{"as_of":"2026-08-14T23:13:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:660a16484de81722206113fab1d9970e1d09900f47d255119d4d497b58f2514a","coverage":[{"denominator":49,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":49,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T05:09:40.020584Z","state":"measured"},{"denominator":60,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":60,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-14T06:32:32.682623+00:00","state":"measured"},{"denominator":11,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":11,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-04T08:06:16.098981Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":1,"source":"pith","source_observed_at":"2026-08-05T02:28:24.338817Z","state":"measured"}],"external_citation_measurements":[{"count":0,"observed_at":"2026-08-05T02:28:24.338817Z","source":"pith"}],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":"2509.05755","doi":"10.48550/arxiv.2509.05755","metadata_source":"pith","pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment","venue":"cs.CR","work_id":"a4731da9-0223-47b1-a697-e45bf22632b5","year":2025},"citing_paper":{"arxiv_id":"2509.06572","last_updated":"2026-05-01T11:41:26Z","snapshot_observed_at":"2026-07-06T22:25:48.473217Z","submitted_at":"2025-09-08T11:35:32Z","title":"Parasites in the Toolchain: A Large-Scale Analysis of Attacks on the MCP Ecosystem","version":5},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-18T18:43:35.072919Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2509.06572"},"observation_digest":"sha256:886732007c3a04bb26b962e2f30eca90fb7c97ec0a437fceec90daa79b048dc6","observation_id":"9d74020d-4276-44f4-972a-d140ebd224d1","resolution":{"observed_at":"2026-06-30T02:16:09.705257Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-04T08:06:16.098981Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment.arXiv preprint arXiv:2509.05755, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2510.22963","last_updated":"2026-06-19T20:25:06Z","snapshot_observed_at":"2026-08-14T17:16:52.193930Z","submitted_at":"2025-10-27T03:37:41Z","title":"When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents","version":4},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-04T08:06:16.098981Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2510.22963"},"observation_digest":"sha256:51eab3885741e8eacb82a4582d58b79c41b35348b86698399d2e9f69faf4caed","observation_id":"b2f37388-ce84-46df-a93e-5317fdf8e087","resolution":{"observed_at":"2026-08-04T08:06:16.098981Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-03T06:18:06.545883Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2601.23132","last_updated":"2026-06-24T01:36:51Z","snapshot_observed_at":"2026-08-13T08:32:28.555855Z","submitted_at":"2026-01-30T16:22:21Z","title":"Verifiable Manifest Signing and Transparency Enforcement for Secure MCP-Based LLM Pipelines","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-03T06:18:06.545883Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2601.23132"},"observation_digest":"sha256:a44bfff74fc762fdf8b0f85d2dd25bb833732a75f6e5db163bbdb78b79592922","observation_id":"647942dc-86f7-4c34-b8d2-3c4975cffa7d","resolution":{"observed_at":"2026-08-03T06:18:06.545883Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":"2509.05755","doi":"10.48550/arxiv.2509.05755","metadata_source":"pith","pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment","venue":"cs.CR","work_id":"a4731da9-0223-47b1-a697-e45bf22632b5","year":2025},"citing_paper":{"arxiv_id":"2603.09002","last_updated":"2026-04-26T14:13:48Z","snapshot_observed_at":"2026-08-14T21:45:56.224919Z","submitted_at":"2026-03-09T22:46:27Z","title":"Security Considerations for Multi-agent Systems","version":2},"reference_index":279,"source":"pdf_text","source_observed_at":"2026-05-15T14:12:14.160789Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2603.09002"},"observation_digest":"sha256:3ce3cc0b0c04dd03c6f885055d9c412fa136e09bdaa4a9f4d138880241b5828d","observation_id":"aaad7391-b404-488a-bdc8-97f7d54d5713","resolution":{"observed_at":"2026-06-30T02:16:09.705257Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":"2509.05755","doi":"10.48550/arxiv.2509.05755","metadata_source":"pith","pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment","venue":"cs.CR","work_id":"a4731da9-0223-47b1-a697-e45bf22632b5","year":2025},"citing_paper":{"arxiv_id":"2605.02187","last_updated":"2026-07-22T08:25:06Z","snapshot_observed_at":"2026-08-11T08:50:00.509790Z","submitted_at":"2026-05-04T03:35:17Z","title":"Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-08T18:42:06.418583Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2605.02187"},"observation_digest":"sha256:e917713be2567cdd6029f80981e793db4f71d92d933c571f327e7be82b231996","observation_id":"ca03258d-9fd1-4e78-b649-060698daa6bc","resolution":{"observed_at":"2026-06-30T02:16:09.705257Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-02T15:04:20.284238Z","title":"Red-teaming