{"as_of":"2026-08-10T12:18:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:310ecd418c9a465b5ecd7e0090cb5156c57ebd13596ad9fe8a812afe19fe5983","coverage":[{"denominator":55,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":55,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-06T05:11:49.315668Z","state":"measured"},{"denominator":55,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":55,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-10T06:31:04.303077+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.05108/citation-record","integrity":"/paper/2608.05108/integrity","json":"/paper/2608.05108/citation-record.json","paper":"/paper/2608.05108"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:45.154237Z","title":"Ignore previous prompt: Attack techniques for language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.154237Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:807f99f6fe6795680d4588f5765813b1f5e7034ee41a2efd49dbcb8528abef74","observation_id":"ce8157a8-3198-4805-9f11-09358257bf05","resolution":{"observed_at":"2026-08-06T05:11:45.154237Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.733810Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection,","venue":null,"work_id":"73249263-f026-4a9e-8e0c-4b3151bcf7df","year":2023},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.267686Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:19be0d8fc8690b5eedc205fe7fe9204b6d0296e017ca7ca22643879c388d0fbb","observation_id":"f2f22714-4efa-45ed-94b5-9bd9f4957670","resolution":{"observed_at":"2026-08-06T05:11:56.781256Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.604725Z","title":"Formalizing and benchmarking prompt injection attacks and defenses,","venue":null,"work_id":"46ba05a0-7de1-4698-be00-5df52a24f8bb","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.327186Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:c2ba34706b3b6e147377eb2b19ab518f9b69a1311d9ac963456c66328695f762","observation_id":"bd61774f-d9cd-4278-95d3-dcd980725294","resolution":{"observed_at":"2026-08-06T05:11:56.674740Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.371338Z","title":"Injecagent: Benchmarking indirect prompt injections in tool- integrated large language model agents,","venue":null,"work_id":"f119171e-ee31-4021-8d20-621f9edabe9f","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.414814Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:75657cb792166d401e1772a4f579dad2026e1e233a42e8b5bd0e72888c510cd8","observation_id":"76d5a701-c412-4fe4-a7c4-3195dff7f224","resolution":{"observed_at":"2026-08-06T05:11:56.473490Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.234630Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents,","venue":null,"work_id":"5ecff1c2-136b-49d6-9d6e-5a3701c38019","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.463507Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:81ac6ad4bc5af26f1dea3ea521c5575eb3e5eaa5fa8edccc9bc344736a9a315f","observation_id":"bde26fa6-ac1b-4460-aa32-edc540ebccec","resolution":{"observed_at":"2026-08-06T05:11:56.289540Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2510.09023","last_updated":"2025-10-10T05:51:04Z","snapshot_observed_at":"2026-08-03T03:11:42.084785Z","submitted_at":"2025-10-10T05:51:04Z","title":"The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against Llm Jailbreaks and Prompt Injections","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2510.09023","snapshot_observed_at":"2026-08-06T05:11:45.495675Z","title":"The attacker moves second: Stronger adaptive attacks bypass defenses against llm jailbreaks and prompt injections,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.495675Z"},"links":{"cited_paper":"/paper/2510.09023","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:a6cea3c5bde25fac5dc4fc6bdb348f3f95bd5d0b7f2cd622203c97f9ee779748","observation_id":"14016feb-d5b0-4dd6-b8ab-4c41d96bc745","resolution":{"observed_at":"2026-08-06T05:11:45.495675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:56.090195Z","title":"Muse spark safety & preparedness report,","venue":null,"work_id":"2f8eb31e-d668-4a90-b43c-88f7c7dcd14d","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.604178Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:f81baa51d9bfbabfd70f4c2f9f76431fc52cb207141126ee0e212882b25ea3c6","observation_id":"7c719ede-b99a-4713-8f57-90f3d7c72b39","resolution":{"observed_at":"2026-08-06T05:11:56.149686Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.952660Z","title":"Claude