{"as_of":"2026-08-09T11:27:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:f7dfdcb24de1cacf677854df00b0f3e47074e0f709331cd158983e6d3d13a581","coverage":[{"denominator":27,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":27,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-05T04:17:02.594840Z","state":"measured"},{"denominator":27,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":27,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.00747/citation-record","integrity":"/paper/2608.00747/integrity","json":"/paper/2608.00747/citation-record.json","paper":"/paper/2608.00747"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2211.09527","last_updated":"2022-11-17T13:43:20Z","snapshot_observed_at":"2026-07-06T14:19:47.424778Z","submitted_at":"2022-11-17T13:43:20Z","title":"Ignore Previous Prompt: Attack Techniques For Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2211.09527","snapshot_observed_at":"2026-08-05T04:17:02.494770Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.494770Z"},"links":{"cited_paper":"/paper/2211.09527","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:93f40d1619727b191d5f7b1c728078d3d90675a87ebac027584c1d63866a08a5","observation_id":"bb170696-a993-47e8-ac53-8a7eea8e35f0","resolution":{"observed_at":"2026-08-05T04:17:02.494770Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.499370Z","title":"Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.499370Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:32ac9d727360e978937c65e723e7aa37da3a7c173ffcb6b927be08f76b0225d3","observation_id":"e51ae8f8-dfe0-4058-aeab-bfe27432df12","resolution":{"observed_at":"2026-08-05T04:17:02.499370Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.06322","last_updated":"2025-01-10T19:56:50Z","snapshot_observed_at":"2026-07-30T22:07:13.869232Z","submitted_at":"2025-01-10T19:56:50Z","title":"Multi-Agent Collaboration Mechanisms: A Survey of LLMs","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.06322","snapshot_observed_at":"2026-08-05T04:17:02.503427Z","title":"Multi-agent collaboration mechanisms: A survey of llms,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.503427Z"},"links":{"cited_paper":"/paper/2501.06322","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:210ba6d99a08eadd05257bfd2c436469c6fe5b6808f2df6ff5166f807078b93c","observation_id":"7c2b1b60-bd8f-485e-ba4e-d4076050b839","resolution":{"observed_at":"2026-08-05T04:17:02.503427Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.507970Z","title":"A survey of llm-driven ai agent communication: Protocols, security risks, and defense countermeasures,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.507970Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:ecb9ab90437317631c68395fca6916ab8942324c42dd99bb4764235915c64859","observation_id":"ce38dc26-2af1-4fe8-ab2e-b556bf871fa2","resolution":{"observed_at":"2026-08-05T04:17:02.507970Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19793","last_updated":"2025-08-24T03:28:21Z","snapshot_observed_at":"2026-08-01T07:24:09.967062Z","submitted_at":"2025-04-28T13:36:43Z","title":"Prompt Injection Attack to Tool Selection in LLM Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.19793","snapshot_observed_at":"2026-08-05T04:17:02.512504Z","title":"Prompt injection attack to tool selection in llm agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.512504Z"},"links":{"cited_paper":"/paper/2504.19793","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:e869751af9115ac210fe4a55c5543aa90e06b99435f1e35a3d0b14b0e7f2cabc","observation_id":"b3b9ed97-2620-415b-96a6-711d66e37531","resolution":{"observed_at":"2026-08-05T04:17:02.512504Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.516491Z","title":"Agentpoison: Red- teaming llm agents via poisoning memory or knowledge bases,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.516491Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:ef26ea81c9acfa3029346dc661d71b534fee31416b2d9dce32fdff517d37c696","observation_id":"558cf644-7c68-49fd-9844-57c81c380287","resolution":{"observed_at":"2026-08-05T04:17:02.516491Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.520587Z","title":"Memory injection attacks on llm agents via query-only interaction,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.520587Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:3af6a64f3208f8dc32e7fbfc311b036211b25e98d6c55747e81684c0d3ea6df6","observation_id":"f5e615bf-34cc-4b35-992c-a4881832719f","resolution":{"observed_at":"2026-08-05T04:17:02.520587Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.524559Z","title":"Prompt infection: Llm-to-llm prompt injection within multi-agent systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.524559Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:fe9aad486fe0d40fac9585d887ddaefdc8931300f9fb6ce4eff6966e7e7413da","observation_id":"b85e4991-a6ec-41a2-ab09-3bd45cd0dd9f","resolution":{"observed_at":"2026-08-05T04:17:02.524559Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.01680","last_updated":"2024-04-19T01:15:16Z","snapshot_observed_at":"2026-08-06T19:10:15.466826Z","submitted_at":"2024-01-21T23:36:14Z","title":"Large Language Model based Multi-Agents: A Survey of Progress and