coding agents from a tool-invocation perspective: An empirical security assessment.arXiv preprint arXiv:2509.05755, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2605.02187","last_updated":"2026-07-22T08:25:06Z","snapshot_observed_at":"2026-08-11T08:50:00.509790Z","submitted_at":"2026-05-04T03:35:17Z","title":"Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agents","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-02T15:04:20.284238Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2605.02187"},"observation_digest":"sha256:352687c9b363dbe114ae455c36c5c91d596e163edc3f2fb7129f8cdd20f245cd","observation_id":"ae2b9919-6ccc-4980-96d2-63039ece1e71","resolution":{"observed_at":"2026-08-02T15:04:20.284238Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":"2509.05755","doi":"10.48550/arxiv.2509.05755","metadata_source":"pith","pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment","venue":"cs.CR","work_id":"a4731da9-0223-47b1-a697-e45bf22632b5","year":2025},"citing_paper":{"arxiv_id":"2605.24069","last_updated":"2026-05-22T08:34:48Z","snapshot_observed_at":"2026-08-13T19:52:37.854755Z","submitted_at":"2026-05-22T08:34:48Z","title":"When the Manual Lies: A Realistic Benchmark to Evaluate MCP Poisoning Attacks for LLM Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-06-30T16:22:23.857438Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2605.24069"},"observation_digest":"sha256:affc67d9c77d1f8b94869daf4e462c3dc68b0bda548bac377e5058cdc5db6def","observation_id":"e3a483f2-a692-4cf3-af23-03f439f78a3d","resolution":{"observed_at":"2026-06-30T16:24:55.067215Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":"2509.05755","doi":"10.48550/arxiv.2509.05755","metadata_source":"pith","pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment","venue":"cs.CR","work_id":"a4731da9-0223-47b1-a697-e45bf22632b5","year":2025},"citing_paper":{"arxiv_id":"2606.10749","last_updated":"2026-06-09T12:01:07Z","snapshot_observed_at":"2026-08-14T19:50:49.492797Z","submitted_at":"2026-06-09T12:01:07Z","title":"Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation","version":1},"reference_index":208,"source":"pdf_text","source_observed_at":"2026-06-27T12:55:22.831264Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2606.10749"},"observation_digest":"sha256:0e18dbe24941d18a7bb8096d39875b17cf918837b6518e0d45639f14ddc4c7b0","observation_id":"eef9bcc5-a2fe-485b-ab8c-85086b0598ad","resolution":{"observed_at":"2026-06-30T02:16:09.705257Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":"2509.05755","doi":"10.48550/arxiv.2509.05755","metadata_source":"pith","pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment","venue":"cs.CR","work_id":"a4731da9-0223-47b1-a697-e45bf22632b5","year":2025},"citing_paper":{"arxiv_id":"2606.12231","last_updated":"2026-06-10T15:39:47Z","snapshot_observed_at":"2026-08-10T05:55:18.931577Z","submitted_at":"2026-06-10T15:39:47Z","title":"Rule Taxonomy and Evolution in AI IDEs: A Mining and Survey Study","version":1},"reference_index":100,"source":"pdf_text","source_observed_at":"2026-06-27T09:06:12.868791Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2606.12231"},"observation_digest":"sha256:405aef51ae1f683fd338f7b88858968ab7ae12ddfa1939cdf00fd11aa9c680dd","observation_id":"09dc7c45-d270-4e7a-aa73-62ff2e95d091","resolution":{"observed_at":"2026-07-03T12:08:07.100919Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":"2509.05755","doi":"10.48550/arxiv.2509.05755","metadata_source":"pith","pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"On the security of tool-invocation prompts for llm-based agentic systems: An empirical risk assessment","venue":"cs.CR","work_id":"a4731da9-0223-47b1-a697-e45bf22632b5","year":2025},"citing_paper":{"arxiv_id":"2606.27027","last_updated":"2026-06-25T13:35:28Z","snapshot_observed_at":"2026-08-13T15:40:00.166221Z","submitted_at":"2026-06-25T13:35:28Z","title":"ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-06-26T04:07:14.506108Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2606.27027"},"observation_digest":"sha256:3c6fb9ad79bf2b6ad91c5833cc34f21e9918385ae3149b2b5f27ee6d329cf2e9","observation_id":"71ce2c75-eb1f-4265-a68f-6b6c27a541bd","resolution":{"observed_at":"2026-07-04T14:19:54.256550Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.05755","snapshot_observed_at":"2026-07-30T17:25:46.962117Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.23624","last_updated":"2026-07-29T14:49:58Z","snapshot_observed_at":"2026-08-14T14:56:12.041809Z","submitted_at":"2026-07-26T12:15:09Z","title":"Where Is the Cost of Third-Party API Routers in Agentic Software Development?","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-30T17:25:46.962117Z"},"links":{"cited_paper":"/paper/2509.05755","citing_paper":"/paper/2607.23624"},"observation_digest":"sha256:c357469eb41610c066bb26ce23b6d539e27dd2020c5ab5cd53a68991de5ccb0f","observation_id":"0c219119-2ba5-4ca1-8932-b9a863d5a04d","resolution":{"observed_at":"2026-07-30T17:25:46.962117Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2509.05755/citation-record","integrity":"/paper/2509.05755/integrity","json":"/paper/2509.05755/citation-record.json","paper":"/paper/2509.05755"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.524928Z","title":"https://jfrog.com/blog/p