{"as_of":"2026-08-06T14:19:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:e8b7b1bb1f6d9a8501a40f40ed92ce0ba8f510374bd5229497cf4f980dedf490","coverage":[{"denominator":57,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":57,"source":"paper_references, paper_reference_links","source_observed_at":"2026-05-08T09:08:30.102711Z","state":"measured"},{"denominator":58,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":58,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-06T06:34:29.942622+00:00","state":"measured"},{"denominator":1,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":1,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T16:35:17.406568Z","state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[{"citation":{"cited_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.06393","snapshot_observed_at":"2026-08-01T16:35:17.406568Z","title":"Available: https://arxiv.org/abs/2605.06393","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.17951","last_updated":"2026-07-20T13:52:24Z","snapshot_observed_at":"2026-08-06T03:03:53.912929Z","submitted_at":"2026-07-20T13:52:24Z","title":"RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-08-01T16:35:17.406568Z"},"links":{"cited_paper":"/paper/2605.06393","citing_paper":"/paper/2607.17951"},"observation_digest":"sha256:e183dac721f6c0174dd003bf148c761f443e61c9374b6e317d0d05a500eb2450","observation_id":"cdd1d98e-bac1-4a6a-99bc-586b5e77c7e5","resolution":{"observed_at":"2026-08-01T16:35:17.406568Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"links":{"evidence":"/evidence","html":"/paper/2605.06393/citation-record","integrity":"/paper/2605.06393/integrity","json":"/paper/2605.06393/citation-record.json","paper":"/paper/2605.06393"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"(2026, Feb.) Openclaw vulnerability: Website-to-local agent takeover","venue":null,"work_id":"6fd3f8b0-74b8-4b16-add6-f6e5bd4efeb5","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:2272e7b535fe1ccc4f978108328e76c04cf6ca3ec1ac61cf5a7cc5fc1e3c01c7","observation_id":"a938718d-cbc8-489d-a4e0-4caf515480f5","resolution":{"observed_at":"2026-05-26T16:27:39.773378Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"(2026, Jan.) Openclaw/clawdbot has 1-click RCE via authentication token exfiltration from gatewayurl","venue":null,"work_id":"ca144187-383d-40a2-8ce4-082287ce2592","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:e85388e948adf376ea37ad618ce1ad115ac4ba828938b9a4adeaeeab2473f3a1","observation_id":"0b4b4f70-bf74-4bfe-9329-d953a1068b27","resolution":{"observed_at":"2026-05-26T16:27:39.764787Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"97abf63e-0517-4431-958e-0647ac99f8de","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:a33e33d49d32c653fc54775c739c49aa8804352e9b4d697a5cdeb22964677b2e","observation_id":"5e1b04e0-c29f-4907-bbc3-6dae257b9c8c","resolution":{"observed_at":"2026-05-26T16:27:39.760093Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":null,"venue":null,"work_id":"36c319dd-d229-4f49-b9c9-b6ee52a0e42f","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:874cfbdec6a6076704b92c872a9ca99a4ecc0a8991fd436cb4f484c141377809","observation_id":"1d00f4a1-38ba-43f1-8026-d190f7616d74","resolution":{"observed_at":"2026-05-26T16:27:39.769061Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OP-TEE (Open Portable Trusted Ex- ecution Environment)","venue":null,"work_id":"599c04c5-06db-4847-99fe-99459adebdde","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ae307461a2f6c0beccf9052e9dc2e8a823cbc4fd324e822e5f5ba1467e35bf93","observation_id":"fad4c65c-8e02-43f5-a36a-5e9154213b04","resolution":{"observed_at":"2026-05-26T16:27:39.750852Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"OP-TEE Documentation","venue":null,"work_id":"183106bf-18c7-4564-9c0b-10ec93b17aad","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:603a7d361c6f005cce6c92caddde80381bb335c3cb7b608bc6497c6c5e181cdd","observation_id":"729c4a5c-21ab-43ec-a6de-fe4de97459fa","resolution":{"observed_at":"2026-05-26T16:27:39.746149Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Keystone: An Open Framework for Architecting Trusted Execution Environments","venue":null,"work_id":"80aa48a3-1c03-48ae-b2f3-2871d0fd487f","year":2020},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:c57a58764a9e0f86299943e50453fef4422bcce0076b189c118633e5f0ddae24","observation_id":"1e866452-8f82-480d-9b55-a219e09aaffa","resolution":{"observed_at":"2026-05-26T16:27:39.731695Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Keystone Enclave