{"as_of":"2026-08-12T14:31:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:ff09ad7f544b3de09690530dfaa3e60d7aef2a2c87b19af816e82a2008531c4d","coverage":[{"denominator":27,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":27,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T23:59:59.384340Z","state":"measured"},{"denominator":33,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":33,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-12T06:34:41.77262+00:00","state":"measured"},{"denominator":6,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":6,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T11:11:40.945299Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-08T00:24:22.457387Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"cited_work":{"arxiv_id":"2506.17318","doi":null,"metadata_source":"pith","pith_arxiv_id":"2506.17318","snapshot_observed_at":"2026-07-08T00:24:22.457387Z","title":"Context manipulation attacks: Web agents are susceptible to corrupted memory","venue":"cs.CR","work_id":"0f1acc61-0568-43cd-86ca-2c44121f700e","year":2025},"citing_paper":{"arxiv_id":"2603.23064","last_updated":"2026-04-04T19:02:50Z","snapshot_observed_at":"2026-07-06T22:50:19.273712Z","submitted_at":"2026-03-24T11:01:09Z","title":"Mind Your HEARTBEAT! Claw Background Execution Inherently Enables Silent Memory Pollution","version":3},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-15T00:55:00.205075Z"},"links":{"cited_paper":"/paper/2506.17318","citing_paper":"/paper/2603.23064"},"observation_digest":"sha256:6ad187d3e93f6c5878c5593e55624c2c853671222387e6b7e63232deaef639b1","observation_id":"b0eed74a-d1e3-40ec-8f15-ffd3ad4cb840","resolution":{"observed_at":"2026-05-15T00:58:26.262828Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"cited_work":{"arxiv_id":"2506.17318","doi":null,"metadata_source":"pith","pith_arxiv_id":"2506.17318","snapshot_observed_at":"2026-07-08T00:24:22.457387Z","title":"Context manipulation attacks: Web agents are susceptible to corrupted memory","venue":"cs.CR","work_id":"0f1acc61-0568-43cd-86ca-2c44121f700e","year":2025},"citing_paper":{"arxiv_id":"2605.01970","last_updated":"2026-05-15T06:42:15Z","snapshot_observed_at":"2026-07-06T23:15:07.159340Z","submitted_at":"2026-05-03T17:07:20Z","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","version":2},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-05-09T17:13:47.722098Z"},"links":{"cited_paper":"/paper/2506.17318","citing_paper":"/paper/2605.01970"},"observation_digest":"sha256:1a559ae4e84906f1620d405680b05160de02c4bde9f73578959259fc7c477051","observation_id":"8a349daf-1cd5-4ab3-85cd-5874eca60d1e","resolution":{"observed_at":"2026-05-11T16:21:10.228512Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"cited_work":{"arxiv_id":"2506.17318","doi":null,"metadata_source":"pith","pith_arxiv_id":"2506.17318","snapshot_observed_at":"2026-07-08T00:24:22.457387Z","title":"Context manipulation attacks: Web agents are susceptible to corrupted memory","venue":"cs.CR","work_id":"0f1acc61-0568-43cd-86ca-2c44121f700e","year":2025},"citing_paper":{"arxiv_id":"2605.01970","last_updated":"2026-05-15T06:42:15Z","snapshot_observed_at":"2026-07-06T23:15:07.159340Z","submitted_at":"2026-05-03T17:07:20Z","title":"Trojan Hippo: Weaponizing Agent Memory for Data Exfiltration","version":3},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-05-19T17:30:22.481943Z"},"links":{"cited_paper":"/paper/2506.17318","citing_paper":"/paper/2605.01970"},"observation_digest":"sha256:73146e2020776548e680b24b11d8c0e42825b457c4cd108d8c7ceaae5e24d10d","observation_id":"fb210899-fbf0-4cbf-b4e3-ff2401b488d9","resolution":{"observed_at":"2026-05-19T17:32:41.624005Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"cited_work":{"arxiv_id":"2506.17318","doi":null,"metadata_source":"pith","pith_arxiv_id":"2506.17318","snapshot_observed_at":"2026-07-08T00:24:22.457387Z","title":"Context manipulation attacks: Web agents are susceptible to corrupted memory","venue":"cs.CR","work_id":"0f1acc61-0568-43cd-86ca-2c44121f700e","year":2025},"citing_paper":{"arxiv_id":"2607.01919","last_updated":"2026-07-02T09:18:09Z","snapshot_observed_at":"2026-08-08T23:02:31.614123Z","submitted_at":"2026-07-02T09:18:09Z","title":"ElephantAgent: Contextual State Continuity in Agentic