opus 4.7 system card,","venue":null,"work_id":"d169a733-d83f-4b63-a71e-0413fae7e28b","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.676598Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:1f57b47a16ef13b53d4598641bdd2d96d5ae16e46c7ed2ea5128513d62689bde","observation_id":"16083f83-3eea-4cce-ac70-1f620f990eab","resolution":{"observed_at":"2026-08-06T05:11:56.015812Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.761051Z","title":"Datasentinel: A game-theoretic detection of prompt injection attacks,","venue":null,"work_id":"fc3fe01e-288b-4030-aac4-cc1e0aced5c2","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.725244Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:7af99af394eed3a71a61057e3a0aa0cf19f8d65592890b03e3e5ec318bf34417","observation_id":"23e69e23-13f4-44f8-a68b-54603f45fa10","resolution":{"observed_at":"2026-08-06T05:11:55.853663Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.604410Z","title":"PromptGuard Prompt Injection Guardrail,","venue":null,"work_id":"fa24f3ff-ce25-47d2-9aa9-80f47776e72c","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.794378Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:b716d33ff2f6f45a2f06d536ea3485df7fb02575f9b7d6005982b85257ac4bdb","observation_id":"a610dc2b-5572-47b4-ba4c-9b8222a28ea6","resolution":{"observed_at":"2026-08-06T05:11:55.674204Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.01194","last_updated":"2026-07-25T19:27:27Z","snapshot_observed_at":"2026-08-07T18:02:22.537986Z","submitted_at":"2026-04-01T17:40:03Z","title":"AgentWatcher: A Rule-based Prompt Injection Monitor","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.01194","snapshot_observed_at":"2026-08-06T05:11:45.854500Z","title":"Agentwatcher: A rule-based prompt injection monitor,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.854500Z"},"links":{"cited_paper":"/paper/2604.01194","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:809519350668eaf5498dfd3bf1a8ebd96b1fbf536b8d285dba6fcf4fe9e61d41","observation_id":"f1bf1c37-421f-42e8-a85b-5263240f4e08","resolution":{"observed_at":"2026-08-06T05:11:45.854500Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:45.943166Z","title":"Meta secalign: A secure foundation llm against prompt injection attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.943166Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:8b7ac0a568515a660d001b8ea82121b9259e59f8da1fa76eb603364475208fb9","observation_id":"cb5317d7-a23e-4772-8e0c-cd71d6462d0b","resolution":{"observed_at":"2026-08-06T05:11:45.943166Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.01850","last_updated":"2024-07-01T23:25:30Z","snapshot_observed_at":"2026-08-01T03:52:37.266248Z","submitted_at":"2024-07-01T23:25:30Z","title":"Purple-teaming LLMs with Adversarial Defender Training","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.01850","snapshot_observed_at":"2026-08-06T05:11:45.995659Z","title":"Purple-teaming llms with adversarial defender training,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:45.995659Z"},"links":{"cited_paper":"/paper/2407.01850","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:a699214651a070ec471f06775cd4493a4b2f35f2a49efce5155d92172eedef2c","observation_id":"fccb7cd8-214d-4419-9e71-61df4f9a1633","resolution":{"observed_at":"2026-08-06T05:11:45.995659Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.495061Z","title":"Black-box red-teaming of multi-agent systems via reinforcement learning,","venue":null,"work_id":"c37fe130-22c0-42e7-a3dc-5c20648730aa","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.063263Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:13e048a0cfaa9dd0b20fc4367de9a579f1e7e1d05aca26766801254d976fdae8","observation_id":"128eff0f-a175-4f43-85ee-a0e8d2807bf2","resolution":{"observed_at":"2026-08-06T05:11:55.546133Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.05746","last_updated":"2026-06-10T08:55:54Z","snapshot_observed_at":"2026-08-03T04:13:45.517910Z","submitted_at":"2026-02-05T15:14:46Z","title":"Learning to Inject: Automated Prompt Injection via Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.05746","snapshot_observed_at":"2026-08-06T05:11:46.111393Z","title":"Learning to inject: Automated prompt injection via reinforcement