{"as_of":"2026-08-10T15:53:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:e949b6c83e6d249db1333274e13019d9b386e9424f1d5d074d624a4444a32eb6","coverage":[{"denominator":29,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":29,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-12T02:36:01.385664Z","state":"measured"},{"denominator":29,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":29,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.03423/citation-record","integrity":"/paper/2607.03423/integrity","json":"/paper/2607.03423/citation-record.json","paper":"/paper/2607.03423"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2302.04761","last_updated":"2023-02-09T16:49:57Z","snapshot_observed_at":"2026-07-06T14:50:07.491434Z","submitted_at":"2023-02-09T16:49:57Z","title":"Toolformer: Language Models Can Teach Themselves to Use Tools","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.04761","snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Toolformer: Language models can teach themselves to use tools","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"cited_paper":"/paper/2302.04761","citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:c5572543c3719ee2c1b6448127595420a63821aa80d3227895d3c01fb1089a5f","observation_id":"6d9cb9c1-b79c-40c4-838d-4cf32f3feb7c","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Re- act: Synergizing reasoning and acting in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:a6f6a0c20bc6a3fa4e4e543d729293dfe010c8e5837d1b2e45486d065bec87b1","observation_id":"a68f4694-6298-4351-821a-80afb2485982","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15334","last_updated":"2023-05-24T16:48:11Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-24T16:48:11Z","title":"Gorilla: Large Language Model Connected with Massive APIs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.15334","snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Patil, Tianjun Zhang, Xin Wang, and Joseph E","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"cited_paper":"/paper/2305.15334","citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:3fef4c1d567f69c65de6e347ad3ead842d40d33dd444c14d695437513b090acd","observation_id":"36e0c54d-935b-42bc-bee8-5d557df68c6e","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.16789","last_updated":"2023-10-03T14:45:48Z","snapshot_observed_at":"2026-07-06T16:00:46.542753Z","submitted_at":"2023-07-31T15:56:53Z","title":"ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.16789","snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Toolllm: Fa- cilitating large language models to master 16000+ real-world apis.arXiv preprint arXiv:2307.16789, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"cited_paper":"/paper/2307.16789","citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:716385adb0fa624c9d5b8f9a9600cc326f27085e7ef68a1822be9ee31143beea","observation_id":"5c402414-357a-4d53-9476-43d4d8b6bf1b","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Github Copilot coding agent, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:cedf5300bb0072b6878b0e6d59500c7390402a1b0a6638e0f20b6ad4c35c22de","observation_id":"b5a3a0f2-946c-4067-9ddb-e41f902da1a3","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Claude code, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:d0d40ee4fe4a2a100951243178e0d84c892ae4279fb87d9dd6041afd8d9a16f3","observation_id":"f421f7ac-05cd-49b3-88eb-ccf978dbcd95","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Codex CLI, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:2bd3842fe3c4a0736506026084629616cf300099d30de6f208af4ac6bf1daa89","observation_id":"de600818-f8b1-408b-a802-45bc1eba284a","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"STAC:Wheninnocenttools form dangerous chains to jailbreak LLM agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:8058caabc4fa56a1f7d15a51cec08721612ec4c10a6b607b828a1f1734313024","observation_id":"558a1d8f-b0fc-4e2a-ba14-2dfe0b0345d1","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"ChainFuzzer: Greybox fuzzing for workflow- levelmulti-toolvulnerabilitiesinLLMagents.arXiv preprint arXiv:2603.12614, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:8e30ec74e7a59f73e9495bdaa32caceeaaa26913ba73f25d014114564996accc","observation_id":"5a04ae7a-07b4-4192-995b-fa3fb5f7a616","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"MSA: A cross-MCP privacy attack via memory exfiltration of large language models","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:0e659f309c7c05b213f04ae442eaf09b7e6c64a57652d4da28175741ab2e10e4","observation_id":"efc53ed8-f136-4e2d-918b-91fa75e54067","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Silent egress: When implicit prompt injection makes LLM agents leak without a trace.arXiv preprint arXiv:2602.22450, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:c3584bd6f4243cda06fd4576de96d7c97da73b19f92d0e2cd74c82b89df2efa0","observation_id":"bcc55e16-145f-454f-b06a-4bf6ca00533a","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"MCP-ITP: An automated framework for implicit tool poisoning in MCP.arXiv preprint arXiv:2601.07395, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:0b2962effd9072e140486fdfe4e9388e635d52316e6d491841e0b889e11e84f8","observation_id":"68b40d21-9dac-4a58-98c3-49686626e3c4","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Model context protocol threat modeling and analyzing vulnerabilities to prompt injection with tool poisoning.arXiv preprint arXiv:2603.22489, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:4a12fc4043604c1f7be7a7be80a16c8116893cbe79016526e15fad09a0febacc","observation_id":"fe7c50c2-3ea6-4b54-98a0-7f8cdeae2fc4","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"MCP security bench (MSB): Benchmarking attacks against model context protocol in LLM agents.arXiv preprint arXiv:2510.15994, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:c41b59b5cc55cc40b29433ee5c04be6cd184fa30569772163f9b3200d7474399","observation_id":"214fc414-9d7e-436d-90b6-30b44ed5360c","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Function