{"as_of":"2026-08-18T23:25:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:57fb77445199b461c25972fbd3be9fa89f623ad6a8e48f42ac8c86fd13c9825b","coverage":[{"denominator":23,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":23,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-01T15:07:27.137476Z","state":"measured"},{"denominator":23,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":23,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-18T06:34:40.430872+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.19432/citation-record","integrity":"/paper/2607.19432/integrity","json":"/paper/2607.19432/citation-record.json","paper":"/paper/2607.19432"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.078957Z","title":"Introducing the Model Context Protocol,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.078957Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:fd9fa8be0d9592a7e87b954ae15ef4b438554673367f4445bc1f579caba5ddf7","observation_id":"297ecb51-a18b-4f54-92bf-ea852bf64b3f","resolution":{"observed_at":"2026-08-01T15:07:25.078957Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.23278","last_updated":"2025-10-07T07:13:32Z","snapshot_observed_at":"2026-08-14T03:34:08.418318Z","submitted_at":"2025-03-30T01:58:22Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.23278","snapshot_observed_at":"2026-08-01T15:07:25.375608Z","title":"Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.375608Z"},"links":{"cited_paper":"/paper/2503.23278","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:cf5f0553b27cb3dc7127b97c6f3d2839c65ce118d448ad60ea328ddf9f89fedd","observation_id":"7fcd43c2-53aa-4586-b12f-09ea20480fdb","resolution":{"observed_at":"2026-08-01T15:07:25.375608Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.544016Z","title":"MCP Security Notification: Tool Poison- ing Attacks and GitHub MCP Prompt Injection,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.544016Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:903f6f6d96455574e6c6423be6a0b03d67e707c5a784eec5b689974d3505ba4f","observation_id":"04849e86-e6cb-4d28-b1be-e6afc5c30c46","resolution":{"observed_at":"2026-08-01T15:07:25.544016Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.602557Z","title":"WhatsApp MCP Exploited via Rug-Pull At- tack,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.602557Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:a9c9f0252cf379b5910532d4fe5562cc5e293bdf0e9ed4b5a62832f2ece05830","observation_id":"cf71caf9-db01-46bd-968c-f1304c3ddaaa","resolution":{"observed_at":"2026-08-01T15:07:25.602557Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2509.25624","last_updated":"2026-07-19T03:06:33Z","snapshot_observed_at":"2026-08-18T07:13:14.326527Z","submitted_at":"2025-09-30T00:31:44Z","title":"STAC: When Innocent Tools Form Dangerous Chains for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2509.25624","snapshot_observed_at":"2026-08-01T15:07:25.693636Z","title":"STAC: When Innocent Tools Form Dangerous Chains to Jailbreak LLM Agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.693636Z"},"links":{"cited_paper":"/paper/2509.25624","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:60dbc8405befd30ee5e686f6a86f7857fef9527ff7fd4d39c2f5fec7c50de919","observation_id":"0881bdf9-edf7-46d9-bf0c-d7d0962ec40f","resolution":{"observed_at":"2026-08-01T15:07:25.693636Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.774651Z","title":"The Promptware Kill Chain,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.774651Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:7a80d722df08eeaea55898d7b2eff481d00e54499fb16d1a2ca16f3d419e1dde","observation_id":"65f1943e-24c4-473c-9887-ab358dc24999","resolution":{"observed_at":"2026-08-01T15:07:25.774651Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.951008Z","title":"MCPShield: A Security Cognition Layer for Adaptive Trust Calibration in Model Context Protocol Agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.951008Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:bd5375d9e34cf01d148e4252a8981848c99214480f2e1cb2f5f9ae3724f56961","observation_id":"6b5ead94-6e06-456a-a533-e26dd79ef1c2","resolution":{"observed_at":"2026-08-01T15:07:25.951008Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.076931Z","title":"MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.076931Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:ecd1e574e152b6711c0bc05fcd93bd110458d2b8e023ae0037e1bb49b607b249","observation_id":"f1ba299a-d8ca-40a0-93da-835264868d79","resolution":{"observed_at":"2026-08-01T15:07:26.076931Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.138141Z","title":"MindGuard: Tracking, Detecting, and Attributing MCP Tool Poisoning Attack via Decision Dependence Graph,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.138141Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:620bf4b2b1642f022ec7ff3322c58843d873991ff83a8cc3e5973b6fc215cba2","observation_id":"00143c95-048a-4af2-a9b5-3d83aadadea0","resolution":{"observed_at":"2026-08-01T15:07:26.138141Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.188371Z","title":"MCPTox: A Benchmark for Tool Poisoning on Real-World MCP Servers,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.188371Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:f1acb0f4e7bb626b0338b7a19ab5d795bab250b565ea4545d17506816ce3c528","observation_id":"5d1b7a0b-8918-4914-97de-e8df3ed51067","resolution":{"observed_at":"2026-08-01T15:07:26.188371Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2506.02040","last_updated":"2025-09-14T07:48:51Z","snapshot_observed_at":"2026-08-12T23:17:01.506390Z","submitted_at":"2025-05-31T08:01:11Z","title":"Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.02040","snapshot_observed_at":"2026-08-01T15:07:26.264517Z","title":"Beyond the Protocol: Empirical Analysis of MCP Attack Scenarios,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.264517Z"},"links":{"cited_paper":"/paper/2506.02040","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:c5d2e3b5087daf85fb7b44d43e8d9f256ebe2b0a8768760a1cb28e16dd2e818d","observation_id":"ac9760dd-fcee-4ada-9c1f-9d509e6b9ad9","resolution":{"observed_at":"2026-08-01T15:07:26.264517Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.325748Z","title":"A systematic survey on multi- step attack