{"as_of":"2026-08-10T14:35:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:1b062780a0bcd553e0030ecc84354da64b4adda8747b7526d73a2566c0661aab","coverage":[{"denominator":30,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":30,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-10T00:02:35.167281Z","state":"measured"},{"denominator":32,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":32,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":2,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":2,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-13T17:08:58.831798Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"pith","source_observed_at":"2026-07-02T21:07:23.686230Z","state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.20994","snapshot_observed_at":"2026-07-13T17:08:58.831798Z","title":"Kelleher","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2605.02900","last_updated":"2026-05-24T13:33:45Z","snapshot_observed_at":"2026-08-02T11:46:07.449862Z","submitted_at":"2026-03-28T13:21:44Z","title":"Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-13T17:08:58.831798Z"},"links":{"cited_paper":"/paper/2604.20994","citing_paper":"/paper/2605.02900"},"observation_digest":"sha256:b536728797e5ccb5e8b4551dc22dc263f1565e1b037ea864bee804f7499f76af","observation_id":"41f00fa2-d1d9-4298-8c44-af22c0bb7a4b","resolution":{"observed_at":"2026-07-13T17:08:58.831798Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"cited_work":{"arxiv_id":"2604.20994","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.20994","snapshot_observed_at":"2026-07-02T21:07:23.686230Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","venue":"cs.CR","work_id":"1f139307-8f7f-4ea4-b864-69e5352f6666","year":2026},"citing_paper":{"arxiv_id":"2606.07992","last_updated":"2026-06-06T06:07:52Z","snapshot_observed_at":"2026-08-03T00:26:10.593406Z","submitted_at":"2026-06-06T06:07:52Z","title":"VATS: Exploiting Implicit Authority in Error-Path Injection via Systematic Mutation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-06-27T19:57:39.536382Z"},"links":{"cited_paper":"/paper/2604.20994","citing_paper":"/paper/2606.07992"},"observation_digest":"sha256:d14d65e20df0684cfcbc0b1068b333c9561aaa410127046a949205f6849f2576","observation_id":"963af959-715f-47af-b5c2-8fddfb2a0997","resolution":{"observed_at":"2026-07-02T21:07:23.687656Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}}],"links":{"evidence":"/evidence","html":"/paper/2604.20994/citation-record","integrity":"/paper/2604.20994/integrity","json":"/paper/2604.20994/citation-record.json","paper":"/paper/2604.20994"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2407.00121","last_updated":"2024-06-27T17:47:26Z","snapshot_observed_at":"2026-08-09T02:44:34.826126Z","submitted_at":"2024-06-27T17:47:26Z","title":"Granite-Function Calling Model: Introducing Function Calling Abilities via Multi-task Learning of Granular Tasks","version":1},"cited_work":{"arxiv_id":"2407.00121","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.00121","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OWASP Foundation","venue":null,"work_id":"edc15fce-3917-4a59-a74d-94c7880fc5d0","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.00121","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:1c97241f5b0ae4158bbe2809abea0fce53eebe08e8e24df32b3c04eb192ca886","observation_id":"e4be9763-e351-48c1-bb75-2a9280a79105","resolution":{"observed_at":"2026-05-10T00:29:47.772642Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.09024","last_updated":"2025-04-18T14:30:31Z","snapshot_observed_at":"2026-08-02T12:38:54.249632Z","submitted_at":"2024-10-11T17:39:22Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","version":3},"cited_work":{"arxiv_id":"2410.09024","doi":"10.48550/arxiv.2410.09024","metadata_source":"pith","pith_arxiv_id":"2410.09024","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents","venue":"cs.LG","work_id":"788aad10-421f-48d7-886c-792665914606","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2410.09024","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a7202dbe674413ed10125f5be4c2dd342cc41b908ea2afb771b98605a4f7348a","observation_id":"4b5adb7b-2248-4cc5-a054-bf2d1a76f191","resolution":{"observed_at":"2026-05-14T01:35:51.514012Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02153","last_updated":"2025-09-15T22:15:00Z","snapshot_observed_at":"2026-08-05T18:56:11.132981Z","submitted_at":"2025-06-02T18:35:16Z","title":"Small Language Models