Systems","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-07-03T14:06:04.996981Z"},"links":{"cited_paper":"/paper/2506.17318","citing_paper":"/paper/2607.01919"},"observation_digest":"sha256:a0e0d6f10b954e2dec9e7e529ede605598703447afd27780bb93dd74cbfa246a","observation_id":"ab84a808-fa4c-414d-a6ee-ce1b41f44785","resolution":{"observed_at":"2026-07-03T14:08:21.374393Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"cited_work":{"arxiv_id":"2506.17318","doi":null,"metadata_source":"pith","pith_arxiv_id":"2506.17318","snapshot_observed_at":"2026-07-08T00:24:22.457387Z","title":"Context manipulation attacks: Web agents are susceptible to corrupted memory","venue":"cs.CR","work_id":"0f1acc61-0568-43cd-86ca-2c44121f700e","year":2025},"citing_paper":{"arxiv_id":"2607.05189","last_updated":"2026-07-06T15:08:58Z","snapshot_observed_at":"2026-08-12T13:55:54.759403Z","submitted_at":"2026-07-06T15:08:58Z","title":"When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-07-08T00:18:55.016013Z"},"links":{"cited_paper":"/paper/2506.17318","citing_paper":"/paper/2607.05189"},"observation_digest":"sha256:bf8db00665b54a070de54c5da0d6c6ccf2fb01500f49ed1a164814d360cda8d4","observation_id":"235bf3eb-2b0a-4441-a2dc-a1f1b23270b8","resolution":{"observed_at":"2026-07-08T00:24:22.459420Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.17318","snapshot_observed_at":"2026-08-05T11:11:40.945299Z","title":"In Proceedings of the 36th annual acm symposium on user interface software and technology, pages 1–22","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.03844","last_updated":"2026-08-04T15:50:26Z","snapshot_observed_at":"2026-08-12T04:55:22.719584Z","submitted_at":"2026-08-04T15:50:26Z","title":"MAFIA: Query-Only Memory Attacks via Probing and Factual Injection against Audited LLM Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T11:11:40.945299Z"},"links":{"cited_paper":"/paper/2506.17318","citing_paper":"/paper/2608.03844"},"observation_digest":"sha256:e2983c3ca6991eeaf63a2a6c0119a2b11ef413137ed47d6ecdd34c779b9da2fe","observation_id":"88c2e2f8-c8e8-4f19-8a87-23e39c6d2a30","resolution":{"observed_at":"2026-08-05T11:11:40.945299Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2506.17318/citation-record","integrity":"/paper/2506.17318/integrity","json":"/paper/2506.17318/citation-record.json","paper":"/paper/2506.17318"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2407.13032","last_updated":"2024-07-17T21:44:28Z","snapshot_observed_at":"2026-08-07T16:45:05.155981Z","submitted_at":"2024-07-17T21:44:28Z","title":"Agent-E: From Autonomous Web Navigation to Foundational Design Principles in Agentic Systems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.13032","snapshot_observed_at":"2026-08-06T23:59:56.633517Z","title":"Agent-e: From autonomous web navigation to foundational design principles in agentic systems.arXiv preprint arXiv:2407.13032,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:56.633517Z"},"links":{"cited_paper":"/paper/2407.13032","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:99c8c41469dfed6bfd6e720e61b483fbdf5218e32c84c4309b991415d9ce8c7f","observation_id":"6c110de6-a08c-425a-81ed-a4ffc0ed1515","resolution":{"observed_at":"2026-08-06T23:59:56.633517Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-07T19:59:01.081751Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-06T23:59:57.114750Z","title":"Defeating prompt injections by design.arXiv preprint arXiv:2503.18813,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.114750Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:808934a58d23324ac3e762fafe545c89ba4dae693750a3c4bc9efb347a60d001","observation_id":"32db510e-a853-437f-9d8a-d7bde270be68","resolution":{"observed_at":"2026-08-06T23:59:57.114750Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T23:59:57.199362Z","title":"A practical memory injection attack against llm agents.arXiv preprint arXiv:2503.03704,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.199362Z"},"links":{"citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:2623b8d6b3078e6b7d2c823728e0d6c4c5182fb3a9a02df2b98f066cfaf6b645","observation_id":"9c5b76c8-0fb1-40f1-8f00-36e9c8a21435","resolution":{"observed_at":"2026-08-06T23:59:57.199362Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.14720","last_updated":"2024-03-20T15:26:23Z","snapshot_observed_at":"2026-08-11T23:47:05.766547Z","submitted_at":"2024-03-20T15:26:23Z","title":"Defending Against Indirect Prompt Injection Attacks With Spotlighting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.14720","snapshot_observed_at":"2026-08-06T23:59:57.399538Z","title":"Defending