Documentation","venue":null,"work_id":"7feb57f2-4884-4a5d-abe4-2939cbf45093","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:4e533cf9203292619d60d0e3a5e06816241bf16acde9159249766988c06997ff","observation_id":"b791c4df-827c-42d6-89c3-d94ba8fd38b3","resolution":{"observed_at":"2026-05-26T16:27:39.736465Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Enclave Application Cache for RISC-V Keystone","venue":null,"work_id":"a88d8986-e17a-41e2-9303-47af70949c75","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ba2d490132d42c85d5cf1a56cadd6a27827a50eed7d66e465dc95a5c289d7be6","observation_id":"83fa6f85-a065-4603-9992-8591b9515393","resolution":{"observed_at":"2026-05-26T16:27:39.741545Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"(2026) Openclaw - personal AI assistant","venue":null,"work_id":"f6789187-215b-4a8f-a41b-5553846927a2","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:fc386df6a443d4befcde539b0f7fd41a02c7d1f5b64d58cf76982ad475457dc8","observation_id":"680bc1a0-c6e7-4d44-a5ef-231d5167017f","resolution":{"observed_at":"2026-05-26T16:27:39.755621Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Camels can use computers too: System-level security for computer use agents","venue":null,"work_id":"6d5d6bf5-683d-42c2-892f-76cf783ca756","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:7514019a38df239aa161eab48ac184fd48e8927b337dd9253c0dee35cdd63da7","observation_id":"e7a12b60-8192-4402-979c-f18fb8387449","resolution":{"observed_at":"2026-05-26T16:27:39.777394Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2601.09923","last_updated":"2026-06-04T15:38:02Z","snapshot_observed_at":"2026-08-06T13:01:48.994450Z","submitted_at":"2026-01-14T23:06:35Z","title":"CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents","version":3},"cited_work":{"arxiv_id":"2601.09923","doi":"10.48550/arxiv.2601.09923","metadata_source":"pith","pith_arxiv_id":"2601.09923","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Camels can use computers too: System-level security for computer use agents","venue":"cs.AI","work_id":"44b54730-e6b2-4e8c-b6af-7c422996c093","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2601.09923","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:4bd2c3350f2f3cba90e62a1fd1d1a525683e224ec48fdc9a2cbbcd2a71b97c06","observation_id":"80f11375-14d6-4b59-9f5b-2cbb42f59c25","resolution":{"observed_at":"2026-06-05T02:16:21.941428Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.04759","last_updated":"2026-04-06T15:27:05Z","snapshot_observed_at":"2026-07-06T22:53:37.357996Z","submitted_at":"2026-04-06T15:27:05Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","version":1},"cited_work":{"arxiv_id":"2604.04759","doi":"10.48550/arxiv.2604.04759","metadata_source":"pith","pith_arxiv_id":"2604.04759","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"Your Agent, Their Asset: A Real-World Safety Analysis of OpenClaw","venue":"cs.CR","work_id":"210c09c9-0953-4b01-aed7-c4f462b807be","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.04759","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:7c8a68c77a704dabe4476dd36e757e5e2c7a0eaa904c9339abee8dc7f23902e4","observation_id":"857b32e5-5f7b-45c6-a219-0997fc26a1a6","resolution":{"observed_at":"2026-05-11T20:26:11.296295Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"A systematic security evaluation of openclaw and its variants","venue":null,"work_id":"640eb21c-41d7-4445-be30-d32f16b9f797","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:41e3ee584497dbefb286aaebf45403872540def1d57d762f05442f7e74a85a95","observation_id":"10e9b729-e369-4008-854b-f832dc2c4825","resolution":{"observed_at":"2026-05-26T16:27:39.791050Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.03131","last_updated":"2026-04-03T15:52:36Z","snapshot_observed_at":"2026-07-06T22:52:20.577677Z","submitted_at":"2026-04-03T15:52:36Z","title":"A Systematic Security Evaluation of OpenClaw and Its Variants","version":1},"cited_work":{"arxiv_id":"2604.03131","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.03131","snapshot_observed_at":"2026-07-03T06:27:42.550738Z","title":"A Systematic Security Evaluation of OpenClaw and Its Variants","venue":"cs.CR","work_id":"22bc6f3d-dd89-4d9d-8993-2ee04896d9ce","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.03131","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:8128342e0e3e19ac6fdab4b72cc97a03e212caf1255e58607a68fed4e0d71f47","observation_id":"e68f8a17-c9fe-47c6-9705-c693cb3197ce","resolution":{"observed_at":"2026-05-11T20:26:11.278150Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2506.02456","doi":"10.48550/arxiv.2506.02456","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Vpi-bench: Visual prompt injection attacks for computer-use agents","venue":"ArXiv.org","work_id":"4edec04f-9cad-4c9f-a494-1e1fe341b706","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:051a0782617837955ebd500be6c3ae085245f532a3c469e25a05dfd17c98049b","observation_id":"39f98c1e-b1b9-4aca-87fa-7eb13a3daa37","resolution":{"observed_at":"2026-05-11T20:26:11.095045Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.28551","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"What Did It Actually Do?: Understanding risk awareness and traceability for computer-use agents","venue":null,"work_id":"4718dc42-6ece-4e53-badb-db1775b62afe","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:e54585c51e4f6a926f8d100ce04ce075fe71166e8a92d620bf9ae26566e90625","observation_id":"45dd7915-755b-42d6-ac93-a71691def5e3","resolution":{"observed_at":"2026-05-11T20:26:11.228751Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Don’t let the claw grip your hand: A security analysis and defense framework for openclaw","venue":null,"work_id":"e2f8b487-6095-4422-bf36-c3e0283fef73","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:3fb5d5c44b4d331b6c648dec73c8eecbf52eec9b4b6e717dbe1cc6a6a42a232d","observation_id":"8e28b5e1-9c8f-4e4f-96f1-bf64c5cc2a3e","resolution":{"observed_at":"2026-05-26T16:27:39.781871Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.10387","doi":"10.48550/arxiv.2603.10387","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Don’t let the claw grip your hand: A security analysis and defense framework for OpenClaw","venue":"arXiv (Cornell University)","work_id":"419d68e7-2dfc-4480-9d0a-0da2040a78d4","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:bdcfdedbd5361a4ade056230b824f055a5ad8b1eccf63ae82d6f47268ea62062","observation_id":"405030aa-437b-4afd-9d6d-a84e5ecb9e86","resolution":{"observed_at":"2026-05-11T20:26:11.236477Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.12644","doi":"10.48550/arxiv.2603.12644","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Uncovering security threats and architecting defenses in autonomous agents: A case study of OpenClaw","venue":"arXiv (Cornell University)","work_id":"73ec2c86-6f34-4369-9dfc-340d7d3a2b77","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:1e5f013c34d5435972efafce3bc2506230248ff18fa287b716d1920654a9f760","observation_id":"f3eea4e2-db26-40ad-9ede-4fb04cf25768","resolution":{"observed_at":"2026-05-11T20:26:11.247346Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.06284","last_updated":"2026-04-07T12:19:55Z","snapshot_observed_at":"2026-07-06T22:54:48.916799Z","submitted_at":"2026-04-07T12:19:55Z","title":"ClawLess: A Security Model of AI Agents","version":1},"cited_work":{"arxiv_id":"2604.06284","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.06284","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"ClawLess: A Security Model of AI Agents","venue":"cs.CR","work_id":"ae7d7abd-09d4-4f20-83da-400ee4d6f03d","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.06284","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:6a55a4a82186859291335e189af426f0b15337682ee14a8b5b80ad58a96d89ce","observation_id":"febdfbe8-d7e8-4c79-bbf1-b6ed5bb54490","resolution":{"observed_at":"2026-05-11T20:26:11.221742Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":"2403.02691","doi":"10.1145/3696410.3714756","metadata_source":"pith","pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","venue":"cs.CL","work_id":"5cbfcda4-ec26-44e4-be60-e1525956d71d","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:7722d5a32617919f32ab2eab6787798eb7ec48798ddaad7aa81a92b1cbb199b0","observation_id":"c0e71a4c-64d8-4714-a732-03437511829a","resolution":{"observed_at":"2026-05-13T21:40:06.567267Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":"2406.13352","doi":"10.48550/arxiv.2406.13352","metadata_source":"pith","pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","venue":"cs.CR","work_id":"7b1b672f-e6b4-4df9-aa8b-3396a2eb8b16","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:b446fe7891b5831045330b66ada5ca71ca3c53d3ee63a131112d4d0a347359d1","observation_id":"3790cb3c-65a3-4eb4-9d82-9fa95ff9aab5","resolution":{"observed_at":"2026-05-13T06:35:13.649872Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2410.02644","last_updated":"2025-05-30T03:50:33Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-10-03T16:30:47Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","version":4},"cited_work":{"arxiv_id":"2410.02644","doi":"10.48550/arxiv.2410.02644","metadata_source":"pith","pith_arxiv_id":"2410.02644","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents","venue":"cs.CR","work_id":"15ab4a69-85ab-4295-839d-080a2cd3e7aa","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2410.02644","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ff25f9b207fabaf4d052c231d5e29312a3871f0fd3247fe88189d82f9bd00eca","observation_id":"60c9c6e5-77ac-428d-90fa-e0414e5d0b22","resolution":{"observed_at":"2026-05-12T13:36:57.477107Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2506.14866","doi":"10.48550/arxiv.2506.14866","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Os-harm: A benchmark for measuring safety of computer use agents","venue":"ArXiv.org","work_id":"e83d917b-c8de-475a-9fdd-0a1c334de498","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:91e4dfc00db583481e3349d2f1eda8d6a16282052b162185acff7d8db78c6a0f","observation_id":"aff62ec5-9650-430a-bebc-7d87a21deba8","resolution":{"observed_at":"2026-05-11T20:26:11.272766Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.18575","last_updated":"2025-05-16T22:42:29Z","snapshot_observed_at":"2026-07-06T21:14:57.707919Z","submitted_at":"2025-04-22T17:51:03Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","version":3},"cited_work":{"arxiv_id":"2504.18575","doi":"10.48550/arxiv.2504.18575","metadata_source":"pith","pith_arxiv_id":"2504.18575","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"WASP: Benchmarking Web Agent Security Against Prompt Injection Attacks","venue":"cs.CR","work_id":"bf1914b2-fd32-4768-a4d5-84720606d71b","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2504.18575","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:60b2333517ca39966aff6deb7cff508e87b0c18f3867e165e209b7c2bd441eea","observation_id":"b6392458-5895-4aef-bb61-063e44d78daf","resolution":{"observed_at":"2026-05-15T22:22:05.737978Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.02947","last_updated":"2026-04-03T10:29:31Z","snapshot_observed_at":"2026-07-29T16:09:43.498926Z","submitted_at":"2026-04-03T10:29:31Z","title":"AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents","version":1},"cited_work":{"arxiv_id":"2604.02947","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.02947","snapshot_observed_at":"2026-07-03T13:48:20.367069Z","title":"AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents","venue":"cs.AI","work_id":"cd51a93d-4f91-49d6-b3c8-ae00ba7d3aa0","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.02947","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:fe22dd14c4e9e204e3d7496828a8d85349d0b6f02cc1c49ab05d0be136d59200","observation_id":"1244999e-f9f3-488d-96d2-2b4c9c8f1b3d","resolution":{"observed_at":"2026-05-11T20:26:11.179617Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01438","last_updated":"2026-04-04T15:18:43Z","snapshot_observed_at":"2026-07-06T22:51:35.522923Z","submitted_at":"2026-04-01T22:24:24Z","title":"ClawSafety: \"Safe\" LLMs, Unsafe Agents","version":2},"cited_work":{"arxiv_id":"2604.01438","doi":"10.48550/arxiv.2604.01438","metadata_source":"pith","pith_arxiv_id":"2604.01438","snapshot_observed_at":"2026-08-05T02:49:54.815029Z","title":"ClawSafety: \"Safe\" LLMs, Unsafe Agents","venue":"cs.AI","work_id":"65792180-ed14-4f36-a1e6-78f74ed5224d","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.01438","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:f486e61e6f8ea0dbd97565fea9b583f2a389351073ddee22fbb2bf8d8a4262bd","observation_id":"6515f193-6b6e-48af-b7ce-2993cb57e9fa","resolution":{"observed_at":"2026-05-11T20:26:11.194653Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2510.06607","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T12:08:07.138069Z","title":"Code agent can be an end-to-end system hacker: Benchmarking real-world threats of computer-use agent","venue":null,"work_id":"ad0b34e0-250e-4566-ae6f-7f282b91a687","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:828e3b0e39bbfc9e28558fe44f4f2a1239a11392ab7f9b59598be1de64fcfcea","observation_id":"124b7586-b60b-41bd-851d-d8c68926a21c","resolution":{"observed_at":"2026-05-11T20:26:11.139612Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.20708","doi":"10.48550/arxiv.2602.20708","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"ICON: Indirect prompt injection defense for agents based on inference-time correction","venue":"Open