{"as_of":"2026-08-22T02:08:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:2d41a237d74a2d1ba2fba223be4eb066d352911d85b9bbc299bb510e70596960","coverage":[{"denominator":33,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":33,"source":"paper_references, paper_reference_links","source_observed_at":"2026-07-31T23:24:19.584090Z","state":"measured"},{"denominator":33,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":33,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-21T06:32:19.484+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2607.23999/citation-record","integrity":"/paper/2607.23999/integrity","json":"/paper/2607.23999/citation-record.json","paper":"/paper/2607.23999"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2506.09956","last_updated":"2025-06-11T17:30:07Z","snapshot_observed_at":"2026-08-16T05:05:43.573600Z","submitted_at":"2025-06-11T17:30:07Z","title":"LLMail-Inject: A Dataset from a Realistic Adaptive Prompt Injection Challenge","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.09956","snapshot_observed_at":"2026-07-31T23:24:19.497728Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.497728Z"},"links":{"cited_paper":"/paper/2506.09956","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:ee9094d59a6739a4d37ffcb41da137ea86513527a666be11bf2ff285d1e848e6","observation_id":"aeac695c-9b02-4acc-84eb-a808e7344957","resolution":{"observed_at":"2026-07-31T23:24:19.497728Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.10986","last_updated":"2024-05-15T20:28:15Z","snapshot_observed_at":"2026-08-20T17:33:36.327360Z","submitted_at":"2024-05-15T20:28:15Z","title":"Benchmark Early and Red Team Often: A Framework for Assessing and Managing Dual-Use Hazards of AI Foundation Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.10986","snapshot_observed_at":"2026-07-31T23:24:19.501291Z","title":"Barrett, Krystal Jackson, Evan R","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.501291Z"},"links":{"cited_paper":"/paper/2405.10986","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:1151ee12d158314722b8303f1bf533114083b29fb2ad149c1d224d01265e5550","observation_id":"9ee9772c-52c1-40c9-8507-5291b06a9e54","resolution":{"observed_at":"2026-07-31T23:24:19.501291Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.23374","last_updated":"2026-04-25T16:39:16Z","snapshot_observed_at":"2026-08-15T03:12:46.423691Z","submitted_at":"2026-04-25T16:39:16Z","title":"Ghost in the Agent: Redefining Information Flow Tracking for LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.23374","snapshot_observed_at":"2026-07-31T23:24:19.504351Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.504351Z"},"links":{"cited_paper":"/paper/2604.23374","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:681f1067428418e75a219dbbab1d3e852b2959b67a0bbb4a90b27cef3d451cee","observation_id":"9717f0fd-4b9e-41f1-9000-9311b93b6de6","resolution":{"observed_at":"2026-07-31T23:24:19.504351Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.01318","last_updated":"2024-10-31T22:26:40Z","snapshot_observed_at":"2026-08-11T16:28:21.917686Z","submitted_at":"2024-03-28T02:44:02Z","title":"JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.01318","snapshot_observed_at":"2026-07-31T23:24:19.507389Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.507389Z"},"links":{"cited_paper":"/paper/2404.01318","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:cedf93d062ddb947820eea2102466aac61aff5e6cb1ea762f430c56590277e74","observation_id":"c08ec257-4107-4c63-bc5b-6e3e968135b9","resolution":{"observed_at":"2026-07-31T23:24:19.507389Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-19T16:46:32.130363Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-07-31T23:24:19.510770Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.510770Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:7de2f709c0d6961254082f2744a3e70abc52d592658ae3e22f56067d8f85ee66","observation_id":"f15623fb-4e63-48a7-a836-0c8851e6a052","resolution":{"observed_at":"2026-07-31T23:24:19.510770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.05451","last_updated":"2025-07-03T05:45:41Z","snapshot_observed_at":"2026-08-16T13:11:45.940997Z","submitted_at":"2024-10-07T19:34:35Z","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.05451","snapshot_observed_at":"2026-07-31T23:24:19.513672Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.513672Z"},"links":{"cited_paper":"/paper/2410.05451","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:0f86bb1741c03d3362471d922a7bd2ce81bfaeb586c9528d2ffdbb4ced0c3a5d","observation_id":"7e004625-42f8-46f4-ada6-d0988f2534ca","resolution":{"observed_at":"2026-07-31T23:24:19.513672Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-07-31T23:24:19.517062Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.517062Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:f48fc3fd133ead1f576368a1414d1e227eac9e73c9d589073417d4bc5d051801","observation_id":"4cd445f0-290a-4c60-b6b6-7af7ddf3b826","resolution":{"observed_at":"2026-07-31T23:24:19.517062Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-20T10:01:00.326084Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