calling and other API updates,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:3497cc6c4b756415168b20abf028f94f96cb8e64e97525b0a45c044d0771c56e","observation_id":"20a33cf9-c714-4349-a5a9-0d2250ac505b","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Blog post, 13 June 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:e99b38b551fd72ee3197ce4f905649d14a72afb51b8af12859461efb4830febb","observation_id":"d271584e-7708-4a11-a7b8-deae2cb74ee8","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"LangChain, 2022","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:e6929e52e4024633a592e59e8b6ba39775f06279c0247dd6977ab16b85bfd372","observation_id":"858a85f1-9fff-424c-b8cb-1c98d61a10a3","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.08155","last_updated":"2023-10-03T20:47:10Z","snapshot_observed_at":"2026-08-08T22:28:26.004138Z","submitted_at":"2023-08-16T05:57:52Z","title":"AutoGen: Enabling Next-Gen LLM Applications via Multi-Agent Conversation","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.08155","snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"White, Doug Burger, and Chi Wang","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"cited_paper":"/paper/2308.08155","citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:f524ef470f0d5c4b74faac984167f6d0e6625a4cf74baeb972f44fddf413608b","observation_id":"93ceb349-420e-434e-95df-ec37ac343fb0","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"LaPadula","venue":null,"work_id":null,"year":1973},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:606e2493bd645180ad39ba59b6e440e41c1d95a8ce172fbbfaa75f93b4d24855","observation_id":"e2188785-cb14-4baa-9a43-48811239879c","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Microsoft frontier governance framework,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:2ee4a448e134f156dcacf26587ea6c1f45023bebd9413196e0d0829459528aea","observation_id":"d49cba52-79e1-4ddc-867b-b776ba068f74","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Accessed 2026-06-26","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:ecea0d7d1d72fb7e8fd1326b4f6aa3e84a4448bef0cc2df14a8e4c7e71e0eff3","observation_id":"8892f3d7-4cbd-4fbd-8ab9-c4b3d1548f1e","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Frontier safety framework, ver- sion 3.0, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:62e902b49c3975860934e09e1dd5e22ca9de62c88e4bfb09ef3d687c68ef85c4","observation_id":"d63d6aee-775b-4bb6-b946-fd5aef0097a0","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Responsible scaling policy, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:7e281707062afd77973eca16e02935e28a98f33453e0df7cfecbaef5d12b3d8b","observation_id":"fba40229-381d-41e6-abeb-6fefa49b3ae1","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Preparedness framework, version 2, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:5a4d51dfddadd4fee22d730916f49d5795ecce8f370207c4d0e68e8cc0a11bd5","observation_id":"bd88f5f7-4419-4ee7-8b06-f88514c8bf5b","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Regulation (EU) 2024/1689 of the euro- pean parliament and of the council laying down harmonised rules on artificial intelligence (Arti- ficial Intelligence Act)","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:2496af45d65ff7841474999bb3de42a73d0c18c3258517ceb138fa7b4affcc3b","observation_id":"c681967a-0bd6-4856-8c69-a29e87571757","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Managing misuse risk for dual-use foundation mod- els","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:0908bf5c23fcbd5335f2308659117a4a7376b1af24ea3ee3854f1b0af232e1ab","observation_id":"41831636-8752-48e9-971f-3c3a47e6177f","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"International AI safety report 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:d0e5ced84f563b2ffc6c67607bc7d7cf04b5a8f47da885a3d4e89b86131e2c66","observation_id":"cc807357-c607-4ff9-a067-137e174a4431","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15324","last_updated":"2023-09-22T18:48:42Z","snapshot_observed_at":"2026-08-08T14:17:44.034837Z","submitted_at":"2023-05-24T16:38:43Z","title":"Model evaluation for extreme risks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.15324","snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"cited_paper":"/paper/2305.15324","citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:1c9b553c109254be384dd794bbf9e62b792ca6498eaee97f0ed8344a745aefdd","observation_id":"8c1c4471-e678-41dd-81b0-679306396f64","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.11671","last_updated":"2024-01-04T18:46:39Z","snapshot_observed_at":"2026-07-06T17:04:54.448866Z","submitted_at":"2023-12-18T19:27:09Z","title":"Evaluating Language-Model Agents on Realistic Autonomous Tasks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.11671","snapshot_observed_at":"2026-07-12T02:36:01.385664Z","title":"Lin, Hjalmar Wijk, Joel Burget, Aaron Ho, Elizabeth Barnes, and Paul Christiano","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-07-12T02:36:01.385664Z"},"links":{"cited_paper":"/paper/2312.11671","citing_paper":"/paper/2607.03423"},"observation_digest":"sha256:34ad5dfa55c2b83959b5dd28d00ef6de0fcc344ebd76455d7fb169167f611df5","observation_id":"8a3b59b2-3665-463d-ba68-61b9d01f5ded","resolution":{"observed_at":"2026-07-12T02:36:01.385664Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.03423","last_updated":"2026-07-03T15:36:44Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-08T14:18:10.486519Z","submitted_at":"2026-07-03T15:36:44Z","title":"Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies"},"reference_resolution":{"displayed":29,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":29,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":29},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 29 of 29 outbound references and 0 inbound Pith citation observations for arXiv:2607.03423."}