are the Future of Agentic AI","version":2},"cited_work":{"arxiv_id":"2506.02153","doi":"10.48550/arxiv.2506.02153","metadata_source":"pith","pith_arxiv_id":"2506.02153","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Small Language Models are the Future of Agentic AI","venue":"cs.AI","work_id":"ba0f0305-4a51-48fd-a13f-201439a18f9e","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2506.02153","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:e22bd18c38ad5ea853c50cb3ab764385b38c8c504c032ff4f72607b27325afa7","observation_id":"6c886954-712d-4542-ac42-c766f3e6cdc6","resolution":{"observed_at":"2026-05-16T11:55:51.260368Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-07-10T01:20:11.837567+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-10T01:20:11.837567+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:937b14863cd573800682fea7dc8a8457cca66f4a7de70b940e27a848b57e3161","observation_id":"942fe2a4-f747-4c9d-aa45-a1df055c4578","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.24963/ijcai.2024/890","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T11:37:03.070551Z","title":"Chawla, Olaf Wiest, and Xiangliang Zhang","venue":"Proceedings of the Thirty-ThirdInternational Joint Conference on Artificial Intelligence","work_id":"67a16baa-abd0-4f7e-a416-8c3f4636e8da","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:5a46fdee1191dbdd51170ac048efe10b876f3d804fd9913dfc7240bbb15549ba","observation_id":"f9ba968a-dc4f-4755-a7b2-b42164db25e1","resolution":{"observed_at":"2026-05-10T00:04:46.236627Z","resolver_source":"doi","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-07-11T17:19:09.686361+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-11T17:19:09.686361+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2402.12329","last_updated":"2024-12-07T23:09:49Z","snapshot_observed_at":"2026-08-10T10:31:44.057697Z","submitted_at":"2024-02-19T18:01:36Z","title":"Query-Based Adversarial Prompt Generation","version":2},"cited_work":{"arxiv_id":"2402.12329","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2402.12329","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"arXiv preprint arXiv:2402.12329 (2024)","venue":null,"work_id":"8f36413f-b5f1-4691-bc32-5a2b817e5b7a","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2402.12329","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:017524bf1e1206c73527ada64e09ad7c4d3a7119ea17471626733d2d4eb62d77","observation_id":"156d8fa3-11f2-42e5-a6fe-24e5a888c145","resolution":{"observed_at":"2026-05-10T00:29:47.789994Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2407.19354","doi":"10.48550/arxiv.2407.19354","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T06:15:00.866473Z","title":"The emerged security and privacy of llm agent: A survey with case studies","venue":null,"work_id":"24043853-2d1b-4a0d-a8dd-5017c0f29a56","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a660647bb81fe5a845b9ea503dfb3fe0c3723521a62d7891964d203bd78426e1","observation_id":"d7f29649-64cd-4a86-b9f0-7bcdde9c91f9","resolution":{"observed_at":"2026-05-10T00:29:47.787301Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.23278","last_updated":"2025-10-07T07:13:32Z","snapshot_observed_at":"2026-07-06T21:00:55.979837Z","submitted_at":"2025-03-30T01:58:22Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","version":3},"cited_work":{"arxiv_id":"2503.23278","doi":"10.48550/arxiv.2503.23278","metadata_source":"pith","pith_arxiv_id":"2503.23278","snapshot_observed_at":"2026-07-11T02:47:49.588216Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","venue":"cs.CR","work_id":"3eff6b57-ab58-474f-afd9-4e115a5818a9","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2503.23278","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:80ed1605a3f4d2f500c319496dec116f5a7cd4c0a89fc67ce096713aedd05463","observation_id":"227a1749-99fb-4149-bae1-a53b15c84a7c","resolution":{"observed_at":"2026-05-13T09:02:40.585277Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T11:23:19.786497+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.06825","last_updated":"2023-10-10T17:54:58Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-10-10T17:54:58Z","title":"Mistral 7B","version":1},"cited_work":{"arxiv_id":"2310.06825","doi":"10.48550/arxiv.2310.06825","metadata_source":"pith","pith_arxiv_id":"2310.06825","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mistral 