-07-31T23:24:19.519727Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.519727Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:4a161b7d04211458bb2c8ad9341f901593c1bfaef2d1ea4d8b294282c42d265f","observation_id":"57c374de-2176-4142-b4ef-4b8e297b7b86","resolution":{"observed_at":"2026-07-31T23:24:19.519727Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.13352","last_updated":"2024-11-24T22:04:23Z","snapshot_observed_at":"2026-07-06T18:33:32.806635Z","submitted_at":"2024-06-19T08:55:56Z","title":"AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.13352","snapshot_observed_at":"2026-07-31T23:24:19.522434Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.522434Z"},"links":{"cited_paper":"/paper/2406.13352","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:868adde9ebb799f3079eec60512c41410878dc8b32a9a5246cf373a31edeae2f","observation_id":"03d99116-2a6c-42d7-a133-65f741bf37b5","resolution":{"observed_at":"2026-07-31T23:24:19.522434Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.08499","last_updated":"2026-04-09T17:42:45Z","snapshot_observed_at":"2026-08-12T13:54:24.443320Z","submitted_at":"2026-04-09T17:42:45Z","title":"PIArena: A Platform for Prompt Injection Evaluation","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.08499","snapshot_observed_at":"2026-07-31T23:24:19.525298Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.525298Z"},"links":{"cited_paper":"/paper/2604.08499","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:045437e9ec4642cf13d4b5f20ec208213411e4241bd15b3522817c7f1ba73703","observation_id":"40160c12-7f09-4560-81c3-d5c55c8cb5ba","resolution":{"observed_at":"2026-07-31T23:24:19.525298Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.12173","last_updated":"2023-05-05T14:26:17Z","snapshot_observed_at":"2026-08-12T14:45:22.117576Z","submitted_at":"2023-02-23T17:14:38Z","title":"Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.12173","snapshot_observed_at":"2026-07-31T23:24:19.528297Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.528297Z"},"links":{"cited_paper":"/paper/2302.12173","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:425354282b87f473c7c18dd61e0bd4723dac831efa38a007f68a343bc51a541f","observation_id":"821494c3-93b2-4b8e-bb2f-c9f4f9c18a25","resolution":{"observed_at":"2026-07-31T23:24:19.528297Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-31T23:24:19.530826Z","title":null,"venue":null,"work_id":null,"year":2013},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.530826Z"},"links":{"citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:29d153a624dbc19e915ae475ca38e61058ae967ecf851a8b677bfbcc93403a3b","observation_id":"3c6d3d66-f670-4597-ba6b-f672b28a96b4","resolution":{"observed_at":"2026-07-31T23:24:19.530826Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-31T23:24:19.533172Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.533172Z"},"links":{"citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:70567cfb93687ad2a69a756241c40b775a5fcd1d83b9ec81a897800977c29099","observation_id":"9cd601ce-f0bd-4cc9-b8d2-48f47dc6a814","resolution":{"observed_at":"2026-07-31T23:24:19.533172Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2603.10749","last_updated":"2026-06-10T06:18:26Z","snapshot_observed_at":"2026-08-15T05:10:01.916759Z","submitted_at":"2026-03-11T13:23:46Z","title":"AttriGuard: Defeating Indirect Prompt Injection in LLM Agents via Causal Attribution of Tool Invocations","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2603.10749","snapshot_observed_at":"2026-07-31T23:24:19.535536Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.535536Z"},"links":{"cited_paper":"/paper/2603.10749","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:646f551b894500776b67d8f31e0c0ed646d7816702094d9b3a04b5bdf8ebd0c4","observation_id":"2ee13d19-4e71-44e9-879b-70ece1bc97b3","resolution":{"observed_at":"2026-07-31T23:24:19.535536Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-12T03:14:31.288757Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-07-31T23:24:19.538321Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.538321Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:997749efccb4b1f804b9a654c28c831b1d4a082b3d3de72a584808566599c10f","observation_id":"1847c81d-a1bd-4925-8204-fb4336c41cec","resolution":{"observed_at":"2026-07-31T23:24:19.538321Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-31T23:24:19.541489Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.541489Z"},"links":{"citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:7e8d9bd7c9f14211eaea64f2eda586e2a229cd7d0522a4a534ce59341adcda5e","observation_id":"537025d7-8b68-47e8-bd76-5ffb88b6a598","resolution":{"observed_at":"2026-07-31T23:24:19.541489Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-31T23:24:19.543798Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.543798Z"},"links":{"citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:8fdd0e32898157ce28bce4f5b6c325e94e73f4f3814893cc7ab9f998b3d7c1f1","observation_id":"79dd798b-0af9-4051-ae66-5709aa246531","resolution":{"observed_at":"2026-07-31T23:24:19.543798Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