0671ccb8c9fa079d56cd1456d1eb0f082dcf87823f8ce4c489874a455b53b1","observation_id":"3f6dbd46-137c-4c4a-b0c3-bd62c8ba26ba","resolution":{"observed_at":"2026-08-06T15:42:01.058771Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-08-06T13:05:40.367994Z","title":"Agentvigil: Generic black-box red-teaming for indirect prompt injection against llm agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2507.21206","last_updated":"2025-07-28T17:58:12Z","snapshot_observed_at":"2026-08-08T10:48:52.442522Z","submitted_at":"2025-07-28T17:58:12Z","title":"Agentic Web: Weaving the Next Web with AI Agents","version":1},"reference_index":224,"source":"arxiv_source","source_observed_at":"2026-08-06T13:05:40.367994Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2507.21206"},"observation_digest":"sha256:15d126d05e6bb7e6aeb175c07f151e28074d457c4161a64683778d3412cf9253","observation_id":"59e59dd2-a947-4309-b9b2-8a72a1bf3145","resolution":{"observed_at":"2026-08-06T13:05:40.367994Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-08-13T06:30:13.674734Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ce39aa78e25d8742dd0fb9d10fabadb9935a8e51b2e602adc597fbc66c601c8c","observation_id":"e01b55d3-0550-41b1-b9e0-7a7aaf50e233","resolution":{"observed_at":"2026-05-11T20:26:11.054246Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-08-13T20:33:40.944815Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-05-20T09:02:59.719090Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:8c31a8e3e39a2b436b24e8d0f300f3fd00648e4ef8b786e704a8af073842ecb7","observation_id":"3ef61d7f-ae1b-4ee4-92bc-5f80b0238b63","resolution":{"observed_at":"2026-05-20T09:03:09.842181Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.18991","last_updated":"2026-05-20T17:25:38Z","snapshot_observed_at":"2026-08-13T20:33:40.944815Z","submitted_at":"2026-05-18T18:11:17Z","title":"Agent Security is a Systems Problem","version":2},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-05-21T07:43:14.250188Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.18991"},"observation_digest":"sha256:876813e22ac08dce8311ccfbb7792f66703039554e1197d37d06149894e9d092","observation_id":"f3353e1c-a6ab-42ad-94a8-a09152700dd7","resolution":{"observed_at":"2026-05-21T07:44:02.914269Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.19192","last_updated":"2026-05-20T21:49:08Z","snapshot_observed_at":"2026-08-03T06:06:31.296336Z","submitted_at":"2026-05-18T23:40:43Z","title":"Hallucination as Exploit: Evidence-Carrying Multimodal Agents","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-05-20T09:46:42.413501Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.19192"},"observation_digest":"sha256:a6a9bff7e15d9a042565026764fa6aa9fba8f188094947da7180c6bd094a8cc3","observation_id":"403464f2-3a56-4ea4-ac84-709e17e2fe54","resolution":{"observed_at":"2026-05-20T09:48:11.589903Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.19192","last_updated":"2026-05-20T21:49:08Z","snapshot_observed_at":"2026-08-03T06:06:31.296336Z","submitted_at":"2026-05-18T23:40:43Z","title":"Hallucination as Exploit: Evidence-Carrying Multimodal Agents","version":2},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-05-22T08:57:29.491043Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.19192"},"observation_digest":"sha256:5e50f9f550ba6229882a7f515b8c668405608af237317f56f1478f23f86737a1","observation_id":"d44f66e0-cfef-4cdc-b84b-b769a5bd773c","resolution":{"observed_at":"2026-05-22T09:01:19.894756Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2606.00566","last_updated":"2026-05-30T06:38:41Z","snapshot_observed_at":"2026-07-06T23:41:15.410587Z","submitted_at":"2026-05-30T06:38:41Z","title":"Same Payload, Different Channel: Measuring Trust Asymmetry in Tool-Using Language Models","version":1},"reference_index":21,"source":"arxiv_source","source_observed_at":"2026-06-28T19:19:17.673497Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2606.00566"},"observation_digest":"sha256:abc92f7d406c24ff5298d7ee618894d6e79500f5e850b8fa0149b63d1603316b","observation_id":"eb3ef02b-eb9b-4acb-8c6b-1a6272bf5342","resolution":{"observed_at":"2026-06-28T19:22:34.394638Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2606.10525","last_updated":"2026-06-09T07:54:58Z","snapshot_observed_at":"2026-08-12T14:50:05.354392Z","submitted_at":"2026-06-09T07:54:58Z","title":"Assessing Automated Prompt Injection Attacks in Agentic Environments","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-06-27T12:47:09.467463Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2606.10525"},"observation_digest":"sha256:c5bc8759c72a1fc15b755bbc77886f96309a6c832b020d118fa3dd8b157ed7df","observation_id":"412cde2d-a5bb-4fc3-bbf5-52bb12fd7d8a","resolution":{"observed_at":"2026-07-03T06:17:41.945423Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2606.12737","last_updated":"2026-06-10T22:57:02Z","snapshot_observed_at":"2026-08-12T23:16:57.249306Z","submitted_at":"2026-06-10T22:57:02Z","title":"PI-Hunter: Automated Red-Teaming for Exposing and Localizing Prompt Injections","version":1},"reference_index":28,"source":"arxiv_source","source_observed_at":"2026-06-27T08:56:12.882653Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2606.12737"},"observation_digest":"sha256:1a67da61b6dac6ef405688b2e197abcf90f4b0ee31e554b459f5cf18c5937e37","observation_id":"d3594358-41db-416a-ba7e-17f323c11cce","resolution":{"observed_at":"2026-07-03T12:38:07.269748Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2606.14027","last_updated":"2026-06-30T01:10:08Z","snapshot_observed_at":"2026-08-02T09:41:26.926011Z","submitted_at":"2026-06-12T02:01:38Z","title":"Same-Origin Policy for Agentic Browsers","version":3},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-01T07:29:08.355105Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2606.14027"},"observation_digest":"sha256:bcab9eb41a819cdb52d75c6cdaec00b749dae9dd86a39d0602054b7400520621","observation_id":"f47fff1d-8f9a-4b0b-a561-ff066adb7b40","resolution":{"observed_at":"2026-07-01T07:35:29.017390Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2606.22864","last_updated":"2026-06-22T05:13:25Z","snapshot_observed_at":"2026-08-02T16:33:47.655259Z","submitted_at":"2026-06-22T05:13:25Z","title":"When AUC 0.998 Is Not Enough: A Candidate Evaluation Protocol for Hidden-State Probes of Indirect Prompt Injection in Multimodal Computer-Use Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-06-26T09:05:22.096955Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2606.22864"},"observation_digest":"sha256:36b76bb77ae91c35c0288c51de4b2fbbe7f81104801e883a82f28b33dfa25829","observation_id":"92e8edb9-0134-4a58-9b27-8bcfe956fd8a","resolution":{"observed_at":"2026-07-04T10:09:45.179850Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-13T06:32:02.005865+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-12T04:03:40.067404Z","title":"arXiv preprint arXiv:2505.05849 , year=","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.03220","last_updated":"2026-07-03T11:34:27Z","snapshot_observed_at":"2026-08-12T21:38:33.754805Z","submitted_at":"2026-07-03T11:34:27Z","title":"CONTRA: Red-Teaming Configurations of Personalizable Agents","version":1},"reference_index":13,"source":"arxiv_source","source_observed_at":"2026-07-12T04:03:40.067404Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2607.03220"},"observation_digest":"sha256:5aa57e9cccd91763e051489d9623d86c314155f94551c16dde6b092293465698","observation_id":"fc937447-2d5a-4b84-b05b-49bdfdbedfc9","resolution":{"observed_at":"2026-07-12T04:03:40.067404Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-08-01T11:38:19.674889Z","title":"Agentvigil: Generic black-box red-teaming for indirect prompt injection against llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19837","last_updated":"2026-07-22T07:20:27Z","snapshot_observed_at":"2026-08-10T05:49:29.427618Z","submitted_at":"2026-07-22T07:20:27Z","title":"Know Your Agent: Reconnaissance-Driven Pentesting of AI Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T11:38:19.674889Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2607.19837"},"observation_digest":"sha256:335a34c77858b2e9cdf8c2bf27eab3c5c81e3a1b3e7e58cb2a657838026321e7","observation_id":"1b17e9f1-3daf-4a2b-ae26-da210751b368","resolution":{"observed_at":"2026-08-01T11:38:19.674889Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-08-01T01:12:44.169745Z","title":"Willison, S","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.26115","last_updated":"2026-07-28T16:03:39Z","snapshot_observed_at":"2026-08-13T19:33:22.724755Z","submitted_at":"2026-07-28T16:03:39Z","title":"GPT-Red: Automated Red Teaming via Self-Play at Scale","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T01:12:44.169745Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2607.26115"},"observation_digest":"sha256:4eb4ee58d0a1e810940d355a811a246417777daf41a65c37101f9c891251323e","observation_id":"c76f5e9b-e5d3-4311-b3ff-1e806e38fac5","resolution":{"observed_at":"2026-08-01T01:12:44.169745Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2505.05849/citation-record","integrity":"/paper/2505.05849/integrity","json":"/paper/2505.05849/citation-record.json","paper":"/paper/2505.05849"},"outbound":[],"paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","latest_version":4,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-12T19:23:00.827622Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents"},"reference_resolution":{"displayed":0,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":0,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":0},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-13T06:32:02.005865+00:00","source":"crossref"},{"observed_at":"2026-08-13T06:31:53.387327+00:00","source":"retraction_watch"}],"thesis":"As of 13 August 2026, this Paper Citation Record lists 0 of 0 outbound references and 18 inbound Pith citation observations for arXiv:2505.05849."}