rompt-injection-attack-code-execution-in-vanna-ai-cve-2024-5565/, 2024","venue":null,"work_id":"74ed5bdc-7937-4ec1-b931-48392403ae08","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.717409Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:3679d829d3bf4416d0aab2be55e67e6c45fac90e5c55d00b2177e8727e7c9fd3","observation_id":"e9995044-7870-47d3-81cc-d43ac03c5082","resolution":{"observed_at":"2026-08-05T05:09:41.530979Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.505380Z","title":"https://thehackernews.com/2024 /06/prompt-injection-flaw-in-vanna-ai.html, 2024","venue":null,"work_id":"d59c698b-78eb-4de8-bf84-60c56381109d","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.724902Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:b595cfb53ebcc82eedf65b35cc18a35c78dbc1883c33b73d52c4ba4bcdc7fe34","observation_id":"908d4b2e-401b-408b-ac44-14ea48069655","resolution":{"observed_at":"2026-08-05T05:09:41.511326Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.478963Z","title":"https://www.cherry-ai.com/, 2025","venue":null,"work_id":"b0bb08f9-f9d2-4b44-bf58-2b3d5f7cf61a","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.731021Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:482f9e3f0a7574cb4b9e0c36c5df01ff6ed1d8d6a8b67b34a78fd4a4f8bc0429","observation_id":"97061c38-caf8-4dd3-952b-00931101f7fe","resolution":{"observed_at":"2026-08-05T05:09:41.485868Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.447866Z","title":"https://docs.anthropic.com/en/docs/claude-code/overview , 2025","venue":null,"work_id":"8efc2991-2d51-45af-b4fb-197191fc8ee2","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.737081Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:242c4c9f1b073d99af03bd762a6f5f10edf8b0e032410b5957410f018c0f27d1","observation_id":"62abf537-44cd-430f-976e-e005c318ed76","resolution":{"observed_at":"2026-08-05T05:09:41.456265Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.423157Z","title":"https://docs.github.com/en/copil ot/using-github-copilot/copilot-chat, 2025","venue":null,"work_id":"76f2b9e3-b1b1-4638-957d-250fb00cb862","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.743955Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:37ca7bba760a96db467b8997533c2604489bce684a4a55790129d068359fd4e7","observation_id":"cd49c8f8-9c8d-4051-9592-a3964d41fb86","resolution":{"observed_at":"2026-08-05T05:09:41.428727Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.392858Z","title":"https://owasp.org/www-proje ct-top-10-for-large-language-model-applications/, 2025","venue":null,"work_id":"1994729f-1b5a-4478-ac3b-81f19d97c5e4","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.749409Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:1805a99eac1eb50da85708ec9e2b5fde9f2c6a011d29b97978b566c7350096c3","observation_id":"ad5068f1-0cd3-4a4d-ab91-481c6f494f4e","resolution":{"observed_at":"2026-08-05T05:09:41.400243Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.369006Z","title":"Accessed 2025-08-26","venue":null,"work_id":"d592822a-3e00-482a-b7c8-c38aee9873a6","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.755742Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:34863ded552e02766e77741935f4386fa6b009bf66235a8ed7a74b2cc9fc172d","observation_id":"3588386c-dd77-41c4-8838-5966f11ef3dd","resolution":{"observed_at":"2026-08-05T05:09:41.375616Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.345497Z","title":"Accessed 2025-08-26","venue":null,"work_id":"99a574f3-83e7-4bcc-b9eb-047ec5f7ddae","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.762358Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:af5618306a0e8722478d656ac56be55b1bf91a91022a7569b7e753881b844470","observation_id":"28026c98-05e1-415c-81ca-2b32d8c036a9","resolution":{"observed_at":"2026-08-05T05:09:41.352428Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.321008Z","title":"Anthropic tool use and function calling","venue":null,"work_id":"a86ffaf1-e7d1-459b-9289-701dcd522810","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.768821Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:19d624d5cf35d5dab2e24e1b2db19ce52c68096224d6337655bef9348dae95c2","observation_id":"89f1ba3c-72ac-4fc3-b6d0-8f58e83df1ea","resolution":{"observed_at":"2026-08-05T05:09:41.327200Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.297562Z","title":"Model context protocol.https://docs.anthropic.com/docs/mcp/, 2024","venue":null,"work_id":"87eaf166-3bd7-49c7-bc14-a5b8d338f4c5","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.776491Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:bfdb13054df8c30a23640a07dc5f037113231e242e1877acfe9ba8f6ada26ee5","observation_id":"9a0f2e10-81c2-45a2-83b3-573ddea70a5e","resolution":{"observed_at":"2026-08-05T05:09:41.305113Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02817","last_updated":"2025-01-30T11:11:37Z","snapshot_observed_at":"2026-08-13T04:03:13.579574Z","submitted_at":"2024-03-05T09:37:13Z","title":"Here