MIND","work_id":"9307fc96-12ad-410b-934b-0c80899ae112","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:f88a4df9248d5d97efc6e516990282861662ed0db8aa5e4a8d7fd603419b8634","observation_id":"cfbda53c-fe70-4b69-8b8e-569fbd67782f","resolution":{"observed_at":"2026-05-11T20:26:11.157152Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2506.01055","last_updated":"2025-06-01T15:48:06Z","snapshot_observed_at":"2026-07-06T21:34:38.683177Z","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","version":1},"cited_work":{"arxiv_id":"2506.01055","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2506.01055","snapshot_observed_at":"2026-07-04T14:09:53.274632Z","title":"Simple prompt injection attacks can leak personal data observed by llm agents during task execution","venue":null,"work_id":"0f88bb16-d6ed-41c4-8b0b-49b456b6d51e","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2506.01055","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:1074be5cf54920e29706c28caeee91007f125e8ba217af8bd8bf7b86e0643cda","observation_id":"c5432059-af0f-467e-850f-7cddc4d5b4f5","resolution":{"observed_at":"2026-05-11T20:26:11.150157Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.10453","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T13:39:51.337137Z","title":"arXiv preprint arXiv:2602.10453 , year=","venue":null,"work_id":"16c524eb-7f93-4bcc-bcb4-d30238f9c00a","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:0b6865132409e9c3227662c3840f272d1809cdf94d021db2a6f198c9ae7f5bc3","observation_id":"7045ce5a-3719-4e0d-8e90-87a6f6e798dd","resolution":{"observed_at":"2026-05-11T20:26:11.164074Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Memory poisoning attack and defense on memory based LLM-agents","venue":null,"work_id":"24e2447d-13a5-4e91-9441-631c163d571a","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:49401b6f510379850b58301841a70846e5ef85c50c805bb8a7e7b835f651e963","observation_id":"83c79e3c-d9a9-4028-a6be-b095f6633a40","resolution":{"observed_at":"2026-05-26T16:27:39.726884Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18666","last_updated":"2025-07-31T04:00:48Z","snapshot_observed_at":"2026-07-06T20:57:47.748881Z","submitted_at":"2025-03-24T13:31:48Z","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","version":3},"cited_work":{"arxiv_id":"2503.18666","doi":"10.48550/arxiv.2503.18666","metadata_source":"pith","pith_arxiv_id":"2503.18666","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents","venue":"cs.AI","work_id":"2d265b31-7dcb-4ab3-8c83-e13bd5598435","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2503.18666","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:61f927558d32b96ca5f0e3a9f003880a327b426da4c37dee9770b21800071c34","observation_id":"07484e74-c5af-4bfb-b66b-1f63318bdd77","resolution":{"observed_at":"2026-05-14T21:24:32.777586Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-03T00:38:11.552641+00:00","source":"crossref_status_cache"},{"observed_at":"2026-08-03T00:38:11.552641+00:00","source":"openalex_status_cache"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.16708","last_updated":"2026-05-08T15:45:27Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2026-02-18T18:57:12Z","title":"Formal Policy Enforcement for Real-World Agentic Systems","version":3},"cited_work":{"arxiv_id":"2602.16708","doi":null,"metadata_source":"pith","pith_arxiv_id":"2602.16708","snapshot_observed_at":"2026-07-11T02:47:51.036183Z","title":"Formal Policy Enforcement for Real-World Agentic Systems","venue":"cs.CR","work_id":"dc0c6fb4-ef13-485c-8109-a5a138684d7e","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2602.16708","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:737f1029450d0fa44c556f1744b67b9f4a31ed4cc172afe64a4e1de7d9f163b9","observation_id":"1cf11920-0b88-401c-a02d-1639deeeda9b","resolution":{"observed_at":"2026-05-12T01:43:58.132331Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2508.03858","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T00:29:16.287201Z","title":"Wang, Trisha Singhal, Ameya Kelkar, and Jason Tuo","venue":null,"work_id":"6c4b5957-7f0a-4b3b-b179-41c13b991dd3","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:7d49851c334f483769bdd14aacbdaef175b9cdf22c6dc4f87ef58780f11c8133","observation_id":"3a65c88d-70c8-4b4d-b8e2-96631ab50289","resolution":{"observed_at":"2026-05-11T20:26:11.289832Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.05229","last_updated":"2026-04-06T22:49:28Z","snapshot_observed_at":"2026-07-06T22:54:00.211106Z","submitted_at":"2026-04-06T22:49:28Z","title":"From Governance Norms to Enforceable Controls: A Layered Translation Method for Runtime Guardrails in Agentic AI","version":1},"cited_work":{"arxiv_id":"2604.05229","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.05229","snapshot_observed_at":"2026-07-04T00:29:16.320431Z","title":"From Governance Norms to Enforceable Controls: A Layered Translation Method for Runtime Guardrails in Agentic AI","venue":"cs.AI","work_id":"a2b5a1a5-8802-49cf-8cc4-da503ba1285e","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.05229","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:3181eda3fa615562d127fd044abf0ebbcce318d701b11c789ce7aa626bca44ab","observation_id":"79808576-a662-47f2-8eb0-7586e30dd6d0","resolution":{"observed_at":"2026-05-11T20:26:11.112259Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.16586","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-04T14:09:53.182384Z","title":"Kaptein, V.