7B","venue":"cs.CL","work_id":"eb5e1305-ad11-4875-ad8d-ad8b8f697599","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2310.06825","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:b11a4d9b8b2f6dbfb017dcf0558bd5cf71a38e26e6a1864e86df48928ac6250b","observation_id":"d56d398c-4e71-4cd6-91c9-fa5700afdec0","resolution":{"observed_at":"2026-05-10T00:29:47.774935Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-02T03:08:12.282824+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-02T03:08:12.282824+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19277","last_updated":"2025-04-27T15:26:51Z","snapshot_observed_at":"2026-08-07T15:58:49.794815Z","submitted_at":"2025-04-27T15:26:51Z","title":"Small Models, Big Tasks: An Exploratory Empirical Study on Small Language Models for Function Calling","version":1},"cited_work":{"arxiv_id":"2504.19277","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2504.19277","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Wilhelm Kirch (ed.).Pearson’s Correlation Coefficient, pp","venue":null,"work_id":"39e66dd2-de5b-430a-b1f0-690ea20537aa","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2504.19277","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:73df97e93115c8c4ba684b501a9c16ffef1f390d01480ab7745fff7149af596c","observation_id":"95b25623-fede-414c-b7de-4d378bd9519f","resolution":{"observed_at":"2026-05-10T00:29:47.784411Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/978-1-4020-5614-7_2569","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"doi: 10.1007/978-1-4020-5614-7_2569","venue":null,"work_id":"a4794aa9-8737-42a5-bb9e-b2c6acffc451","year":null},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:4532a6b410aad47eef2df641c32d2b1a9e8d197961d169b812fde69665bdfff0","observation_id":"a40a26bd-59da-47bb-b83b-997e5a0930c4","resolution":{"observed_at":"2026-05-10T00:04:46.238341Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.04451","last_updated":"2024-03-20T21:34:56Z","snapshot_observed_at":"2026-08-06T02:57:30.438059Z","submitted_at":"2023-10-03T19:44:37Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","version":2},"cited_work":{"arxiv_id":"2310.04451","doi":"10.48550/arxiv.2310.04451","metadata_source":"pith","pith_arxiv_id":"2310.04451","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models","venue":"cs.CL","work_id":"3b676de6-edef-4976-a8b5-082d4ff50867","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2310.04451","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:f63a18ac9a19aff0a897a496db7efda5879ce97ec96319ae1e8e5e65b2f20a0b","observation_id":"e999f22a-0af0-43b5-95af-3016b0ce9367","resolution":{"observed_at":"2026-05-12T16:28:04.131927Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-05-23T04:52:41.614605+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-23T04:52:41.614605+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.18890","last_updated":"2024-10-24T16:27:35Z","snapshot_observed_at":"2026-08-06T04:16:49.356443Z","submitted_at":"2024-10-24T16:27:35Z","title":"Improving Small-Scale Large Language Models Function Calling for Reasoning Tasks","version":1},"cited_work":{"arxiv_id":"2410.18890","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2410.18890","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OpenAI and al","venue":null,"work_id":"2a106f23-eeae-4cd2-b259-3b860fc5f60f","year":null},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2410.18890","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:79ebb795db9a4d567ee7af5df30b194a0c9dda76ddece0976d48708d06c4cedd","observation_id":"452cc3db-cb36-4c5e-b5e8-bcd4e90e7e7e","resolution":{"observed_at":"2026-05-10T00:29:47.792643Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":"2303.08774","doi":"10.1002/tea.20265","metadata_source":"pith","pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"GPT-4 Technical Report","venue":"cs.CL","work_id":"b928e041-6991-4c08-8c81-0359e4097c7b","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a395eab2738a9f4bb618cbc119933506c241eba72c1b8b6fe888b93ee5855cda","observation_id":"6f45da65-d33e-4a4d-87f4-1d2a979c383c","resolution":{"observed_at":"2026-05-10T00:29:47.728581Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15334","last_updated":"2023-05-24T16:48:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-24T16:48:11Z","title":"Gorilla: Large Language Model Connected with Massive APIs","version":1},"cited_work":{"arxiv_id":"2305.15334","doi":"10.48550/arxiv.2305.15334","metadata_source":"pith","pith_arxiv_id":"2305.15334","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Gorilla: Large Language Model Connected with Massive APIs","venue":"cs.CL","work_id":"126a464a-4a73-495f-b669-de1e44aa8f09","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2305.15334","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:62c87399e3b62d5f96dcd883772dac4bccaa170990d7aa0a70205a4639e8abeb","observation_id":"2d04e746-dd57-4d8e-866e-52c4fcad3630","resolution":{"observed_at":"2026-05-11T23:22:17.488448Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.09388","last_updated":"2025-05-14T13:41:34Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2025-05-14T13:41:34Z","title":"Qwen3 Technical Report","version":1},"cited_work":{"arxiv_id":"2505.09388","doi":"10.1016/j.aiopen.2022.12","metadata_source":"pith","pith_arxiv_id":"2505.09388","snapshot_observed_at":"2026-07-11T11:50:26.030339Z","title":"Qwen3 Technical Report","venue":"cs.CL","work_id":"25a4e30c-1232-48e7-9925-02fa12ba7c9e","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2505.09388","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:c2d16255852c4245358ccaf302f32dfd8ad1eca8a7a6ac7ac2d6898947490c61","observation_id":"7982d7b7-2af6-4a08-a5b1-15d8a876b20f","resolution":{"observed_at":"2026-05-10T00:29:47.722945Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2409.15398","last_updated":"2024-09-23T10:18:10Z","snapshot_observed_at":"2026-07-06T19:20:42.231272Z","submitted_at":"2024-09-23T10:18:10Z","title":"Attack Atlas: A Practitioner's Perspective on Challenges and Pitfalls in Red Teaming GenAI","version":1},"cited_work":{"arxiv_id":"2409.15398","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2409.15398","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Rawat, S","venue":null,"work_id":"bdece4f8-3627-451c-bc76-0b26abf7016b","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2409.15398","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:339beb9575f5e6c1c96ec4e3855bc9d22306a40443837910ade8a8996045beba","observation_id":"c6035f76-126d-426f-8739-e91c2e80ec34","resolution":{"observed_at":"2026-05-10T00:29:47.734221Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.04761","last_updated":"2023-02-09T16:49:57Z","snapshot_observed_at":"2026-07-06T14:50:07.491434Z","submitted_at":"2023-02-09T16:49:57Z","title":"Toolformer: Language Models Can Teach Themselves to Use Tools","version":1},"cited_work":{"arxiv_id":"2302.04761","doi":"10.48550/arxiv.2302.04761","metadata_source":"pith","pith_arxiv_id":"2302.04761","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Toolformer: Language Models Can Teach Themselves to Use Tools","venue":"cs.CL","work_id":"9bce40c8-cfd7-4983-80e0-c3bd4402322a","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2302.04761","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:f38b0b1cc0c02710c85b9753eaf35720aa036ac22db62d7920c32abc20b82aa3","observation_id":"e23a0ec1-bcb9-40b5-b5d6-74cb965e43f5","resolution":{"observed_at":"2026-05-10T19:57:53.077868Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-04T01:08:11.107254+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-04T01:08:11.107254+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2302.13971","last_updated":"2023-02-27T17:11:15Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-02-27T17:11:15Z","title":"LLaMA: Open and Efficient Foundation Language Models","version":1},"cited_work":{"arxiv_id":"2302.13971","doi":"10.48550/arxiv.2302.13971","metadata_source":"pith","pith_arxiv_id":"2302.13971","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"LLaMA: Open and Efficient Foundation Language Models","venue":"cs.CL","work_id":"c018fc23-6f3f-4035-9d02-28a2173b2b9d","year":2023},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2302.13971","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:6c0f8f3820515b02c2efead97557ced90cd6f2b8f4e23de81c06570bd32d566d","observation_id":"9c946c59-4198-4ad6-be0a-9ff4891064c5","resolution":{"observed_at":"2026-05-10T00:29:47.750810Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-08T16:08:17.350515+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-08T16:08:17.350515+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1007/s11704-024-40231-1","metadata_source":"doi_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-10T13:37:06.774536Z","title":"Frontiers Comput","venue":"Frontiers of Computer