against indirect prompt injection attacks with spotlighting.arXiv preprint arXiv:2403.14720,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.399538Z"},"links":{"cited_paper":"/paper/2403.14720","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:52086d42181cd69343e0586a5de93026922bdabda2c0df11a8739e344edcb654","observation_id":"c1667d30-140e-4145-985d-24abbef7fc40","resolution":{"observed_at":"2026-08-06T23:59:57.399538Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.05566","last_updated":"2024-01-17T20:26:01Z","snapshot_observed_at":"2026-08-12T12:19:52.685961Z","submitted_at":"2024-01-10T22:14:35Z","title":"Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.05566","snapshot_observed_at":"2026-08-06T23:59:57.453507Z","title":"M., Maxwell, T., Cheng, N., et al","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.453507Z"},"links":{"cited_paper":"/paper/2401.05566","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:abf59225abcf25c8818e0c7a18220139794800c1f228d843d4d2a6246f3c26cb","observation_id":"7e80cdd0-7a0d-4a06-b73c-57daa70636ec","resolution":{"observed_at":"2026-08-06T23:59:57.453507Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.13886","last_updated":"2024-10-21T18:06:58Z","snapshot_observed_at":"2026-08-12T11:02:50.464446Z","submitted_at":"2024-10-11T06:54:12Z","title":"Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.13886","snapshot_observed_at":"2026-08-06T23:59:57.578866Z","title":"R., Chang, E., Robinson, V ., Hendryx, S., Zhou, S., Fredrik- son, M., et al","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.578866Z"},"links":{"cited_paper":"/paper/2410.13886","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:5e94daa1c43c247697a6a492939ea12548b625a7e60db9091b1dda1995bffe6f","observation_id":"7ab7792c-e789-4154-a3b6-519601f1212d","resolution":{"observed_at":"2026-08-06T23:59:57.578866Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00820","last_updated":"2024-10-28T17:05:10Z","snapshot_observed_at":"2026-08-08T14:45:39.949674Z","submitted_at":"2024-10-28T17:05:10Z","title":"AutoGLM: Autonomous Foundation Agents for GUIs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00820","snapshot_observed_at":"2026-08-06T23:59:57.655062Z","title":"L., Sun, J., Wang, J., et al","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.655062Z"},"links":{"cited_paper":"/paper/2411.00820","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:79cf9135848cc8766524179ac3e71caf4a4e6ffa58757847ad0992b486ca8f2c","observation_id":"22a7d239-5c65-481a-ae70-947d5b649241","resolution":{"observed_at":"2026-08-06T23:59:57.655062Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T00:00:00.552864Z","title":"Accessed: 2025- 05-21","venue":null,"work_id":"6b2dfd31-b9d5-439b-a19b-d52b9e4285ef","year":2025},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.753830Z"},"links":{"citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:9a9589961bff40e4b13766929a561476a702a3b7eabd3094ed11a95f47d1fe75","observation_id":"c400cb14-701a-429e-8ef4-b3292688f52d","resolution":{"observed_at":"2026-08-07T00:00:00.657809Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-07T00:00:00.341247Z","title":"Nagli, G","venue":null,"work_id":"c642bccf-060b-4321-aa7f-7d22485c22fa","year":2025},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.843937Z"},"links":{"citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:40567eb9b3a305a4caff941bea40cca23c6ce0425763a2f134cb63eed0626eb0","observation_id":"d3b431d1-5f74-4b7d-b0a5-47b2ff5c9453","resolution":{"observed_at":"2026-08-07T00:00:00.419469Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-12T06:34:41.77262+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.16950","last_updated":"2024-10-22T12:24:41Z","snapshot_observed_at":"2026-08-11T22:23:38.514950Z","submitted_at":"2024-10-22T12:24:41Z","title":"Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.16950","snapshot_observed_at":"2026-08-06T23:59:57.968116Z","title":"Accessed: 