{"as_of":"2026-08-18T19:14:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:1d1d46e653c82a5e611ac573201dc05881d8283c1681de953af6cc28596b5524","coverage":[{"denominator":77,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":77,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-16T00:16:52.653903Z","state":"measured"},{"denominator":77,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":77,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-18T06:34:40.430872+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.12172/citation-record","integrity":"/paper/2608.12172/integrity","json":"/paper/2608.12172/citation-record.json","paper":"/paper/2608.12172"},"outbound":[{"citation":{"cited_paper":{"arxiv_id":"2506.01055","last_updated":"2025-06-01T15:48:06Z","snapshot_observed_at":"2026-08-15T10:52:39.381322Z","submitted_at":"2025-06-01T15:48:06Z","title":"Simple Prompt Injection Attacks Can Leak Personal Data Observed by LLM Agents During Task Execution","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2506.01055","snapshot_observed_at":"2026-08-16T00:16:52.303564Z","title":"Simple prompt injection attacks can leak personal data observed by llm agents during task execution.arXiv preprint arXiv:2506.01055, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.303564Z"},"links":{"cited_paper":"/paper/2506.01055","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:dc3c739b164eb4d1260db64130117f20d6b57aed22ac58fd7e683ae8a982137f","observation_id":"307f55f9-9df6-44ed-9392-4dd75055892e","resolution":{"observed_at":"2026-08-16T00:16:52.303564Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.133612Z","title":"Model context protocol","venue":null,"work_id":"94bf5e0f-d62e-447e-b59f-3871fa743051","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.309227Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:25dc5a6027277086c69953b7628cd9fbefb0ac5df6d3c6bf5742ce122ccdecc6","observation_id":"75af99fd-35b9-45be-bb0e-539c3b19fb0a","resolution":{"observed_at":"2026-08-16T00:16:54.138420Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.118625Z","title":"Air- GapAgent: Protecting privacy-conscious conversational agents","venue":null,"work_id":"97069d2a-6977-4be2-aa75-7f5cb07b87c4","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.313941Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:72bc87d711ab3614de76ab3d8e004a1bdd4cfd2b6f81e1cbc7c421ec04f0e80f","observation_id":"7bc4a230-bca9-4d4e-90b1-0e0bda6b742d","resolution":{"observed_at":"2026-08-16T00:16:54.123389Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.093730Z","title":"Off by default! InProceedings of the 4th ACM Workshop on Hot Topics in Networks (HotNets-IV), College Park, MD, 2005","venue":null,"work_id":"38384177-8016-4437-9aaa-524138ecfdbc","year":2005},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.323520Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:d8444f4c71e3d072aeb097e91553a07ec3fdfba6cf72d501decf7d198a0ebf0a","observation_id":"085a062e-7873-4d4d-87bf-6f2a28a46938","resolution":{"observed_at":"2026-08-16T00:16:54.098945Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.078942Z","title":"Freedman, Justin Pettit, Jianying Luo, Nick McKeown, and Scott Shenker","venue":null,"work_id":"689f70a8-0ca7-45d2-97a1-da63bfa597a2","year":2007},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.328579Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:190e2b6d4b3da3f162ca5e2f5dc1e9909c97efc6bc2540d18e41361bec0733e2","observation_id":"ac23da05-14a3-4f9e-ba6b-6351207f1f80","resolution":{"observed_at":"2026-08-16T00:16:54.083703Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.064786Z","title":"Freedman, Dan Boneh, Nick McKeown, and Scott Shenker","venue":null,"work_id":"5d012f23-c261-455d-9779-7431bc3a4242","year":2006},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.334111Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:e7429d67e41950b5b136823b355167a5200bb146687c1c7b9117661d080aafb9","observation_id":"9742d581-a98e-4778-9ff6-d7453dbaab05","resolution":{"observed_at":"2026-08-16T00:16:54.069453Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.049248Z","title":"{StruQ}: Defending against prompt injection with structured queries","venue":null,"work_id":"892af39b-ecfe-4d5f-bfb2-f16f9967e7eb","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.339433Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ae18b40027ec9cda041f60b4bec7e03d035e4e2a618d4d02f82639fd61764137","observation_id":"22ba1fa3-3d01-42f6-a726-dacd082a736b","resolution":{"observed_at":"2026-08-16T00:16:54.054036Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.344313Z","title":"Secalign: Defending against prompt injection with preference optimization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.344313Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:8db23776eddb755c9b496b6c49372baa561dff0eb1a3a3e24865e2a32351d919","observation_id":"0fb0ed77-c5b1-4fcf-97e5-3e97c8b89892","resolution":{"observed_at":"2026-08-16T00:16:52.344313Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.348775Z","title":"Agentpoison: Red-teaming llm agents via poisoning memory or knowl- edge bases.Advances in Neural Information Processing Systems, 