learning,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.111393Z"},"links":{"cited_paper":"/paper/2602.05746","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:9b7e1ba042ecff6321f7e1e79669e1132ebc85cafbc15a167b4164206076f217","observation_id":"1506dadd-4cfc-4288-87d3-46cd75cdeb52","resolution":{"observed_at":"2026-08-06T05:11:46.111393Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.203274Z","title":"Rl is a hammer and llms are nails: A simple reinforcement learning recipe for strong prompt injection,","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.203274Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:ed7b7ec0c23c2a8aef09fe0f63ace40585925ba6156bdffa9d30bdfce3a0edfe","observation_id":"6058760e-f676-4eeb-be9d-2d872b0e74d7","resolution":{"observed_at":"2026-08-06T05:11:46.203274Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2603.13026","last_updated":"2026-07-23T13:46:08Z","snapshot_observed_at":"2026-08-10T08:59:45.532396Z","submitted_at":"2026-03-13T14:34:54Z","title":"PISmith: Reinforcement Learning-based Red Teaming for Prompt Injection Defenses","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2603.13026","snapshot_observed_at":"2026-08-06T05:11:46.310041Z","title":"Pismith: Reinforcement learning-based red teaming for prompt injection defenses,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.310041Z"},"links":{"cited_paper":"/paper/2603.13026","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:8827c1e2a2a182014dc55969abfe043118c42f57d247db934f4cd8b825fec121","observation_id":"f8e5973a-ec6c-48b5-8515-b3a7e9413797","resolution":{"observed_at":"2026-08-06T05:11:46.310041Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.382227Z","title":"Tree of attacks: Jailbreaking black-box llms automatically,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.382227Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:4fdbce60f6065eb94d394ce8a5ec933ade820ec2dba11f8c2dff4b4a475f2a79","observation_id":"40477b0a-9b12-4a28-bfe1-36da9440ec23","resolution":{"observed_at":"2026-08-06T05:11:46.382227Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.449184Z","title":"Jailbreaking black box large language models in twenty queries,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.449184Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:cf9336943936587b51a8373d72774cd99062efa255f755a7d9032bb8d151c007","observation_id":"7986393b-053b-411a-9513-0af5e38c9095","resolution":{"observed_at":"2026-08-06T05:11:46.449184Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.267417Z","title":"Agentvigil: Automatic black-box red-teaming for indirect prompt injection against llm agents,","venue":null,"work_id":"793eda12-bcf0-40a4-82b5-ae2fe05590f8","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.532386Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:c9bebe13561956959495ee0bf35d6462b24a2620850061fa7f87ec10b4bc0f17","observation_id":"8b07b5e7-5bfc-4f94-a98d-05a9ccd7b76a","resolution":{"observed_at":"2026-08-06T05:11:55.370992Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:55.140944Z","title":"Piarena: A platform for prompt injection evaluation,","venue":null,"work_id":"5045b103-f083-4247-b3de-7a18977e3e49","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.588128Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:f461396b8556dfcd1e473a30712ba1d7829549ab3913e92bbedf5cbab2e48765","observation_id":"975147fa-4954-4812-8b14-8f12eb3df08d","resolution":{"observed_at":"2026-08-06T05:11:55.198269Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.914605Z","title":"Gpt-red: Automated red teaming via self-play at scale","venue":null,"work_id":"5c391d22-49ff-4d56-b284-816c7882ff1e","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.654896Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:8081067b3698d58dba1f9489c5b9dc8c4e6d25b3ae1914542b27e48d5402e3a3","observation_id":"d4dae2ee-2ff0-427c-83aa-68f923b3ab64","resolution":{"observed_at":"2026-08-06T05:11:55.032827Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.711658Z","title":"How vulnerable are ai agents to indirect prompt injections? insights from a large-scale public competition,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.711658Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:d72053e1dc6b540ffe9661142440d0d73cdd38d1a0593d1d54e94fa39fb74036","observation_id":"6b1bbc84-dceb-4cd5-8669-4c88c9828352","resolution":{"observed_at":"2026-08-06T05:11:46.711658Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:46.767256Z","title":"Muzzle: Adaptive agentic red-teaming of web agents against indirect prompt injection