Comes The AI Worm: Unleashing Zero-click Worms that Target GenAI-Powered Applications","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02817","snapshot_observed_at":"2026-08-05T05:09:39.782564Z","title":"Here comes the ai worm: Unleashing zero-click worms that target genai-powered applications.arXiv preprint arXiv:2403.02817, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.782564Z"},"links":{"cited_paper":"/paper/2403.02817","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:847c2a7173a6316c2dd2fa3e8ea0766eff5f98807f646564f2c09db9a8d1add9","observation_id":"c9179a97-7fa6-44f1-8062-1426bbf4cf12","resolution":{"observed_at":"2026-08-05T05:09:39.782564Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.271129Z","title":"Accessed 2025-08-26","venue":null,"work_id":"abcc866b-d4a3-439d-97e2-cfdd9c327091","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.789182Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:bad98eaf5e253a070983cf03deca8385e625206059ff9b56c767a9941e78d020","observation_id":"407c5235-9481-478b-9021-979d2501ae22","resolution":{"observed_at":"2026-08-05T05:09:41.278728Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.250450Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents.Advances in Neural Information Processing Systems, 37:82895–82920, 2024","venue":null,"work_id":"75162e2e-fbea-4da1-abfa-cfb3f03e6ad0","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.795361Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:6f7ee69d90d4e6eab25974c381b3e0eab61d7b943cf9c9e1d53352b292f98f03","observation_id":"07079539-cf03-4ffe-a02d-24f475836e0e","resolution":{"observed_at":"2026-08-05T05:09:41.256452Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.21783","last_updated":"2024-11-23T23:27:33Z","snapshot_observed_at":"2026-08-13T17:20:44.002518Z","submitted_at":"2024-07-31T17:54:27Z","title":"The Llama 3 Herd of Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.21783","snapshot_observed_at":"2026-08-05T05:09:39.800933Z","title":"The llama 3 herd of models.arXiv preprints arXiv:2407.21783, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.800933Z"},"links":{"cited_paper":"/paper/2407.21783","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:e2568a5eb48535934714d53f2c39f94157ecca3b4532693b85b96fc5a408a91f","observation_id":"f3762e53-3c9e-461c-a296-2888f147cbac","resolution":{"observed_at":"2026-08-05T05:09:39.800933Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.04560","last_updated":"2024-08-08T16:18:39Z","snapshot_observed_at":"2026-08-12T23:06:27.908274Z","submitted_at":"2024-08-08T16:18:39Z","title":"Conversational Prompt Engineering","version":1},"cited_work":{"arxiv_id":"2408.04560","doi":null,"metadata_source":"pith","pith_arxiv_id":"2408.04560","snapshot_observed_at":"2026-08-05T05:09:40.770543Z","title":"Conversational Prompt Engineering","venue":"cs.CL","work_id":"9bd83fb3-d2b9-468c-8757-d27ef8e5a600","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.806899Z"},"links":{"cited_paper":"/paper/2408.04560","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:d13460f85418bf05fdcc0cfa06a25bc4e48b64b5e486ae05c0ed221e6637492c","observation_id":"2a3bf3fe-ac71-45a1-bfe0-02f925a4b86e","resolution":{"observed_at":"2026-08-05T05:09:40.777379Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.18575","last_updated":"2025-05-16T22:42:29Z","snapshot_observed_at":"2026-08-10T18:17:57.457186Z","submitted_at":"2025-04-22T17:51:03Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.18575","snapshot_observed_at":"2026-08-05T05:09:39.813876Z","title":"Wasp: Benchmarking web agent security against prompt injection attacks.arXiv preprint arXiv:2504.18575, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.813876Z"},"links":{"cited_paper":"/paper/2504.18575","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:1013dfc12f5fd7c2a0dac3b8d266a8b82031cffd678f960d83e9abbee8ebf542","observation_id":"0e8dfd11-281a-4c09-91c8-f6ef868ce623","resolution":{"observed_at":"2026-08-05T05:09:39.813876Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14837","last_updated":"2024-02-18T23:03:56Z","snapshot_observed_at":"2026-08-13T04:15:53.595337Z","submitted_at":"2024-02-18T23:03:56Z","title":"An Empirical Categorization of Prompting Techniques for Large Language Models: A Practitioner's Guide","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14837","snapshot_observed_at":"2026-08-05T05:09:39.820844Z","title":"An empirical categorization of prompting techniques for large language models: A practitioner’s guide.arXiv preprint arXiv:2402.14837, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.820844Z"},"links":{"cited_paper":"/paper/2402.14837","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:d919a1b0082a662641471b1dc123597df61b3ec1fcaa685f0ed8fdd8a51329be","observation_id":"ef92fb38-1d05-47b3-8b4d-4afed1b45398","resolution":{"observed_at":"2026-08-05T05:09:39.820844Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.224367Z","title":"What