2025-05-19","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.968116Z"},"links":{"cited_paper":"/paper/2410.16950","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:b00aadae17824d89d84d66b1e9df2a60f934f795a051b24605ec30e09e64eb01","observation_id":"0f711ea3-6b3e-41cf-8876-56db82a3083e","resolution":{"observed_at":"2026-08-06T23:59:57.968116Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.16248","last_updated":"2025-07-09T01:38:20Z","snapshot_observed_at":"2026-08-07T16:48:50.288627Z","submitted_at":"2025-03-20T15:44:31Z","title":"Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.16248","snapshot_observed_at":"2026-08-06T23:59:58.046495Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.046495Z"},"links":{"cited_paper":"/paper/2503.16248","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:66e8d6b035c079dca37fa99734a2aeee6dc06397ebc5ee074a49117dd08e17f6","observation_id":"97c31c83-b164-4164-8d32-1c6d4c0dcd73","resolution":{"observed_at":"2026-08-06T23:59:58.046495Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.07199","last_updated":"2024-08-13T20:52:13Z","snapshot_observed_at":"2026-08-01T22:07:45.419539Z","submitted_at":"2024-08-13T20:52:13Z","title":"Agent Q: Advanced Reasoning and Learning for Autonomous AI Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.07199","snapshot_observed_at":"2026-08-06T23:59:58.150222Z","title":"Agent q: Advanced reasoning and learning for autonomous ai agents.arXiv preprint arXiv:2408.07199,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.150222Z"},"links":{"cited_paper":"/paper/2408.07199","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:cc42f6eab9db83a05c3e20a82db76c73a91a9eefaa270f78e82e3c9ea1af5562","observation_id":"c560ef41-3caf-492b-8d59-6ee5f40b70d6","resolution":{"observed_at":"2026-08-06T23:59:58.150222Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.10741","last_updated":"2024-09-16T21:18:39Z","snapshot_observed_at":"2026-08-11T12:44:23.837317Z","submitted_at":"2024-09-16T21:18:39Z","title":"NaviQAte: Functionality-Guided Web Application Navigation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.10741","snapshot_observed_at":"2026-08-06T23:59:58.207154Z","title":"Shahbandeh, M., Alian, P., Nashid, N., and Mesbah, A","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.207154Z"},"links":{"cited_paper":"/paper/2409.10741","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:d4132e777d708aa326a255dc903ba8962412cba0053f06516c1d7111298384f5","observation_id":"854fd232-5147-4956-813f-04f42650ce18","resolution":{"observed_at":"2026-08-06T23:59:58.207154Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.15004","last_updated":"2024-12-05T02:00:07Z","snapshot_observed_at":"2026-08-05T16:22:08.749834Z","submitted_at":"2024-11-22T15:26:23Z","title":"ScribeAgent: Towards Specialized Web Agents Using Production-Scale Workflow Data","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.15004","snapshot_observed_at":"2026-08-06T23:59:58.320838Z","title":"Scribeagent: Towards specialized web agents using production-scale workflow data.arXiv preprint arXiv:2411.15004,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.320838Z"},"links":{"cited_paper":"/paper/2411.15004","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:b16df860ce904995413f6e8fa653a2afc188fd468d34a1cad44f838072f92d15","observation_id":"e5eb8fc5-f132-4016-a889-12123a376cd2","resolution":{"observed_at":"2026-08-06T23:59:58.320838Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.10893","last_updated":"2025-01-18T22:34:41Z","snapshot_observed_at":"2026-08-10T22:27:08.878421Z","submitted_at":"2025-01-18T22:34:41Z","title":"Learn-by-interact: A Data-Centric Framework for Self-Adaptive Agents in Realistic Environments","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.10893","snapshot_observed_at":"2026-08-06T23:59:58.476318Z","title":"Su, H., Sun, R., Yoon, J., Yin, P., Yu, T., and Arık, S","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.476318Z"},"links":{"cited_paper":"/paper/2501.10893","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:537421dda7ae40f4f730b8da40bfc3b129902c6d4089c80ac1c8691c431808ae","observation_id":"ccae596f-1585-4b59-8a4e-918da8565249","resolution":{"observed_at":"2026-08-06T23:59:58.476318Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2309.02427","last_updated":"2024-03-15T15:44:11Z","snapshot_observed_at":"2026-08-12T12:49:52.874568Z","submitted_at":"2023-09-05T17:56:20Z","title":"Cognitive Architectures for Language Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2309.02427","snapshot_observed_at":"2026-08-06T23:59:58.569340Z","title":"R., Yao, S., Narasimhan, K., and Griffiths, T","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.569340Z"},"links":{"cited_paper":"/paper/2309.02427","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:a67947f42bc2ab256144a516ed6ff93d591675b6a4615b27fdbcd010a6498a84","observation_id":"9a6b55bd-94b3-4536-acde-883b10d6bc7e","resolution":{"observed_at":"2026-08-06T23:59:58.569340Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.16741","last_updated":"2025-04-18T18:14:31Z","snapshot_observed_at":"2026-08-02T14:58:44.167588Z","submitted_at":"2024-07-23T17:50:43Z","title":"OpenHands: An Open Platform for AI Software Developers as Generalist Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.16741","snapshot_observed_at":"2026-08-06T23:59:58.681501Z","title":"F., Tang, X., Zhuge, M., Pan, J., Song, Y ., Li, B., Singh, J., et al","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.681501Z"},"links":{"cited_paper":"/paper/2407.16741","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:3449278a93137b1f3909ef144318b85fdd6ef601ddc6b56328238567b88eab22","observation_id":"2248a23a-f81a-4310-9ea8-e2998a16f579","resolution":{"observed_at":"2026-08-06T23:59:58.681501Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.12814","last_updated":"2025-02-04T20:02:17Z","snapshot_observed_at":"2026-08-08T10:00:10.515051Z","submitted_at":"2024-06-18T17:32:48Z","title":"Dissecting Adversarial Robustness of Multimodal LM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.12814","snapshot_observed_at":"2026-08-06T23:59:58.834733Z","title":"H., Koh, J","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.834733Z"},"links":{"cited_paper":"/paper/2406.12814","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:44b66a41a12cbf47961ea70ccb5872272bd6a6a6566c64018c4ae6c4f6a83bda","observation_id":"8d6ba60c-0766-45ab-b2ca-771efd58fc12","resolution":{"observed_at":"2026-08-06T23:59:58.834733Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.24370","last_updated":"2025-05-21T17:51:27Z","snapshot_observed_at":"2026-08-07T16:20:08.878901Z","submitted_at":"2025-03-31T17:50:13Z","title":"Effectively Controlling Reasoning Models through Thinking Intervention","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.24370","snapshot_observed_at":"2026-08-06T23:59:58.885764Z","title":"T., and Mittal, P","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:58.885764Z"},"links":{"cited_paper":"/paper/2503.24370","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:8b0b3ef1bbc1b925cb7e4a9a7444d596ffa324eca29925f5413bb764d1b5a1e0","observation_id":"2744fd10-c728-4929-859f-1aba7df71045","resolution":{"observed_at":"2026-08-06T23:59:58.885764Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.13825","last_updated":"2025-05-24T03:55:22Z","snapshot_observed_at":"2026-08-04T16:18:16.404587Z","submitted_at":"2024-10-17T17:50:38Z","title":"AgentOccam: A Simple Yet Strong Baseline for LLM-Based Web Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.13825","snapshot_observed_at":"2026-08-06T23:59:59.024265Z","title":"Agentoccam: A sim- ple yet strong baseline for llm-based web agents.arXiv preprint arXiv:2410.13825,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:59.024265Z"},"links":{"cited_paper":"/paper/2410.13825","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:bed246c0844b571150e221a4794c4002e36cf811edb4b0521928c6891f9829b1","observation_id":"62995c05-718c-492e-b6f1-297d1fe614b3","resolution":{"observed_at":"2026-08-06T23:59:59.024265Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.14197","last_updated":"2025-01-27T08:51:16Z","snapshot_observed_at":"2026-08-11T04:13:43.714152Z","submitted_at":"2023-12-21T01:08:39Z","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.14197","snapshot_observed_at":"2026-08-06T23:59:59.158675Z","title":"Benchmarking and defending against indirect prompt injection attacks on large language models.arXiv preprint arXiv:2312.14197,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:59.158675Z"},"links":{"cited_paper":"/paper/2312.14197","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:c99b7f82e1aee0a6226b9ba914148da5e4429f996e3518113d96731aa12c8353","observation_id":"3acf0b93-0149-488e-824d-e8f5aa16dca9","resolution":{"observed_at":"2026-08-06T23:59:59.158675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-08-06T23:59:59.304589Z","title":"Injeca- gent: Benchmarking indirect prompt injections in tool- integrated large language model agents.arXiv preprint arXiv:2403.02691,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:59.304589Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:b562b86df86dd0154e266cb0ee1d828686050c269d7051f9bddda69f091d9f19","observation_id":"c888e957-68cf-4710-acc6-12e5f1948611","resolution":{"observed_at":"2026-08-06T23:59:59.304589Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.01614","last_updated":"2024-03-12T23:14:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-01-03T08:33:09Z","title":"GPT-4V(ision) is