Science","work_id":"c00808e5-64e6-4bbb-9a05-230c05403bff","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:e77c460b402cd74e932c6068041bee69409e7bd7c69a89ac570a75f424d4e986","observation_id":"bb5daf56-e290-461f-a095-2bd4174dd0e7","resolution":{"observed_at":"2026-05-10T00:04:46.240745Z","resolver_source":"doi","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-07T23:38:13.154229+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-07T23:38:13.154229+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2505.11154","doi":"10.48550/arxiv.2505.11154","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Mpma: Preference manipulation attack against model context protocol","venue":"ArXiv.org","work_id":"a2dcd840-29d4-4ee6-b5dc-2eff7e281fb5","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:2d128d375165a9e23728a304741b683d70f0519acd7eca1ffefd3216ded405f6","observation_id":"2314d07c-6aad-44e6-8562-809e02a38862","resolution":{"observed_at":"2026-05-10T00:29:47.753365Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.16779","last_updated":"2025-03-21T01:26:12Z","snapshot_observed_at":"2026-08-07T16:47:43.422821Z","submitted_at":"2025-03-21T01:26:12Z","title":"Chain-of-Tools: Utilizing Massive Unseen Tools in the CoT Reasoning of Frozen Language Models","version":1},"cited_work":{"arxiv_id":"2503.16779","doi":"10.48550/arxiv.2503.16779","metadata_source":"arxiv_reference","pith_arxiv_id":"2503.16779","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Chain-of-Tools: Utilizing massive unseen tools in the CoT reasoning of frozen language models","venue":"ArXiv.org","work_id":"2ae0f20e-a3e6-4523-95a2-18218de8e4a7","year":2025},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2503.16779","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:0563caf1d7bc8c1461e6871e28666be69fa28c123767b29c4734f5013ef17388","observation_id":"0b3a85a4-9a7b-4349-aa8a-f0e25ef55c1f","resolution":{"observed_at":"2026-05-10T00:29:47.756025Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.17915","last_updated":"2024-12-24T09:35:05Z","snapshot_observed_at":"2026-08-02T03:32:23.832727Z","submitted_at":"2024-07-25T10:09:21Z","title":"The Dark Side of Function Calling: Pathways to Jailbreaking Large Language Models","version":4},"cited_work":{"arxiv_id":"2407.17915","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.17915","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"The dark side of function calling: Pathways to jailbreaking large language models","venue":null,"work_id":"063ec0c4-451d-4603-b7ba-fd2455924264","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.17915","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:c92a335d1905c1eb0d4efe5fac7fa1dff6d8837c47e33f17e00932668905f4bd","observation_id":"d694d785-c614-4000-8372-1e35e787a8c8","resolution":{"observed_at":"2026-05-10T00:29:47.731340Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2210.03629","last_updated":"2023-03-10T01:00:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-10-06T01:00:32Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","version":3},"cited_work":{"arxiv_id":"2210.03629","doi":"10.48550/arxiv.2210.03629","metadata_source":"pith","pith_arxiv_id":"2210.03629","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","venue":"cs.CL","work_id":"407a2351-25f1-497d-b611-f77d0292a8e6","year":2022},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2210.03629","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:59f9bf1fc5a08a781c9f5a3fd22b51fc567b2c0cf71ff09d2d8420d7a5449c9e","observation_id":"5d83d633-9d93-4bde-bcee-02774333068e","resolution":{"observed_at":"2026-05-10T00:29:47.743040Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"crossref_status_cache"},{"observed_at":"2026-07-12T03:19:36.897515+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.04295","last_updated":"2024-08-30T11:57:47Z","snapshot_observed_at":"2026-08-04T23:34:13.332065Z","submitted_at":"2024-07-05T06:57:30Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","version":2},"cited_work":{"arxiv_id":"2407.04295","doi":"10.48550/arxiv.2407.04295","metadata_source":"pith","pith_arxiv_id":"2407.04295","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Jailbreak Attacks and Defenses Against Large Language Models: A Survey","venue":"cs.CR","work_id":"0ee7fc45-ae61-432b-83ac-f1d93ccd88fb","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.04295","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:d6eb981c1f2cb532ec4df42afcc2e135509356477bba49f658fd08660a2b6572","observation_id":"f11bf409-6bfd-486f-beaf-4fbf122d1bc6","resolution":{"observed_at":"2026-05-15T02:20:44.922788Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-05-24T00:53:04.67981+00:00","source":"crossref_status_cache"},{"observed_at":"2026-05-24T00:53:04.67981+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.20653","last_updated":"2025-06-17T03:03:45Z","snapshot_observed_at":"2026-08-06T16:41:41.743961Z","submitted_at":"2024-05-31T07:41:03Z","title":"Mind