is prompt engineering? https://cloud.google.com/discover/what-is-promp t-engineering?hl=en#what-is-prompt-engineering, 2025","venue":null,"work_id":"9378bd97-91a8-4131-ac46-ba07b2107355","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.828635Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:f7fa22022031bf6d423dce977206202633728aa8c796ab71ab8344d481162d19","observation_id":"d868d79c-af93-469e-887d-e8428f51f636","resolution":{"observed_at":"2026-08-05T05:09:41.232493Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:39.835452Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.835452Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:e89869791d1dc49977f83aca2d339020e3f04c7c80d7309fbeae19b75dfe6ee6","observation_id":"b4656a5e-5286-4acb-a1d8-2dd5e5a89746","resolution":{"observed_at":"2026-08-05T05:09:39.835452Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-08-14T15:42:19.849118Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-05T05:09:39.841874Z","title":"Llama guard: Llm-based input-output safeguard for human-ai conversations.arXiv preprint arXiv:2312.06674, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.841874Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:0998fefe566e0cb15ba89f99b1bef3a7e7793f82c10ddea318ec2e5e81891476","observation_id":"a43c34b6-1182-4430-99b8-28e4822e7418","resolution":{"observed_at":"2026-08-05T05:09:39.841874Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.187417Z","title":"Promptshield: Deploy- able detection for prompt injection attacks","venue":null,"work_id":"1899556d-fdab-4af3-a621-b202ba46c40a","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.848575Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:7b612f3f41c2963ec86685526a495de314f60322b190fcbda9fd6c817e0ff320","observation_id":"85e9ee6f-d778-4a05-a24d-147cab8a50b9","resolution":{"observed_at":"2026-08-05T05:09:41.193369Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.167175Z","title":"Kpmg ai quarterly pulse survey: From agent experimentation to rapid scale and deployment","venue":null,"work_id":"b725c3e4-e2b7-464a-a276-d88e04d39f21","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.855633Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:9d202ba884abee62e47ed47fbf6cc2b976737fac0ff89de64b4e476467ec23ba","observation_id":"27b5fa44-5b19-4017-9c30-566884e56539","resolution":{"observed_at":"2026-08-05T05:09:41.172873Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.143718Z","title":"How to use chat models to call tools","venue":null,"work_id":"e704ea27-49ca-44da-ab35-7f9a4355bf81","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.861201Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:2b537847486ab329a58b4de86fb9137b25913d53093e10b5615b2a7f271a6622","observation_id":"a3a3005c-09d3-4bc1-ac61-76dc3459c4f4","resolution":{"observed_at":"2026-08-05T05:09:41.150660Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.11295","last_updated":"2025-03-12T20:54:00Z","snapshot_observed_at":"2026-08-13T14:04:19.412614Z","submitted_at":"2024-09-17T15:49:44Z","title":"EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.11295","snapshot_observed_at":"2026-08-05T05:09:39.868193Z","title":"Eia: Environmental injection attack on generalist web agents for privacy leakage.arXiv:2409.11295, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.868193Z"},"links":{"cited_paper":"/paper/2409.11295","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:1e751b12a41b141a7367f56bd7e677b5066404a14f468e4f0bdf99e06189babb","observation_id":"ae5f12df-493f-4ed9-ba60-7c71131e3ff7","resolution":{"observed_at":"2026-08-05T05:09:39.868193Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.10400","last_updated":"2025-02-16T09:33:15Z","snapshot_observed_at":"2026-08-12T23:42:22.947158Z","submitted_at":"2024-06-14T20:07:11Z","title":"Self-Reflection Makes Large Language Models Safer, Less Biased, and Ideologically Neutral","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.10400","snapshot_observed_at":"2026-08-05T05:09:39.874576Z","title":"Self-reflection makes large language models safer, less biased, and ideologically neutral.arXiv preprint arXiv:2406.10400, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.874576Z"},"links":{"cited_paper":"/paper/2406.10400","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:940166beae274ba00c89e3e9d140f9e0bc857c894d63a19e74fa51eaa3a924dc","observation_id":"d7881e67-b55b-4f0a-a74f-5b1944d62543","resolution":{"observed_at":"2026-08-05T05:09:39.874576Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.120826Z","title":"Demystifying rce vulnerabilities in llm-integrated apps","venue":null,"work_id":"61cd08ef-588b-46ec-9fe5-50fe10827960","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.879992Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:c9986746a9745d3c65c38ad1e89c7f4c31fe3e1132e8f34a16f44ee7d80f634c","observation_id":"4119c212-c675-408a-81e9-0e99ba7fe945","resolution":{"observed_at":"2026-08-05T05:09:41.126476Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:39.887000Z","title":"What