2602.03117","last_updated":"2026-05-07T07:42:14Z","snapshot_observed_at":"2026-08-11T14:17:58.581691Z","submitted_at":"2026-02-03T05:20:42Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.03117","snapshot_observed_at":"2026-07-31T23:24:19.546238Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.546238Z"},"links":{"cited_paper":"/paper/2602.03117","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:5b8e16bde903a5390522b474b89d3908b45c4b268b52d8180e9de63f6d2be9ad","observation_id":"eaa2c2ad-ef7c-4974-ae9c-874e66312460","resolution":{"observed_at":"2026-07-31T23:24:19.546238Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-31T23:24:19.548846Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.548846Z"},"links":{"citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:f80ed7866d77f53a5d7963694f1d72aedc3c921749f08b634bb7a991c99ab3ce","observation_id":"0e5ab8cb-f451-44f9-9b0e-829a48db625a","resolution":{"observed_at":"2026-07-31T23:24:19.548846Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-31T23:24:19.551189Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.551189Z"},"links":{"citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:a351174428e59342193b34c67c023b8fb33cd9fbeb3ce903ac7f151688e4b152","observation_id":"ec202576-c99d-448f-8282-f480d312a74b","resolution":{"observed_at":"2026-07-31T23:24:19.551189Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.15338","last_updated":"2026-05-18T07:05:25Z","snapshot_observed_at":"2026-08-14T01:42:26.007821Z","submitted_at":"2026-05-14T19:06:10Z","title":"Hidden in Memory: Sleeper Memory Poisoning in LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.15338","snapshot_observed_at":"2026-07-31T23:24:19.553643Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.553643Z"},"links":{"cited_paper":"/paper/2605.15338","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:1379cbf1f42f662776d9a3d6a46ba006e5624c2925e8867f5b2dc388c8c2d3f0","observation_id":"df633017-c20f-4002-931b-59ffa8d091b3","resolution":{"observed_at":"2026-07-31T23:24:19.553643Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.06508","last_updated":"2026-05-07T16:21:26Z","snapshot_observed_at":"2026-07-06T23:18:55.724335Z","submitted_at":"2026-05-07T16:21:26Z","title":"On the Security of Research Artifacts","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.06508","snapshot_observed_at":"2026-07-31T23:24:19.556466Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.556466Z"},"links":{"cited_paper":"/paper/2605.06508","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:ffd7fddd9dcb376bfa808c45c9320cb15f0063495cc4c2e843a7a9fa6f3b1b1d","observation_id":"9d7b2f26-314f-449a-aa5c-5bad1cab13e5","resolution":{"observed_at":"2026-07-31T23:24:19.556466Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.01263","last_updated":"2024-04-01T11:50:35Z","snapshot_observed_at":"2026-08-20T18:53:27.304270Z","submitted_at":"2023-08-02T16:30:40Z","title":"XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.01263","snapshot_observed_at":"2026-07-31T23:24:19.559009Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.559009Z"},"links":{"cited_paper":"/paper/2308.01263","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:e24fbd4ee138424fb8862960a5b8625c4ce4bd4d36bba56e7e24175d605380ae","observation_id":"a6561c55-5b02-4db0-9230-688998f169c5","resolution":{"observed_at":"2026-07-31T23:24:19.559009Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.15324","last_updated":"2023-09-22T18:48:42Z","snapshot_observed_at":"2026-08-18T23:10:44.101812Z","submitted_at":"2023-05-24T16:38:43Z","title":"Model evaluation for extreme risks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.15324","snapshot_observed_at":"2026-07-31T23:24:19.561447Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.561447Z"},"links":{"cited_paper":"/paper/2305.15324","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:d7479216aec33d209744c75dcf47143964c133601c1f917b525739af51760af2","observation_id":"91461674-e372-43c8-b8fd-57db70a1d14f","resolution":{"observed_at":"2026-07-31T23:24:19.561447Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-08-17T13:35:14.591010Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-07-31T23:24:19.564377Z","title":null,"venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.564377Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:5810389e8e7b29c5c1e203bb93facbd73757400a8ea0b824e052f9372a569d25","observation_id":"05ea2542-c8a2-4670-b3ae-2a66fa62a11d","resolution":{"observed_at":"2026-07-31T23:24:19.564377Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-07-31T23:24:19.567115Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.567115Z"},"links":{"citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:b9364431c3e0fe30a950ec0cf492f6f89d51e2ba1291aedefe872e78cd7a4c40","observation_id":"93f01eca-e0a2-46bd-b77f-26dffe350b4e","resolution":{"observed_at":"2026-07-31T23:24:19.567115Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.10260","last_updated":"2024-08-27T03:32:47Z","snapshot_observed_at":"2026-08-20T20:23:20.798055Z","submitted_at":"2024-02-15T18:58:09Z","title":"A StrongREJECT for Empty