a Generalist Web Agent, if Grounded","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.01614","snapshot_observed_at":"2026-08-06T23:59:59.384340Z","title":"Gpt-4v (ision) is a generalist web agent, if grounded.arXiv preprint arXiv:2401.01614,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:59.384340Z"},"links":{"cited_paper":"/paper/2401.01614","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:f1ca08bef3c195cfa01f7a74653fe8fb7628a866f9540b4f0b7f7bfbfdaf0936","observation_id":"d51fba25-3e83-422d-a8e8-dd541d5accef","resolution":{"observed_at":"2026-08-06T23:59:59.384340Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-11T03:37:22.279261Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-06T23:59:56.849987Z","title":"Struq: De- fending against prompt injection with structured queries","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":2022,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:56.849987Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:ffba4cd7f5a5246c2b3913580fe440b7a70e4026052ed4a6379f2962929bbec3","observation_id":"1dcae755-f2e7-4186-a403-9fce4adccbfa","resolution":{"observed_at":"2026-08-06T23:59:56.849987Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.13919","last_updated":"2024-06-06T18:37:34Z","snapshot_observed_at":"2026-08-09T21:47:22.232349Z","submitted_at":"2024-01-25T03:33:18Z","title":"WebVoyager: Building an End-to-End Web Agent with Large Multimodal Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.13919","snapshot_observed_at":"2026-08-06T23:59:57.316081Z","title":"Webvoyager: Building an end-to-end web agent with large multimodal models.arXiv preprint arXiv:2401.13919,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":2023,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:57.316081Z"},"links":{"cited_paper":"/paper/2401.13919","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:cf5ae83e37554d4d0a7b587d3bc128a94eb563a36913355aa2d9609e629d649b","observation_id":"dee9f153-8a10-4e6f-ad5b-794bda4ddd19","resolution":{"observed_at":"2026-08-06T23:59:57.316081Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2204.05862","last_updated":"2022-04-12T15:02:38Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-04-12T15:02:38Z","title":"Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedback","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2204.05862","snapshot_observed_at":"2026-08-06T23:59:56.775981Z","title":"Bai, Y ., Jones, A., Ndousse, K., Askell, A., Chen, A., Das- Sarma, N., Drain, D., Fort, S., Ganguli, D., Henighan, T., et al","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:56.775981Z"},"links":{"cited_paper":"/paper/2204.05862","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:10cc7340c0038ee284d151422e2815cddc01fdfbd695cc79dd5cb99fcb5c8146","observation_id":"2a2103e8-0b56-46a2-9c61-afed381238ed","resolution":{"observed_at":"2026-08-06T23:59:56.775981Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-06T23:59:56.937292Z","title":"Agentdojo: A dynamic en- vironment to evaluate attacks and defenses for llm agents","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory","version":1},"reference_index":2025,"source":"pdf_text","source_observed_at":"2026-08-06T23:59:56.937292Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2506.17318"},"observation_digest":"sha256:531501ede04197e9767b2670ce2f1249013e5e2d7cc5eb9bf5358acdd64a5e86","observation_id":"0235cebc-d9cf-42b2-84c8-6fa715484961","resolution":{"observed_at":"2026-08-06T23:59:56.937292Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2506.17318","last_updated":"2025-06-18T14:29:02Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-06T23:52:05.545407Z","submitted_at":"2025-06-18T14:29:02Z","title":"Context manipulation attacks : Web agents are susceptible to corrupted memory"},"reference_resolution":{"displayed":27,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":25,"verified_exact":0,"verified_fuzzy":2},"total_outbound_references":27},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-12T06:34:41.77262+00:00","source":"crossref"},{"observed_at":"2026-08-12T06:34:36.333875+00:00","source":"retraction_watch"}],"thesis":"As of 12 August 2026, this Paper Citation Record lists 27 of 27 outbound references and 6 inbound Pith citation observations for arXiv:2506.17318."}