do you want? user-centric prompt generation for text-to-image synthesis via multi-turn guidance.arXiv preprint arXiv:2408.12910, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.887000Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:d7bce50099d2e857ac381a2758f19a1d22ef9646c1ae3d38429f01b2deac48bd","observation_id":"c568f671-1bbd-4ccd-8da4-85eea6062524","resolution":{"observed_at":"2026-08-05T05:09:39.887000Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.090145Z","title":"Formalizing and bench- marking prompt injection attacks and defenses","venue":null,"work_id":"8b0bfc6f-bae2-4cbb-b6d7-fb54f4cdfcae","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.892467Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:82c3d04c10525503db696fbc89dd28100913ff7134203433bc620097cb4f4514","observation_id":"d6f45d43-3a6d-4e11-bf11-4700c819a7f0","resolution":{"observed_at":"2026-08-05T05:09:41.098378Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.08865","last_updated":"2024-04-13T01:13:59Z","snapshot_observed_at":"2026-08-13T00:30:57.518365Z","submitted_at":"2024-04-13T01:13:59Z","title":"LLM In-Context Recall is Prompt Dependent","version":1},"cited_work":{"arxiv_id":"2404.08865","doi":null,"metadata_source":"pith","pith_arxiv_id":"2404.08865","snapshot_observed_at":"2026-08-05T05:09:40.266725Z","title":"LLM In-Context Recall is Prompt Dependent","venue":"cs.CL","work_id":"3ed6b1bd-a684-4457-acea-b19f3ee6c017","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.897444Z"},"links":{"cited_paper":"/paper/2404.08865","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:5df75853567eb5ed2962f432a90c8f3f721553e4b941d8cc413a2df2ea00e00b","observation_id":"6f1910d5-5138-4ac3-8888-c7e150c90193","resolution":{"observed_at":"2026-08-05T05:09:40.275758Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.06573","last_updated":"2023-10-19T23:45:30Z","snapshot_observed_at":"2026-08-13T12:27:00.157489Z","submitted_at":"2023-03-12T05:08:16Z","title":"Large Language Models Know Your Contextual Search Intent: A Prompting Framework for Conversational Search","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.06573","snapshot_observed_at":"2026-08-05T05:09:39.903821Z","title":"Large language models know your contextual search intent: A prompting framework for conversational search.arXiv preprint arXiv:2303.06573, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.903821Z"},"links":{"cited_paper":"/paper/2303.06573","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:64b0d8a2401dd9fa1c20e3a1ed2e0a6747c09559bcf7aa9f0f1cccb6fba06bbc","observation_id":"71f603de-062e-4ca4-a6b1-0630cb42a9d4","resolution":{"observed_at":"2026-08-05T05:09:39.903821Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.063861Z","title":"Llama-prompt-guard-2-22m","venue":null,"work_id":"8cf8aea0-9517-40de-8d26-c1d14e7d96fe","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.909568Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:b042121ebc351e2dc12dde61026097b058bcf6238cc62cff168f87dfc6671046","observation_id":"579ea73d-e38b-4363-bf91-7ade07ccf287","resolution":{"observed_at":"2026-08-05T05:09:41.073052Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.07842","last_updated":"2023-02-15T18:25:52Z","snapshot_observed_at":"2026-07-30T02:11:00.198428Z","submitted_at":"2023-02-15T18:25:52Z","title":"Augmented Language Models: a Survey","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.07842","snapshot_observed_at":"2026-08-05T05:09:39.915182Z","title":"Augmented language models: a survey.arXiv preprint arXiv:2302.07842, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.915182Z"},"links":{"cited_paper":"/paper/2302.07842","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:ad555e96ebccf55761bf161dfc5e3e149285d094b206a0b0acea46be79b13c1b","observation_id":"c5410c68-8013-4137-b1be-d3555ec15528","resolution":{"observed_at":"2026-08-05T05:09:39.915182Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.12197","last_updated":"2025-02-15T18:10:45Z","snapshot_observed_at":"2026-08-07T18:15:36.433702Z","submitted_at":"2025-02-15T18:10:45Z","title":"A Closer Look at System Prompt Robustness","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.12197","snapshot_observed_at":"2026-08-05T05:09:39.921172Z","title":"A closer look at system prompt robustness.arXiv preprint arXiv:2502.12197, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.921172Z"},"links":{"cited_paper":"/paper/2502.12197","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:16c836d8c6077873b1e6e11d6f658eac84bd47ff47baa60840844827c9f221be","observation_id":"39e175ac-9b83-4922-9ee4-5ad3e26f625a","resolution":{"observed_at":"2026-08-05T05:09:39.921172Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.038816Z","title":"Position is power: System prompts as a mechanism of bias in large language models (llms)","venue":null,"work_id":"22517aec-2bd3-4b23-b807-fcc7abfa8ce3","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.926761Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:8dd2b6d006fd58c13d1bea88bda2b2734ec0e40ef07801a85d15985c02521888","observation_id":"7b8a8328-08ce-48a9-b6d4-25206be9f2d5","resolution":{"observed_at":"2026-08-05T05:09:41.046186Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:41.019752Z","title":"What is agentic ai? https://blogs.nvidia.com/blog/what-is-agentic-ai/ , 2024","venue":null,"work_id":"453938a7-d6e0-48c7-85af-2b7b6efb5cdf","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.933155Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:853d1b65321d328f52ab0a2c26265f57d6952d47930c38d6a05c52f906dabbc9","observation_id":"51e69f08-bc38-41a7-9027-b8bb4893e81b","resolution":{"observed_at":"2026-08-05T05:09:41.025647Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:40.997558Z","title":"Function Calling with LLMs","venue":null,"work_id":"dee8dde1-576d-482e-b154-86d0382b7741","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.939751Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:980f66f8efdd48580d345a342c7127e3185ba4b93f50ca8a361b9e2c82c4191d","observation_id":"85c1f51f-3a59-46e4-8458-194e521ee7ac","resolution":{"observed_at":"2026-08-05T05:09:41.005989Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:40.978292Z","title":"Openai assistants and tool use documentation","venue":null,"work_id":"ece9aa15-7063-474e-b4c0-b65d203a8ffc","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.945109Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:44f3e260ec49fb23aabffd68c53dd36cc06634362e4020bdc7d1edb78d985e5f","observation_id":"c045c9d2-502b-4728-a01e-b20d81f1ed24","resolution":{"observed_at":"2026-08-05T05:09:40.984125Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:40.958714Z","title":"Pwc’s ai agent survey","venue":null,"work_id":"ce09cea1-c516-49d5-b3b2-8a52223c0c2d","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.950807Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:530438e44eef939cb8b607de8b6fe9d21a728516d85bf053e9bc2526dea53050","observation_id":"d8150135-e2ca-4871-9c30-2ee3b1997c5e","resolution":{"observed_at":"2026-08-05T05:09:40.964097Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:39.957253Z","title":"Tool learning with large language models: A survey.Frontiers of Computer Science, 19(8):198343, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.957253Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:44274ad1e89bfb588f85ec3bfc2575e507f411bb2f45c9a32d8e804363ce3923","observation_id":"ea544374-55c9-45f2-8a42-10ee93d2d637","resolution":{"observed_at":"2026-08-05T05:09:39.957253Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:40.926337Z","title":"Toolformer: Language models can teach themselves to use tools.Advances in Neural Information Processing Systems, 36:68539–68551, 2023","venue":null,"work_id":"5a89b3a7-e2b2-47d9-b6c0-53f0fb716375","year":2023},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.963689Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:33c14c2f117c5889e8bc256629d33f13ae73f503555e1d8a59a103935b6d5818","observation_id":"0caf3c5a-5e4a-4ec4-91c4-462359a1756b","resolution":{"observed_at":"2026-08-05T05:09:40.933641Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:40.906074Z","title":"Cline — ai coding, open source and uncompromised","venue":null,"work_id":"a6b214b0-cd2e-487a-9ec1-9c162ec83c23","year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.969422Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:f32ee288b4f697ba88615cb369ca628c7cdcab3f86a03beb432c0fc034eb688a","observation_id":"fe7e9087-75fb-4593-a0a9-62ffbe2bfc75","resolution":{"observed_at":"2026-08-05T05:09:40.911858Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.17401","last_updated":"2025-05-31T18:34:01Z","snapshot_observed_at":"2026-08-13T15:05:08.682924Z","submitted_at":"2024-10-22T20:18:26Z","title":"AdvAgent: Controllable Blackbox Red-teaming on Web Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.17401","snapshot_observed_at":"2026-08-05T05:09:39.975185Z","title":"Advweb: Controllable black-box attacks on vlm-powered web agents.arXiv preprint arXiv:2410.17401, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.975185Z"},"links":{"cited_paper":"/paper/2410.17401","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:88dbc74da224ea67a55a8a85bd157af2c5f1b79e838c5be71406c8348d4470a9","observation_id":"9c655096-f07b-42c1-b1cc-3548e9f88d27","resolution":{"observed_at":"2026-08-05T05:09:39.975185Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:39.981410Z","title":"React: Synergizing reasoning and acting in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.981410Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:adb9d9a6432878954fa9533ce47eaba78091efe009c54cc1f2f971824bb4f6dd","observation_id":"aa5368bd-9afc-4180-b2ac-059056983a7a","resolution":{"observed_at":"2026-08-05T05:09:39.981410Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.00061","last_updated":"2025-03-04T03:32:46Z","snapshot_observed_at":"2026-08-07T17:44:13.894740Z","submitted_at":"2025-02-27T04:04:50Z","title":"Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.00061","snapshot_observed_at":"2026-08-05T05:09:39.987143Z","title":"Adaptive