the Inconspicuous: Revealing the Hidden Weakness in Aligned LLMs' Refusal Boundaries","version":3},"cited_work":{"arxiv_id":"2405.20653","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2405.20653","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Enhancing jailbreak attack against large language models through silent tokens","venue":null,"work_id":"c631bee8-b687-4d33-acd2-127688801b28","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2405.20653","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:476131c36f78dd3349daa40ad796909b4a9dfc12e8a3ee9334465be9305a229c","observation_id":"f64c2241-ab4f-42e4-8de0-401a934a4e77","resolution":{"observed_at":"2026-05-10T00:29:47.739027Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20859","last_updated":"2024-07-30T14:35:31Z","snapshot_observed_at":"2026-07-06T18:53:57.980865Z","submitted_at":"2024-07-30T14:35:31Z","title":"Breaking Agents: Compromising Autonomous LLM Agents Through Malfunction Amplification","version":1},"cited_work":{"arxiv_id":"2407.20859","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2407.20859","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification","venue":null,"work_id":"5d974f12-7aa9-48ab-91d4-b739092384cb","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2407.20859","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:86b3fe527c87955c1ea97ef231571535bfbfaaf3c7e9844585a9f893ea0dbe32","observation_id":"00c339ae-648a-41f4-b060-8eb944fbb130","resolution":{"observed_at":"2026-05-10T00:29:47.748410Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.04313","last_updated":"2024-07-12T16:51:07Z","snapshot_observed_at":"2026-08-10T13:31:39.611752Z","submitted_at":"2024-06-06T17:57:04Z","title":"Improving Alignment and Robustness with Circuit Breakers","version":4},"cited_work":{"arxiv_id":"2406.04313","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2406.04313","snapshot_observed_at":"2026-07-04T20:00:07.967572Z","title":"https: //arxiv.org/abs/2406.04313.arXiv(2024)","venue":null,"work_id":"2145f7d3-5c56-458e-90f1-43d172ec2654","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"cited_paper":"/paper/2406.04313","citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:a7a4af509e0a44cc08f34386f1914fc6b5fea1541cd42122a235c79b28c7753d","observation_id":"235710f3-2205-4509-96fa-ec57a0c3c973","resolution":{"observed_at":"2026-05-10T00:29:47.745676Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Figures (1), (2) and (3) detail the prompts used for the reformulation (1) and argument-variation (2), and multi-intent variation (3) strategies, respectively","venue":null,"work_id":"4f599dcb-5661-471f-9bc2-1805ccdc5a5f","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:70ae92775d30f6a1f09e558d9a55d3d1ef63b3791e0e2886d80241eca6454ae6","observation_id":"55bc25ac-1d02-482e-befe-76950f5529ff","resolution":{"observed_at":"2026-05-23T11:52:56.817923Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Specifically, we observe a peak on lower values for strategy (3), representing the queries containing different intents from the original prompt","venue":null,"work_id":"50ed66e9-7caf-47cf-ac2a-e1e8ec924f75","year":2024},"citing_paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-10T00:02:35.167281Z"},"links":{"citing_paper":"/paper/2604.20994"},"observation_digest":"sha256:8b75ddb00bafdb3b01789f1121a0bea4b2fb53d5e9b360997ff3f37b3fa6bb51","observation_id":"cc40ab87-f257-499d-95f7-f05b57d056ad","resolution":{"observed_at":"2026-05-23T11:52:56.822538Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2604.20994","last_updated":"2026-04-22T18:32:38Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-02T13:22:16.885289Z","submitted_at":"2026-04-22T18:32:38Z","title":"Breaking MCP with Function Hijacking Attacks: Novel Threats for Function Calling and Agentic Models"},"reference_resolution":{"displayed":30,"state_counts":{"malformed_identifier":0,"metadata_mismatch":18,"parse_uncertain":0,"unresolved":0,"verified_exact":10,"verified_fuzzy":2},"total_outbound_references":30},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 30 of 30 outbound references and 2 inbound Pith citation observations for arXiv:2604.20994."}