Challenges","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.01680","snapshot_observed_at":"2026-08-05T04:17:02.527779Z","title":"Large language model based multi-agents: A survey of progress and challenges,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.527779Z"},"links":{"cited_paper":"/paper/2402.01680","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:f07d58181f7726b5c7f1feaba7c5c8fa15b3e7a4b3ab4f14538147243ef261cd","observation_id":"a13f49f7-e8f2-4232-9e0b-09ee727c3222","resolution":{"observed_at":"2026-08-05T04:17:02.527779Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.12442","last_updated":"2025-06-17T15:37:58Z","snapshot_observed_at":"2026-08-07T15:43:38.945053Z","submitted_at":"2025-05-18T14:31:45Z","title":"IP Leakage Attacks Targeting LLM-Based Multi-Agent Systems","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.12442","snapshot_observed_at":"2026-08-05T04:17:02.531826Z","title":"Ip leakage attacks targeting llm-based multi-agent systems,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.531826Z"},"links":{"cited_paper":"/paper/2505.12442","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:ba3fbbd9fa69f842bd97852d65d6d20905362f6d3e0584a6a80b51d5acae8b68","observation_id":"d1181928-a6dd-4bc4-81e2-21c2891f11cb","resolution":{"observed_at":"2026-08-05T04:17:02.531826Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.12188","last_updated":"2025-09-12T19:53:17Z","snapshot_observed_at":"2026-08-07T17:01:45.148471Z","submitted_at":"2025-03-15T16:16:08Z","title":"Multi-Agent Systems Execute Arbitrary Malicious Code","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.12188","snapshot_observed_at":"2026-08-05T04:17:02.535609Z","title":"Multi-agent systems execute arbitrary malicious code,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.535609Z"},"links":{"cited_paper":"/paper/2503.12188","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:76b95d390a08f6783a67403cdc30692f1ca3dcdda3b95e02535bc86e5dd39825","observation_id":"df05d453-c18f-46f1-af60-291b8c858210","resolution":{"observed_at":"2026-08-05T04:17:02.535609Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.539306Z","title":"Red-teaming llm multi-agent systems via communication attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.539306Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:a420395a487a385fd4517fb28262e1a0059cc3826547394503155b494e935604","observation_id":"a261c141-7ae3-4579-b997-dfd297475108","resolution":{"observed_at":"2026-08-05T04:17:02.539306Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.543199Z","title":"Breaking agents: Compromising autonomous llm agents through malfunction amplification,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.543199Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:a7329fb01716247bc964b771b16a954e33d985c4271545040ce16194800151a1","observation_id":"8af621a0-4dd1-4298-be2e-110119c99a48","resolution":{"observed_at":"2026-08-05T04:17:02.543199Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.20242","last_updated":"2026-06-09T05:19:18Z","snapshot_observed_at":"2026-07-06T18:53:31.241776Z","submitted_at":"2024-07-16T13:13:16Z","title":"BadRobot: Jailbreaking Embodied LLM Agents in the Physical World","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.20242","snapshot_observed_at":"2026-08-05T04:17:02.546665Z","title":"Badrobot: Jailbreaking embodied llms in the physical world,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.546665Z"},"links":{"cited_paper":"/paper/2407.20242","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:5b34dbda09cd183bf61d903856322e4243576890dd532a3a3ab7bca05e9b5b40","observation_id":"59e1107c-10eb-4979-88e4-7a47f7bb4241","resolution":{"observed_at":"2026-08-05T04:17:02.546665Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.550312Z","title":"A study on prompt injection attack against llm-integrated mobile robotic systems,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.550312Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:de8c88c7981a1185b8dbc907d706c3b3a2278a38885d55b2dc0bf155bb380e8d","observation_id":"92ca83d1-8370-4254-a965-5d995bd50553","resolution":{"observed_at":"2026-08-05T04:17:02.550312Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.553854Z","title":"Long-horizon planning for multi- agent robots in partially observable environments,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.553854Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:b2ecbff7fd1a126a7314faf34cba59c24268b9cbd7ac88b3946126ed06cf1b8f","observation_id":"780ac79f-a127-4fe2-a6d8-35f377c52541","resolution":{"observed_at":"2026-08-05T04:17:02.553854Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.557683Z","title":"AI2-THOR: An Interactive 3D Environment for Visual AI,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.557683Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:23ee439ec86558d2577f50f801cb5677a1726333bf4d6873f087e9f29213911e","observation_id":"b770397f-38d6-4569-a686-d40e456a5ef4","resolution":{"observed_at":"2026-08-05T04:17:02.557683Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.561146Z","title":"Formalizing and benchmarking prompt injection attacks and