37:130185–130213, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.348775Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:5843c18ebe0274d67dee143af3cd4f673c23cb5ae50bbbc0be6d420b04853a8d","observation_id":"0334ae0a-09da-44dc-9871-32a9fb6b030c","resolution":{"observed_at":"2026-08-16T00:16:52.348775Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.015598Z","title":"Overprivileged by design: AI agents as cloud escalation vectors","venue":null,"work_id":"54bfa993-fc7d-4af1-9f93-e4e483cf2782","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.353237Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a44cb1345ed81c525aa741839faea3458bda680eeab939c4b3b4827e723b2b81","observation_id":"b36724f7-1f7b-4d93-9381-ed66a003bfb7","resolution":{"observed_at":"2026-08-16T00:16:54.020107Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.23643","last_updated":"2025-09-03T12:30:47Z","snapshot_observed_at":"2026-07-06T21:33:02.686798Z","submitted_at":"2025-05-29T16:50:41Z","title":"Securing AI Agents with Information-Flow Control","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.23643","snapshot_observed_at":"2026-08-16T00:16:52.357689Z","title":"Securing ai agents with information-flow control.arXiv preprint arXiv:2505.23643, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.357689Z"},"links":{"cited_paper":"/paper/2505.23643","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:4fb826af24854f321f848d27c12adf2bfbe85477b0add1556c6bc157114b9d1b","observation_id":"10c52286-c590-4493-99a8-3e7a23025f32","resolution":{"observed_at":"2026-08-16T00:16:52.357689Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-17T17:40:10.591866Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-16T00:16:52.362927Z","title":"Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.362927Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:05ec0c337edb81252e02092e60329c4083a5b60d857d9dbbdf11d383a8a82b5e","observation_id":"4d423be8-c845-4d2b-ad13-3306bed23c1e","resolution":{"observed_at":"2026-08-16T00:16:52.362927Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:54.000024Z","title":"AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents","venue":null,"work_id":"06097ded-21b0-46d0-940d-ed8e2ab594d2","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.367655Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:bec0df3548053f9e76b7ca3925ff4f2d55f93ea31231e9eb445e8c772de74f43","observation_id":"1a09a59c-fecb-44a5-a867-1443ac50449a","resolution":{"observed_at":"2026-08-16T00:16:54.005425Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.372005Z","title":"Ai agents under threat: A survey of key security challenges and future pathways.ACM Computing Surveys, 57(7):1–36, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.372005Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:dcca1571826c3dabc56aa08b499658951df4788f00d1e148ece399b5f61ab523","observation_id":"5d732177-794b-4a5f-a7fe-332b5dd6d2f2","resolution":{"observed_at":"2026-08-16T00:16:52.372005Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.975979Z","title":null,"venue":null,"work_id":"eca0f44c-865b-4a0d-86fd-1a5fcf02f05e","year":1987},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.376540Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:64f83512d2c0bec7cff186ffa8527572696700c7bbdf090f3b5da3f9452c2ab1","observation_id":"14a28adc-8e32-4b04-8a6f-ca792ee3b9cc","resolution":{"observed_at":"2026-08-16T00:16:53.980500Z","resolver_source":"raw_fallback","status":"unresolved"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.961420Z","title":"Memory injection attacks on llm agents via query-only interaction.Advances in Neural Information Processing Systems, 38:46697–46731, 2026","venue":null,"work_id":"961a3f32-f5d6-4fd2-99c4-68f292418b01","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.381100Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:242393af13d3666faa0c7e7bf22db07ee09e6d9fb6ec66de62e55f8fc3656802","observation_id":"abdb78e1-07bf-4c0c-ad3f-540f869ee3ae","resolution":{"observed_at":"2026-08-16T00:16:53.965986Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.947519Z","title":"Towards verifiably safe tool use for llm agents","venue":null,"work_id":"29579fb5-3a7c-4c88-9712-3fcaad6be48f","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.385629Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:8da06217f8bce523c7cf737347eef685e7c8e5e3fb73db4f07399973c689a734","observation_id":"afa7f544-284d-42f7-80a1-682cc86e9981","resolution":{"observed_at":"2026-08-16T00:16:53.952047Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.389986Z","title":"AgentLeak: A full-stack benchmark for privacy leakage in multi-agent LLM systems.arXiv preprint arXiv:2602.11510, February 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.389986Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:e05d389b640f914b0e41da4abcd1ab07d97aaab0c69cc558b2c43f73ed8496b8","observation_id":"a96d1fef-c4fd-498d-b08e-444032087434","resolution":{"observed_at":"2026-08-16T00:16:52.389986Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.932921Z","title":"Wasp: Benchmarking web agent security against prompt injection attacks.Advances in Neural Information Processing Systems, 38, 