detection,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.325748Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:cbb214894f2ff73a40ac5cd4cb7ab25c0e66cf431e932fac83a62fa5d956666f","observation_id":"5160222a-3cc9-4d01-9c55-94a5df232b4b","resolution":{"observed_at":"2026-08-01T15:07:26.325748Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.441209Z","title":"Real-time multistep attack prediction based on hidden Markov models,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.441209Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:d6a9696bdaecebaf23c34f43afe6c2a444ddd1de5f1981ff5efb9dc1e905347a","observation_id":"773bc88e-6868-40d6-8314-ee3e5b2081b4","resolution":{"observed_at":"2026-08-01T15:07:26.441209Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.534645Z","title":"KAIROS: Practical Intrusion Detection and Investigation using Whole- system Provenance,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.534645Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:be81c37deafa9df17817ce32efba1ec860de96b783852de7265d62a01ad0d119","observation_id":"a689a81e-7bc8-4f53-a1c5-e2e4fb0545ef","resolution":{"observed_at":"2026-08-01T15:07:26.534645Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.594388Z","title":"MAAC: Multi-step Attack Alert Correlation using Semantic Vectorization,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.594388Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:53b11ae014581f730c4b11459b58e870ea32431ec71dbe2ca2745ddfdced2825","observation_id":"3205e2af-fccb-4420-b4f0-10af8a31d27b","resolution":{"observed_at":"2026-08-01T15:07:26.594388Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.03767","last_updated":"2025-04-11T16:59:05Z","snapshot_observed_at":"2026-08-16T12:44:27.261973Z","submitted_at":"2025-04-02T21:46:02Z","title":"MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.03767","snapshot_observed_at":"2026-08-01T15:07:26.667184Z","title":"MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Vulnerabilities,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.667184Z"},"links":{"cited_paper":"/paper/2504.03767","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:9913ed59f01a6a96be971f69bbc3dcd015bb90bd072ddbae0241ea0c8cfccc54","observation_id":"419dc962-5f29-4880-9bb4-9ac28e2d0310","resolution":{"observed_at":"2026-08-01T15:07:26.667184Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.724243Z","title":"MCP-SafetyBench: A Benchmark for Safety Evaluation of Large Language Models with Real- World MCP Servers,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.724243Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:0086f92415991594c701f4c3ae659a4ef5a0b2ec39f867740284f4cb5cb49cb5","observation_id":"f8e68bd0-9940-4d46-a07c-075d574fcc25","resolution":{"observed_at":"2026-08-01T15:07:26.724243Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.08623","last_updated":"2025-05-02T18:26:39Z","snapshot_observed_at":"2026-08-16T12:41:58.226065Z","submitted_at":"2025-04-11T15:25:58Z","title":"Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.08623","snapshot_observed_at":"2026-08-01T15:07:26.820487Z","title":"Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.820487Z"},"links":{"cited_paper":"/paper/2504.08623","citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:4bbb992be54c41c634b77b858797abdb6a5d9de742517058dbec4c1d7369cc62","observation_id":"bba5fd3a-39c3-46de-b413-da05b33b197e","resolution":{"observed_at":"2026-08-01T15:07:26.820487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:26.947983Z","title":"Temporal Attack Pattern Detection in Multi-Agent AI Workflows: An Open Framework for Training Trace-Based Security Models,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:26.947983Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:b0a1598c090f47bbac2c02203feb0431d6ea9efd7f284883bc49b6aeda1a7f20","observation_id":"81f4d9d6-bcbd-4dce-a97d-b887707ba0fe","resolution":{"observed_at":"2026-08-01T15:07:26.947983Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:27.040743Z","title":"From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:27.040743Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:b30bd23e86d2f645d9c0db4c9a5912b653fc1914e63c469f638ad1fe3c59bdde","observation_id":"480047d8-bc68-41a9-a14e-5ea1cdd6f4c3","resolution":{"observed_at":"2026-08-01T15:07:27.040743Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:27.073413Z","title":"Cross-Agent Privilege Escalation: When Agents Free Each Other,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:27.073413Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:60ad765341d4df033bc6a4005aa42de6d633154e60baa8060818fe8ddddf5172","observation_id":"11ef57fd-0de9-4141-a9b8-845aaf3494d7","resolution":{"observed_at":"2026-08-01T15:07:27.073413Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:27.137476Z","title":"Poison Everywhere: No Output from Your MCP Server is Safe,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:27.137476Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:b6b67d1407f4b869467a8bd4da99e435bcb11420079ebead0b65f01631786a05","observation_id":"8c0ed8bd-ff51-4e02-b3e7-88c98fe23732","resolution":{"observed_at":"2026-08-01T15:07:27.137476Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-01T15:07:25.234002Z","title":"Available: https://www.anthropic.com/news/ model-context-protocol","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-01T15:07:25.234002Z"},"links":{"citing_paper":"/paper/2607.19432"},"observation_digest":"sha256:c5ccb36d20ec70281075647ceb0a2a9628df23214ba15cbf535a1b381356f11a","observation_id":"a8fa1f76-858c-4d0a-8631-7fbab9b279bb","resolution":{"observed_at":"2026-08-01T15:07:25.234002Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.19432","last_updated":"2026-07-20T22:36:26Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-18T10:01:01.057485Z","submitted_at":"2026-07-20T22:36:26Z","title":"ChainWatch: A Kill Chain-Aligned Sequential Detection Framework for Multi-Step Attacks in MCP-Based AI Agent Systems"},"reference_resolution":{"displayed":23,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":23,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":23},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"thesis":"As of 18 August 2026, this Paper Citation Record lists 23 of 23 outbound references and 0 inbound Pith citation observations for arXiv:2607.19432."}