attacks,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.767256Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:14c504c8d5d7f8713a54218c6c950a977eab7d74a38d5a33206b288ea0b16e30","observation_id":"f286f7ff-181a-40e7-8e00-de6f0b86b501","resolution":{"observed_at":"2026-08-06T05:11:46.767256Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.665975Z","title":"Autodan- turbo: A lifelong agent for strategy self-exploration to jailbreak llms,","venue":null,"work_id":"54edfa8e-84a5-4776-b89a-1b8745647d9b","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.906206Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:61c4efe1225b3d3c463d8a0d306b45e7c33fe5a6bdee097ba7502a834dfbdcc1","observation_id":"66b2b30e-52df-4521-8173-9b09574fa6b6","resolution":{"observed_at":"2026-08-06T05:11:54.785109Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2605.04808","last_updated":"2026-05-06T11:59:48Z","snapshot_observed_at":"2026-07-06T23:17:33.252539Z","submitted_at":"2026-05-06T11:59:48Z","title":"DecodingTrust-Agent Platform (DTap): A Controllable and Interactive Red-Teaming Platform for AI Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.04808","snapshot_observed_at":"2026-08-06T05:11:46.996106Z","title":"Decodingtrust- agent platform (dtap): A controllable and interactive red-teaming platform for ai agents,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:46.996106Z"},"links":{"cited_paper":"/paper/2605.04808","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:5ba57b5f77b5de5dfb6bc89715ce28e1dd20175aba5e4443ccb3eb531cf7d4d3","observation_id":"773492fa-d159-4a91-b778-4d6aac32070e","resolution":{"observed_at":"2026-08-06T05:11:46.996106Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2210.03629","last_updated":"2023-03-10T01:00:17Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2022-10-06T01:00:32Z","title":"ReAct: Synergizing Reasoning and Acting in Language Models","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2210.03629","snapshot_observed_at":"2026-08-06T05:11:47.055268Z","title":"React: Synergizing reasoning and acting in language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.055268Z"},"links":{"cited_paper":"/paper/2210.03629","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3207567d559e43bc7d8b30ec3bd565f9961a28f1583880dc79aad1b9e2acf5f9","observation_id":"ef34a227-74f2-469e-9719-296058853a8b","resolution":{"observed_at":"2026-08-06T05:11:47.055268Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.386531Z","title":"Toolllm: Facilitating large language models to master 16000+ real-world apis,","venue":null,"work_id":"3880e049-8a14-4572-bee6-11652a99ae68","year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.096713Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:d550605abf833130debbc2c593e89874e9ac8b8ed49c30a5b27cfaba95f3e5c8","observation_id":"83da0063-c6d1-44d6-ad44-f293bc8c0929","resolution":{"observed_at":"2026-08-06T05:11:54.496789Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:47.164645Z","title":"Autoharness: improving llm agents by automatically synthesizing a code harness,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.164645Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:8fc852950a63770f735695482798e6d2b324ba80a5e1e05dc3d232d411c263bb","observation_id":"e32db511-3395-4a05-b2f4-daa3e63dbbf3","resolution":{"observed_at":"2026-08-06T05:11:47.164645Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2502.04180","last_updated":"2025-06-09T05:15:47Z","snapshot_observed_at":"2026-08-08T23:12:45.901049Z","submitted_at":"2025-02-06T16:12:06Z","title":"Multi-agent Architecture Search via Agentic Supernet","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.04180","snapshot_observed_at":"2026-08-06T05:11:47.247014Z","title":"Multi-agent architecture search via agentic supernet,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.247014Z"},"links":{"cited_paper":"/paper/2502.04180","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:fa72f1c95974893e209051f7d6a8ddfc83fbd7daea17f181e3ee565d37cfb55d","observation_id":"3e3a3567-d74d-46e1-965d-21c61d8ce21a","resolution":{"observed_at":"2026-08-06T05:11:47.247014Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.07496","last_updated":"2024-06-11T17:32:21Z","snapshot_observed_at":"2026-07-06T18:29:04.294349Z","submitted_at":"2024-06-11T17:32:21Z","title":"TextGrad: Automatic \"Differentiation\" via Text","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.07496","snapshot_observed_at":"2026-08-06T05:11:47.342591Z","title":"Textgrad: Automatic","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.342591Z"},"links":{"cited_paper":"/paper/2406.07496","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:0a9e215dc488a16127404784b02c9ade831721dea1bdc99d8f3e1ab70cb3181c","observation_id":"554b4a78-c0c9-49bb-8e1c-30dc5a1c2eaa","resolution":{"observed_at":"2026-08-06T05:11:47.342591Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:54.194006Z","title":"Test-time training with self-supervision for generalization under distribution shifts,","venue":null,"work_id":"fd0c2984-7e2c-45c9-92b8-acbbc3314b2a","year":2020},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.402594Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:f43321f859a2b2362b7a928338015f6cc0c007172f0ee9990199f699569a8c5e","observation_id":"3c0af994-60f6-4303-96f5-c5a3d88969e6","resolution":{"observed_at":"2026-08-06T05:11:54.272634Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.937350Z","title":"Gemini CLI: An open-source AI agent for the terminal,","venue":null,"work_id":"8a89a2ce-c87c-4a43-9ef7-125a10709f3a","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.493187Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:08b53b6909d9516d6f35ac3d0c87d1227a1af712c2a8a966244e842532c33aff","observation_id":"4761427b-17af-4cfc-94f1-f0fe0af33f58","resolution":{"observed_at":"2026-08-06T05:11:54.073223Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.702383Z","title":"Codex CLI: A lightweight coding agent that runs in your terminal,","venue":null,"work_id":"faf6d47a-1533-4d5b-a1f6-fd7583ed81ba","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.564559Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:f6a429227f6a76e590dfe1fda9e918d04d189833d7315240defd4b6ef1ccf9f2","observation_id":"5a1b9b39-aa08-4a74-b822-af031cc6d786","resolution":{"observed_at":"2026-08-06T05:11:53.825124Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.412972Z","title":"Claw code: A clean-room open-source coding-agent CLI,","venue":null,"work_id":"47023826-824c-4d31-971e-69609160d18e","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.614225Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:c278b69e27a348cb920c9f45eb546636f3f706fda33c5d4a9825de8b89bd8da8","observation_id":"b8b85a14-c728-4f94-8f93-c37e7e3f8b8d","resolution":{"observed_at":"2026-08-06T05:11:53.561952Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:53.088238Z","title":"Hermes agent: An open-source self-hosted autonomous AI agent,","venue":null,"work_id":"ba328d59-84df-4c3d-bc66-cb681081da13","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.654480Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:e7520503cab1f74ef86724a32582c420696dffc4d81fa88623f781d87829e58f","observation_id":"c49965f8-9100-48da-8537-c1ebcda2ae54","resolution":{"observed_at":"2026-08-06T05:11:53.262640Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.931701Z","title":"Claude code: An agentic coding tool for the terminal,","venue":null,"work_id":"10b1184c-fc72-467f-b8fe-504bde347c4c","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.694271Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:2f3467ba15b798539f29de2d33dce46d230cc021c55708cd5ef628bf4f8005ba","observation_id":"72716773-1290-4acc-85d2-783456d67671","resolution":{"observed_at":"2026-08-06T05:11:53.011248Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.717893Z","title":"Attention tracker: Detecting prompt injection attacks in llms,","venue":null,"work_id":"cd087c98-7f14-4a9e-a1d4-eaef4575d094","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.764775Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:aaba40b1e114ab9f93287c6c424667b4f131cc1e7dabaec3c4d31973fa183934","observation_id":"03c25b03-505b-4056-9caa-f7d8060cf3a2","resolution":{"observed_at":"2026-08-06T05:11:52.823611Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.424077Z","title":"Piguard: Prompt injection guardrail via mitigating overdefense for free,","venue":null,"work_id":"b97858bb-4e44-4ecb-9519-119457995c95","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.844255Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:ef327ed70d3f6713efc24845e9b65ca6abb1960841f4bdc207363d88ec95b429","observation_id":"6bf302bb-3a4c-4b99-9e42-3f29ecb6f5dd","resolution":{"observed_at":"2026-08-06T05:11:52.534030Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:47.884895Z","title":"Pishield: Detecting prompt injection attacks via intrinsic llm