attacks break defenses against indirect prompt injection attacks on llm agents.arXiv preprint arXiv:2503.00061, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.987143Z"},"links":{"cited_paper":"/paper/2503.00061","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:d7b0b8cbc79f1d3053bca422cfeaf20630806994b8b0fd10ebba48a6f4211b96","observation_id":"9acb4cc3-cf41-47ab-a028-ae5e1faf9068","resolution":{"observed_at":"2026-08-05T05:09:39.987143Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:40.869614Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated llm agents","venue":null,"work_id":"8aee22af-5fce-4883-9c97-9322b27ede53","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.993267Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:9560ad3cb165854415dc153a58068e2d15444eddd50c2f66a3b20a9d84d2f7ae","observation_id":"d981f5bf-91c7-408e-8196-88cd0ac27398","resolution":{"observed_at":"2026-08-05T05:09:40.876491Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.14826","last_updated":"2026-04-04T00:44:19Z","snapshot_observed_at":"2026-08-06T19:44:15.952593Z","submitted_at":"2024-10-18T18:51:44Z","title":"SPRIG: Improving Large Language Model Performance by System Prompt Optimization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.14826","snapshot_observed_at":"2026-08-05T05:09:39.998742Z","title":"Sprig: Improving large language model performance by system prompt optimization.arXiv preprint arXiv:2410.14826, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:39.998742Z"},"links":{"cited_paper":"/paper/2410.14826","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:771c02d4bb3c3050c475eb7124dc893587dc932d798ef8de92f2e784aca178bc","observation_id":"06f34892-dbc4-47f3-a2d6-a25f7954bf0a","resolution":{"observed_at":"2026-08-05T05:09:39.998742Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T05:09:40.844457Z","title":"a helpful assistant","venue":null,"work_id":"c713f384-6e15-4681-aefe-a8a62d318d8c","year":2024},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:40.007399Z"},"links":{"citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:8954c40417416f46dda1c3cb0e3034caa7dca7f014b71dc23dc2086f78699e73","observation_id":"7a67a165-bd3d-411e-82f6-82ce4ba28d9c","resolution":{"observed_at":"2026-08-05T05:09:40.850748Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-14T06:32:32.682623+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.11315","last_updated":"2023-10-23T03:25:13Z","snapshot_observed_at":"2026-08-13T12:20:31.283620Z","submitted_at":"2023-03-20T17:54:58Z","title":"Context-faithful Prompting for Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.11315","snapshot_observed_at":"2026-08-05T05:09:40.014381Z","title":"Context-faithful prompting for large language models.arXiv preprint arXiv:2303.11315, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:40.014381Z"},"links":{"cited_paper":"/paper/2303.11315","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:b2d1647bdaa8fcf6d62c91760c6bbb7dd996ddde5af469009cb370b43c36b15d","observation_id":"439ec31b-2370-422d-a5ee-527c586cfa08","resolution":{"observed_at":"2026-08-05T05:09:40.014381Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.05174","last_updated":"2025-06-10T18:13:09Z","snapshot_observed_at":"2026-08-08T19:58:38.598603Z","submitted_at":"2025-02-07T18:57:49Z","title":"MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.05174","snapshot_observed_at":"2026-08-05T05:09:40.020584Z","title":"¡” and “¿","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment","version":6},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-05T05:09:40.020584Z"},"links":{"cited_paper":"/paper/2502.05174","citing_paper":"/paper/2509.05755"},"observation_digest":"sha256:b7539b40eabff72facf91f866a9e16189a904c2c844e6e9cb71f751b2dbdd1c9","observation_id":"cf50d8e3-a96a-4a81-9b6d-0591876bad5e","resolution":{"observed_at":"2026-08-05T05:09:40.020584Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2509.05755","last_updated":"2026-06-28T05:20:23Z","latest_version":6,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-06T21:30:43.649885Z","submitted_at":"2025-09-06T15:48:49Z","title":"Red-Teaming Coding Agents from a Tool-Invocation Perspective: An Empirical Security Assessment"},"reference_resolution":{"displayed":49,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":19,"verified_exact":2,"verified_fuzzy":28},"total_outbound_references":49},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-14T06:32:32.682623+00:00","source":"crossref"},{"observed_at":"2026-08-14T06:32:18.44784+00:00","source":"retraction_watch"}],"thesis":"As of 14 August 2026, this Paper Citation Record lists 49 of 49 outbound references and 11 inbound Pith citation observations for arXiv:2509.05755."}