-J","venue":null,"work_id":"de1091cb-8f2a-4b9e-b767-645990d8315a","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:fea192a11dc493ea76570f22ec6234bbaa20d8f0a34e3ad68dfb72ae4973ac06","observation_id":"9c4d0216-016c-4e0c-b5eb-75b5c00c4ee2","resolution":{"observed_at":"2026-05-11T20:26:11.033709Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.20953","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.317156Z","title":"Uchibeke","venue":null,"work_id":"e707c68e-9311-4108-9524-efc7b1c3ddf6","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:6fe8b21fee955076324b6e7c2073a2dc9bff75b1bea97789ba37400e0e3674f6","observation_id":"8ecb8f47-41c0-46c7-a2cb-fa8a78897c79","resolution":{"observed_at":"2026-05-11T20:26:10.998204Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-07-06T21:10:09.129714Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":"2504.11703","doi":"10.48550/arxiv.2504.11703","metadata_source":"pith","pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Progent: Securing AI Agents with Privilege Control","venue":"cs.CR","work_id":"193d98f2-c913-4d0c-814e-b550a64bd03c","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:be5163236cd73db6fa4bfa9b89c24465b70677b0dae62f22aec3b5b86af8b784","observation_id":"8ae5faa8-34a4-4369-8397-0a37b9e330da","resolution":{"observed_at":"2026-05-15T01:43:10.493453Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2508.00500","last_updated":"2026-08-03T00:31:29Z","snapshot_observed_at":"2026-08-06T14:15:17.701138Z","submitted_at":"2025-08-01T10:24:47Z","title":"ProbGuard: Proactive Runtime Monitoring for LLM Agent Safety via Probabilistic Prediction","version":4},"cited_work":{"arxiv_id":"2508.00500","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2508.00500","snapshot_observed_at":"2026-08-04T02:29:49.790599Z","title":"Pro2Guard: Proactive runtime enforcement of LLM agent safety via probabilistic model checking","venue":null,"work_id":"d4c2a48d-ad9b-4f3b-91df-81f61d80ff64","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2508.00500","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:10e2837706e0f809bef38cc65ca550150b1ec26d8ade30ac0ce5bc2554c9c56c","observation_id":"46bff2a8-8ccb-4bd7-8772-b4def0492778","resolution":{"observed_at":"2026-08-04T02:29:49.790599Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2602.22302","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-03T22:28:59.755034Z","title":"Agent Behavioral Contracts: Formal Specification and Runtime Enforcement","venue":null,"work_id":"9f9c854c-a981-4164-9adb-28fd62ffeecd","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:ce8a3c7e6b9cc02d4f9e267fc7eeea82d458fd0266249f101a4a52918e0a4e8d","observation_id":"8fce22f1-336f-4e23-aa2d-2f2d869a9b99","resolution":{"observed_at":"2026-05-11T20:26:10.961108Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.28166","last_updated":"2026-04-20T07:37:21Z","snapshot_observed_at":"2026-08-02T07:10:51.130581Z","submitted_at":"2026-03-30T08:35:00Z","title":"Evaluating Privilege Usage of Agents with Real-World Tools","version":2},"cited_work":{"arxiv_id":"2603.28166","doi":null,"metadata_source":"pith","pith_arxiv_id":"2603.28166","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Evaluating Privilege Usage of Agents with Real-World Tools","venue":"cs.CR","work_id":"846ef222-b04f-4285-a9e3-3f81eaa73cb3","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2603.28166","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:705f3c470e3d4d7248260df85f4ad8e4a513426b82dbafff94029c7009ea743f","observation_id":"00fb860b-50b0-46e9-824e-6493c1c3ed53","resolution":{"observed_at":"2026-05-11T20:26:10.968405Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2603.28807","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-30T07:54:22.134696Z","title":"SafeClaw-R: Risk analysis and runtime enforcement for OpenClaw