defenses,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.561146Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:de0acb0acddd2886a07e9053b759eede746d380d421f303aec8d238037495a0c","observation_id":"94a70e48-81f1-47a6-b2e5-c5d52ffe3948","resolution":{"observed_at":"2026-08-05T04:17:02.561146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.564492Z","title":"Injecagent: Benchmark- ing indirect prompt injections in tool-integrated large language model agents,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.564492Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:1ff0117c570bb8ef1ba143de7423e6fdb9981faf64520bda48167a5e3a5f07a7","observation_id":"5989c688-0522-4bc9-a1f1-35dda94cdeef","resolution":{"observed_at":"2026-08-05T04:17:02.564492Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.568841Z","title":"Jailbreaking llm-controlled robots,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.568841Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:b59945b37ba74331ff0dac60fef6478bd8cdb7dddc7a871e361ea0e7b4aea3a3","observation_id":"c55359a1-2b3c-49f6-9650-7e85313e2762","resolution":{"observed_at":"2026-08-05T04:17:02.568841Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.573034Z","title":"Jailbreaking black box large language models in twenty queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.573034Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:573755903ae16b551567b98077355381aee61ceed2f69b7a5e0a3140d4637db6","observation_id":"f0d232bb-7615-44f2-9eb3-c775250afb6d","resolution":{"observed_at":"2026-08-05T04:17:02.573034Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.576515Z","title":"Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.576515Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:059cb035fc1cf4f5a3f3417fe8435bcd859775fb5486ea845d236748d2f2527c","observation_id":"ccb795ea-410c-463e-b843-18a3122bd09c","resolution":{"observed_at":"2026-08-05T04:17:02.576515Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08567","last_updated":"2024-06-03T14:15:03Z","snapshot_observed_at":"2026-08-09T09:14:39.779608Z","submitted_at":"2024-02-13T16:06:17Z","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08567","snapshot_observed_at":"2026-08-05T04:17:02.580448Z","title":"Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.580448Z"},"links":{"cited_paper":"/paper/2402.08567","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:b5d0b6f868e91799c1ad060bd468c71eb79f2061163ff7ed4d7815e9afbf887b","observation_id":"3a84d894-086c-40ad-9149-71cfca548d58","resolution":{"observed_at":"2026-08-05T04:17:02.580448Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.584306Z","title":"Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.584306Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:110c5c23f1899ec565acf3270c21aeaa8b08f75e78721ee82611a3aaeaae4a8b","observation_id":"f0902229-485e-4fd6-9b20-fbef892648d8","resolution":{"observed_at":"2026-08-05T04:17:02.584306Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.587650Z","title":"Sentence-bert: Sentence embeddings using siamese bert-networks,","venue":null,"work_id":null,"year":2019},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.587650Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:5213c9677cb8dd0a3c830ce5a549b13cb8157300beb4cc194606ecf6dfcd7d32","observation_id":"3b86aa3e-7ec1-4254-bdcd-bd320813b959","resolution":{"observed_at":"2026-08-05T04:17:02.587650Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-05T04:17:02.591154Z","title":"Image-based prompt injection: Hijacking multimodal llms through visually embed- ded adversarial instructions,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.591154Z"},"links":{"citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:507a708d16059493202fb88e6bb3d02c9933c50023e1ce4365befdbde7a1178e","observation_id":"f4472c28-19f9-4a15-a6fe-6d667a43d765","resolution":{"observed_at":"2026-08-05T04:17:02.591154Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04957","last_updated":"2024-03-07T23:46:20Z","snapshot_observed_at":"2026-08-08T04:50:42.660630Z","submitted_at":"2024-03-07T23:46:20Z","title":"Automatic and Universal Prompt Injection Attacks against Large Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04957","snapshot_observed_at":"2026-08-05T04:17:02.594840Z","title":"Automatic and universal prompt injection attacks against large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-05T04:17:02.594840Z"},"links":{"cited_paper":"/paper/2403.04957","citing_paper":"/paper/2608.00747"},"observation_digest":"sha256:e442a664a8c2bd8a0ba612062362b7d2a08e0328b5e876227e4c9532533a1354","observation_id":"7b3561d9-29b1-40cc-91cb-e557b307c12c","resolution":{"observed_at":"2026-08-05T04:17:02.594840Z","resolver_source":null,"status":"malformed_identifier"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.00747","last_updated":"2026-08-04T16:20:03Z","latest_version":2,"primary_category":"cs.RO","snapshot_observed_at":"2026-08-07T23:11:48.110574Z","submitted_at":"2026-08-01T16:31:00Z","title":"When Prompts Control Robots: Prompt Injection Attacks in Multi-Agent Robotic Systems"},"reference_resolution":{"displayed":27,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":26,"verified_exact":0,"verified_fuzzy":0},"total_outbound_references":27},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 27 of 27 outbound references and 0 inbound Pith citation observations for arXiv:2608.00747."}