Jailbreaks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.10260","snapshot_observed_at":"2026-07-31T23:24:19.569415Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.569415Z"},"links":{"cited_paper":"/paper/2402.10260","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:8ee27f56bae79cc85967b7391e6cde63f82d179105e48050b02665128d6f1467","observation_id":"f59612fe-e213-458a-ad2b-960d48303897","resolution":{"observed_at":"2026-07-31T23:24:19.569415Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.26497","last_updated":"2026-05-26T03:20:23Z","snapshot_observed_at":"2026-08-21T08:30:11.305434Z","submitted_at":"2026-05-26T03:20:23Z","title":"Aligning Provenance with Authorization: A Dual-Graph Defense for LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.26497","snapshot_observed_at":"2026-07-31T23:24:19.571879Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.571879Z"},"links":{"cited_paper":"/paper/2605.26497","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:0780c9ceb21d334363b405536cc4c82ef210c311a073dd0b119d7d8757aa19ed","observation_id":"05761911-becf-4f48-8109-c5106db028bc","resolution":{"observed_at":"2026-07-31T23:24:19.571879Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01194","last_updated":"2026-07-25T19:27:27Z","snapshot_observed_at":"2026-08-18T11:12:57.466717Z","submitted_at":"2026-04-01T17:40:03Z","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.01194","snapshot_observed_at":"2026-07-31T23:24:19.574454Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.574454Z"},"links":{"cited_paper":"/paper/2604.01194","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:9e59a31f59376882ebc9b9f1b800addbf662d556337c9b59156ccfb94c39bb56","observation_id":"6461035e-c70b-4983-b037-2ce642539fa6","resolution":{"observed_at":"2026-07-31T23:24:19.574454Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.14197","last_updated":"2025-01-27T08:51:16Z","snapshot_observed_at":"2026-08-20T04:34:32.315379Z","submitted_at":"2023-12-21T01:08:39Z","title":"Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.14197","snapshot_observed_at":"2026-07-31T23:24:19.576853Z","title":null,"venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.576853Z"},"links":{"cited_paper":"/paper/2312.14197","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:2022325265829dd1c7934cd19b2ca506fe8b7999b45e40df2ee555c45ce4a651","observation_id":"db4457de-bbd2-4963-a793-ecef3e38fac2","resolution":{"observed_at":"2026-07-31T23:24:19.576853Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2603.13026","last_updated":"2026-07-23T13:46:08Z","snapshot_observed_at":"2026-08-15T23:44:19.312473Z","submitted_at":"2026-03-13T14:34:54Z","title":"PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2603.13026","snapshot_observed_at":"2026-07-31T23:24:19.579327Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.579327Z"},"links":{"cited_paper":"/paper/2603.13026","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:7465f1e1a0a4dabbc3535fc1dcc506675c47dcd8928c7b9c218c2aee86204db1","observation_id":"518f7e29-b41a-4e0c-9ac4-e543b5e30a0c","resolution":{"observed_at":"2026-07-31T23:24:19.579327Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.02691","last_updated":"2024-08-04T04:52:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2024-03-05T06:21:45Z","title":"InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.02691","snapshot_observed_at":"2026-07-31T23:24:19.581798Z","title":null,"venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.581798Z"},"links":{"cited_paper":"/paper/2403.02691","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:5f71ff2a50d5856a8c7466b76cc4187fe486b5cded0d5fe56b4d579a986b8921","observation_id":"b9707586-dd10-4ae5-9fcc-3f98054edf33","resolution":{"observed_at":"2026-07-31T23:24:19.581798Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-08-12T15:01:26.208104Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.11790","snapshot_observed_at":"2026-07-31T23:24:19.584090Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-07-31T23:24:19.584090Z"},"links":{"cited_paper":"/paper/2604.11790","citing_paper":"/paper/2607.23999"},"observation_digest":"sha256:579d055eee02133dce497a761dcb5f4236c18edc06be22628aeb5ae6afc40a8e","observation_id":"e18f42e5-3596-43bb-acbc-680fa8fce847","resolution":{"observed_at":"2026-07-31T23:24:19.584090Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2607.23999","last_updated":"2026-07-28T07:27:46Z","latest_version":2,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-15T13:44:43.771184Z","submitted_at":"2026-07-27T04:51:20Z","title":"ContainmentBench: Trace-Based Evaluation of Post-Injection Containment in Tool-Using LLM Agents"},"reference_resolution":{"displayed":33,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":33,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":33},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-21T06:32:19.484+00:00","source":"crossref"},{"observed_at":"2026-08-21T06:32:16.066871+00:00","source":"retraction_watch"}],"thesis":"As of 22 August 2026, this Paper Citation Record lists 33 of 33 outbound references and 0 inbound Pith citation observations for arXiv:2607.23999."}