skills","venue":null,"work_id":"60190bcb-d450-43f2-9341-222afdca5f1a","year":2022},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:510bfe94f9c057eb9217adb35d5d55919f836a9f9a6051ad9b024f25a54241e3","observation_id":"86acbf06-b9b5-4128-b4e8-d914434b1ecf","resolution":{"observed_at":"2026-05-11T20:26:10.985007Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2603.12230","last_updated":"2026-04-05T08:33:19Z","snapshot_observed_at":"2026-08-04T04:27:19.804842Z","submitted_at":"2026-03-12T17:49:39Z","title":"Security Considerations for Artificial Intelligence Agents","version":2},"cited_work":{"arxiv_id":"2603.12230","doi":null,"metadata_source":"pith","pith_arxiv_id":"2603.12230","snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Security Considerations for Artificial Intelligence Agents","venue":"cs.LG","work_id":"ac86548e-22d3-4f8f-9098-c77af47420b6","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2603.12230","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:66e3052eb0dcc705d3588d5007605f2eac60e83007aa741976f51c5ec5ce45f2","observation_id":"fbb5e2cf-877a-421f-995f-4aaa38147dd5","resolution":{"observed_at":"2026-05-11T20:26:11.020770Z","resolver_source":"local_arxiv","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Preventing privilege escala- tion","venue":null,"work_id":"db3c4997-a0fb-4941-840a-e534f89d2b34","year":2003},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:891d2f699b6447a30316e8ec4bac67e4d3ccef99153d8d2cf8d087a3967a6d43","observation_id":"0b7bd804-a764-4f99-b017-a16b441fc0fd","resolution":{"observed_at":"2026-05-26T16:27:39.795252Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Enforceable security policies","venue":null,"work_id":"21074288-e19f-47f3-af9a-edd9b65fb967","year":2000},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:aa78b303c457541b2b46d881fb58c7df5a6664743999796f345242be2b00612a","observation_id":"aaf89c1e-2d1b-40a6-92d3-be094afd834e","resolution":{"observed_at":"2026-05-08T22:24:19.059649Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"SC-11: Trusted Path","venue":null,"work_id":"554b4b5c-771a-465a-8c7d-adf6f5a32b12","year":2020},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:9e9ad33302dc2eb830368d41b27cd9d4044ea4ae94bdb5dc26ab74db7063b954","observation_id":"18ac8001-21ab-4c87-a6d5-5765c533885b","resolution":{"observed_at":"2026-05-26T16:27:39.721928Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":"10.1109/csf.2008.24","metadata_source":"openalex","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Evidence- based audit","venue":null,"work_id":"483b8d67-9a63-463f-b846-fca7eee41724","year":2008},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:da2e5db819d613ca01c9061af66bfea9defd487ede78855c79a180e940025361","observation_id":"2b6a1e22-f50d-4448-ae00-ce754119e139","resolution":{"observed_at":"2026-05-08T22:24:19.064342Z","resolver_source":"doi","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2512.01295","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-07-11T02:47:50.063911Z","title":"Systems security foundations for agentic computing","venue":null,"work_id":"f9165bc7-0f01-458f-9b95-f4be76e21b26","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:43097151e8bccc6abb51fbb46f58e99bfe0cb42c293446a692621ed09d00f930","observation_id":"37192e4b-2743-420c-b239-cf356377d326","resolution":{"observed_at":"2026-05-11T20:26:11.044363Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2406.02630","doi":"10.48550/arxiv.2406.02630","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Ai agents under threat: A survey of key security challenges and future pathways","venue":"arXiv (Cornell University)","work_id":"fee97178-2c2c-4126-b6e2-9bd883f9a4c1","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:77a88fd28986ac3976ed918c1841133d59b2198c89b85ea6550939e8db089c55","observation_id":"7e382754-e76c-4c4a-8122-4a3bc07887d8","resolution":{"observed_at":"2026-05-11T20:26:11.067357Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.05849","last_updated":"2025-06-14T01:50:21Z","snapshot_observed_at":"2026-07-06T21:21:20.149404Z","submitted_at":"2025-05-09T07:40:17Z","title":"AgentVigil: Generic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents","version":4},"cited_work":{"arxiv_id":"2505.05849","doi":null,"metadata_source":"arxiv_reference","pith_arxiv_id":"2505.05849","snapshot_observed_at":"2026-07-04T10:09:45.177863Z","title":"Agentvigil: Generic black-box red- teaming for indirect prompt injection against llm