features,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.884895Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:fbea56e1e710a72a9da0cc43742f1443dfb3b27b5711d809ec2abbff2ace0916","observation_id":"4c31e5f5-4e0d-4b42-9b48-68ca1a65e058","resolution":{"observed_at":"2026-08-06T05:11:47.884895Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:47.889944Z","title":"Pisanitizer: Preventing prompt injection to long-context llms via prompt sanitization,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.889944Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:5df7c225b9a8bddcf6ec55c3552ea71ae4a9a98aeb450456c75bd75e6bbe95c5","observation_id":"b87c2d68-6b1a-4788-97cb-a45d674b1b06","resolution":{"observed_at":"2026-08-06T05:11:47.889944Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2507.15219","last_updated":"2025-07-21T03:41:44Z","snapshot_observed_at":"2026-08-06T15:35:31.690602Z","submitted_at":"2025-07-21T03:41:44Z","title":"PromptArmor: Simple yet Effective Prompt Injection Defenses","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.15219","snapshot_observed_at":"2026-08-06T05:11:47.970675Z","title":"Promptarmor: Simple yet effective prompt injection defenses,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:47.970675Z"},"links":{"cited_paper":"/paper/2507.15219","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:2a776725bc9394813b358e663ec379e44a2f1c2c7d68c2dd5985f34c869451ff","observation_id":"407bed97-eabb-4702-8561-0b84d15625bf","resolution":{"observed_at":"2026-08-06T05:11:47.970675Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:48.140727Z","title":"Defending against prompt injection with datafilter,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.140727Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3c0f0402986df3cb25438c6e3f934bb7ce9578ad650ed785c669f8d49ddf9835","observation_id":"333ca45e-6c47-4e83-9f80-76610928175c","resolution":{"observed_at":"2026-08-06T05:11:48.140727Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-07T19:59:01.081751Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-06T05:11:48.276646Z","title":"Defeating prompt injections by design,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.276646Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:c565b84c9b685853f514ac0adce1884075e387743b757874c4a86f1a08a5d6ed","observation_id":"059b8f4f-e9f5-4311-a80e-d78b91967332","resolution":{"observed_at":"2026-08-06T05:11:48.276646Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:52.139197Z","title":"Drift: Dynamic rule-based defense with injection isolation for securing llm agents,","venue":null,"work_id":"801ebf0d-a39f-46c4-845f-3871df6f1cec","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.451426Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:0cdb567fe17218568576f97d570e2bb412e0b86733e9bb6f983e0a5313f35b07","observation_id":"82359524-7b03-44e3-a8b2-982d4129ad90","resolution":{"observed_at":"2026-08-06T05:11:52.260009Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2602.03117","last_updated":"2026-05-07T07:42:14Z","snapshot_observed_at":"2026-07-06T22:44:18.875334Z","submitted_at":"2026-02-03T05:20:42Z","title":"AgentDyn: Are Your Agent Security Defenses Deployable in Real-World Dynamic Environments?","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.03117","snapshot_observed_at":"2026-08-06T05:11:48.601504Z","title":"Agentdyn: A dynamic open-ended benchmark for evalu- ating prompt injection attacks of real-world agent security system,","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.601504Z"},"links":{"cited_paper":"/paper/2602.03117","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:fc640c742316dda41fa49f8b86962d9fcd4d31ebe435ccee87341f0c1fb67bf3","observation_id":"d8392da2-dc0a-404f-91c0-488d8251085d","resolution":{"observed_at":"2026-08-06T05:11:48.601504Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.876243Z","title":"Claude opus 4.8 system card,","venue":null,"work_id":"8426c432-a006-4a49-8ae3-9ce6ebca1b89","year":2026},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.792435Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:9e6e5ec11f92aff2a0cb2232c1086b1706e0f61d5ad009ff2f197b0a8d21f58d","observation_id":"c23152a6-c5e5-4cd2-a546-fbde8379b1b4","resolution":{"observed_at":"2026-08-06T05:11:51.990541Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.619734Z","title":"Secalign: Defend- ing against prompt injection with preference