agents","venue":null,"work_id":"78036d3e-3022-41fc-a844-76366394ab0d","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2505.05849","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:258cd3c065c79ebf62e65a145092e05a973ce57f9b843644d34af35fdd6ecd2c","observation_id":"e01b55d3-0550-41b1-b9e0-7a7aaf50e233","resolution":{"observed_at":"2026-05-11T20:26:11.054246Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2407.12784","last_updated":"2024-07-17T17:59:47Z","snapshot_observed_at":"2026-07-06T18:47:56.109836Z","submitted_at":"2024-07-17T17:59:47Z","title":"AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Bases","version":1},"cited_work":{"arxiv_id":"2407.12784","doi":"10.48550/arxiv.2407.12784","metadata_source":"pith","pith_arxiv_id":"2407.12784","snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases","venue":"cs.LG","work_id":"fd576f32-99d7-40a6-866a-ad86ad47565d","year":2024},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2407.12784","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:61165cfab5464a49b53e6fed7aefb83ae2c65b0edb755106c635cb8a6f684ee0","observation_id":"feca86c2-699d-439c-862d-c539df9af9d4","resolution":{"observed_at":"2026-05-11T20:26:11.087888Z","resolver_source":"arxiv_id","status":"verified_exact"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"Poison once, exploit forever: Environment-injected memory poisoning attacks on web agents","venue":null,"work_id":"cda4fe95-fe63-40ee-8fec-218bb7616012","year":null},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:e315a7c70e3bd913c8a3ea06e272358ee7234734031c401d323d2188068e801d","observation_id":"812bbb9c-6812-4222-8e0f-6b0884b22141","resolution":{"observed_at":"2026-05-26T16:27:39.717404Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.02623","last_updated":"2026-04-07T14:45:15Z","snapshot_observed_at":"2026-08-05T14:57:29.112440Z","submitted_at":"2026-04-03T01:25:12Z","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","version":2},"cited_work":{"arxiv_id":"2604.02623","doi":null,"metadata_source":"pith","pith_arxiv_id":"2604.02623","snapshot_observed_at":"2026-07-03T05:57:41.940009Z","title":"Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents","venue":"cs.CR","work_id":"b00d3f50-24e0-4812-87e0-eb47767f463f","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"cited_paper":"/paper/2604.02623","citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:df7305bc59507c731e152c2e45453639f05b78edf0ad5d90ce67fe652d1d06cd","observation_id":"ca9a4bb9-9268-419a-bee3-71963bd3fa48","resolution":{"observed_at":"2026-05-11T20:26:11.122650Z","resolver_source":"local_arxiv","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":"2601.17548","doi":"10.48550/arxiv.2601.17548","metadata_source":"arxiv_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T02:28:24.338817Z","title":"Maloyan and D","venue":"CyberLeninK (CyberLeninka)","work_id":"16c69ef7-00fc-4f32-bd01-e17005fa7480","year":2026},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:80bd783b125a1e122c92b38a25c76c57249cf887e47596c4d6b36611d6fdddb7","observation_id":"ed97e1cc-5655-45ed-b989-7a0abf94d55a","resolution":{"observed_at":"2026-05-11T20:26:11.009072Z","resolver_source":"arxiv_id","status":"metadata_mismatch"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-06-05T21:23:00.469572Z","title":"His research interests include trusted com- puting, confidential computing, system and network security","venue":null,"work_id":"d030abd8-ce98-4845-b339-a73a772a470f","year":2025},"citing_paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-05-08T09:08:30.102711Z"},"links":{"citing_paper":"/paper/2605.06393"},"observation_digest":"sha256:365049b7d8936cc339fb5187517cc386bf82e3ff6ef6aad03cb1e1a98cfaac5e","observation_id":"dd7c609b-319f-4a4d-8f9d-500d6728a290","resolution":{"observed_at":"2026-05-26T16:27:39.786529Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-06T06:34:29.942622+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2605.06393","last_updated":"2026-05-07T15:08:40Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-07-06T23:18:51.157048Z","submitted_at":"2026-05-07T15:08:40Z","title":"Constraining Host-Level Abuse in Self-Hosted Computer-Use Agents via TEE-Backed Isolation"},"reference_resolution":{"displayed":57,"state_counts":{"malformed_identifier":0,"metadata_mismatch":9,"parse_uncertain":0,"unresolved":2,"verified_exact":30,"verified_fuzzy":16},"total_outbound_references":57},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-06T06:34:29.942622+00:00","source":"crossref"},{"observed_at":"2026-08-06T06:34:23.284952+00:00","source":"retraction_watch"}],"thesis":"As of 6 August 2026, this Paper Citation Record lists 57 of 57 outbound references and 1 inbound Pith citation observation for arXiv:2605.06393."}