optimization,","venue":null,"work_id":"4a30fd48-1666-495d-954b-342c6f168108","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.892272Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:be86e19debe293a47d2cad6d81eba38dc340ac4df92a0214b417ae7c7c87f252","observation_id":"d09fb8ad-d715-4abd-8272-6f2a4d75c615","resolution":{"observed_at":"2026-08-06T05:11:51.702584Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-10T04:45:11.275468Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-06T05:11:48.996878Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:48.996878Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:57e840835a35e0b2a429f14888bdfd085639366a278b25a895af03dc8c6843fc","observation_id":"9f07afa9-9677-4cdc-8795-3b858e9f8935","resolution":{"observed_at":"2026-08-06T05:11:48.996878Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.419078Z","title":null,"venue":null,"work_id":"d9f4663f-8678-4bfe-9c5e-b2b75b79e681","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.034052Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:1e3d508a5b72923f61401f641eee91e81eb3b828e65d327f1b1aa822a1215e22","observation_id":"c7126831-551e-4344-84b8-ffab5e6054f3","resolution":{"observed_at":"2026-08-06T05:11:51.514757Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:51.140208Z","title":null,"venue":null,"work_id":"47cf36e1-8b4e-4df8-a32d-a583845ea509","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.083594Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:77609c59659227bb207d217b79fa91bc14c45cc5db0e570d2fcb67f140e0551b","observation_id":"f5074bf4-fd08-4704-b766-4b57a2c2cdc8","resolution":{"observed_at":"2026-08-06T05:11:51.296756Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.975176Z","title":null,"venue":null,"work_id":"b957a8cb-efac-46d6-813d-f5a7bab54b77","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.126679Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:9752f7cd59a2bf72512345c84177b62f54f1d7bfb4c0cea25ff057d21011da72","observation_id":"c1fea9e2-c54c-47e1-b6a8-1f3ee21011a3","resolution":{"observed_at":"2026-08-06T05:11:51.021691Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.732061Z","title":null,"venue":null,"work_id":"15943586-be93-4886-b37d-613efbec3d5e","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.191010Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:c8aa0d11deb6333d070ae8a90118599550055330eaeb17d5026358236e247a47","observation_id":"b27962e6-48cf-4f7a-b695-dcc41b949dc2","resolution":{"observed_at":"2026-08-06T05:11:50.833130Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.448875Z","title":"## In-context examples","venue":null,"work_id":"c7ab87ef-9e90-4f1b-8a06-7aaeb558124f","year":null},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.260862Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:3952b1e14c91b85782b85d5f75c0a48827d7492d253e6ecd25ea1156fe0a35ba","observation_id":"dc2a7192-903f-4f9e-bae5-1e721339cad3","resolution":{"observed_at":"2026-08-06T05:11:50.559662Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-06T05:11:50.227444Z","title":"## When this strategy is expected to fail","venue":null,"work_id":"108187ac-b813-477d-87ec-8edf9cf1eb4d","year":2025},"citing_paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-06T05:11:49.315668Z"},"links":{"citing_paper":"/paper/2608.05108"},"observation_digest":"sha256:7abaff1101949fcc3925c5b7840a55dc13494cfe865877223783000634947888","observation_id":"a1f25a28-a12e-4227-91e7-d3686e6a9dcf","resolution":{"observed_at":"2026-08-06T05:11:50.294110Z","resolver_source":"raw_fallback","status":"malformed_identifier"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-10T06:31:04.303077+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.05108","last_updated":"2026-08-05T17:44:09Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-10T06:38:32.034468Z","submitted_at":"2026-08-05T17:44:09Z","title":"Agent Against Agent: An Agentic System for Automatic Prompt Injection Red Teaming"},"reference_resolution":{"displayed":55,"state_counts":{"malformed_identifier":1,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":28,"verified_exact":0,"verified_fuzzy":26},"total_outbound_references":55},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-10T06:31:04.303077+00:00","source":"crossref"},{"observed_at":"2026-08-10T06:30:57.382061+00:00","source":"retraction_watch"}],"thesis":"As of 10 August 2026, this Paper Citation Record lists 55 of 55 outbound references and 0 inbound Pith citation observations for arXiv:2608.05108."}