2026","venue":null,"work_id":"a06d84d2-1bc7-4ec0-95d6-01556e8d4522","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.394299Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:22f8e08558481d1aa9f433c93494abbd76f6b98c2ed5abee259769e887730e28","observation_id":"47c471bd-da43-4778-987e-87ab27143bc4","resolution":{"observed_at":"2026-08-16T00:16:53.937836Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.917742Z","title":"AI agents are the biggest data security threat you’re not governing","venue":null,"work_id":"16ea9726-8e3d-441b-baa0-1e078234ef17","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.398764Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:8264f5c765731907daee9f1f7e651f1ea62f073d898fc79f9ba3eb17518732aa","observation_id":"bd14a932-ea5c-4abf-beac-791911997f00","resolution":{"observed_at":"2026-08-16T00:16:53.922661Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.903151Z","title":"Agent2agent (A2A) protocol","venue":null,"work_id":"002a3932-29ea-4951-bba2-c56d8a32e4aa","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.403122Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a7939e2551faad836da7010c3e2bffdc8ba95f35dd18827eadbbf1ed97ae9847","observation_id":"805acb9c-2d57-4b25-8f79-b61dc624336f","resolution":{"observed_at":"2026-08-16T00:16:53.907836Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.887435Z","title":"Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection","venue":null,"work_id":"5f0405ec-c9ca-4fe5-8f32-32eff2161745","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.407983Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2acfe585a19cef11b37c944a199fead3e9d56f174e739367eed2b3036b4fa518","observation_id":"3274f44a-94e6-4713-bd52-2347f864e27d","resolution":{"observed_at":"2026-08-16T00:16:53.892852Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.874114Z","title":"Bypassing LLM guardrails: An empirical analysis of eva- sion attacks against prompt injection and jailbreak detection systems, 2025","venue":null,"work_id":"3f86728d-e9a1-4c7d-96ee-9f5a8262a34e","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.412448Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:e6730e24ea6ceb6689a60add05204b153b6530c6f5f76341be9b54b807d30002","observation_id":"14e2ac38-18e9-4ab8-a80b-8296a1587c9a","resolution":{"observed_at":"2026-08-16T00:16:53.878294Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.858737Z","title":"The OAuth 2.0 authorization framework","venue":null,"work_id":"6078a5a8-eb7e-470e-be35-a34368df00bc","year":2012},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.417816Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:0a976c1259fccc43c08b879048be87876f35811362da5786abc5b34929c87fa7","observation_id":"096b3df7-3605-4b26-9a17-35957152ba5c","resolution":{"observed_at":"2026-08-16T00:16:53.864145Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2312.06674","last_updated":"2023-12-07T19:40:50Z","snapshot_observed_at":"2026-08-14T15:42:19.849118Z","submitted_at":"2023-12-07T19:40:50Z","title":"Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.06674","snapshot_observed_at":"2026-08-16T00:16:52.422410Z","title":"Llama guard: Llm-based input-output safeguard for human-ai conversations.arXiv preprint arXiv:2312.06674, 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.422410Z"},"links":{"cited_paper":"/paper/2312.06674","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2233598e81f3f5748958e5658b5b38fceebd7b6467fa9491dd5642b10b945c78","observation_id":"42e92a12-2d7e-4a9f-9608-4b5405e86323","resolution":{"observed_at":"2026-08-16T00:16:52.422410Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.426857Z","title":"Break- ing and fixing defenses against control-flow hijacking in multi-agent systems.arXiv preprint arXiv:2510.17276, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.426857Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a51bdcde227be1653b086e86cb615036fea9723b11a7527c60e7c32877b05e9e","observation_id":"ad8ee4e6-8e34-41c1-9042-17c252d61947","resolution":{"observed_at":"2026-08-16T00:16:52.426857Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.841809Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in LLM agents","venue":null,"work_id":"70002660-6305-4c60-9418-8658536e4ce8","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.430727Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:7dacf73d42cfb4c6817e25f4222b15c63f8d94fd17dabe74f3ad4cc0192bd751","observation_id":"6e52efd2-8208-4a1e-921e-7b31bea700d2","resolution":{"observed_at":"2026-08-16T00:16:53.846847Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.18333","last_updated":"2025-05-23T19:39:56Z","snapshot_observed_at":"2026-08-07T14:30:46.734293Z","submitted_at":"2025-05-23T19:39:56Z","title":"A Critical Evaluation of Defenses against Prompt Injection Attacks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.18333","snapshot_observed_at":"2026-08-16T00:16:52.434773Z","title":"A critical evaluation of defenses against prompt injection attacks.arXiv preprint arXiv:2505.18333, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.434773Z"},"links":{"cited_paper":"/paper/2505.18333","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:5a60eb73f97a843ebdb08584a2e33f044bfda0227ba8b9bbe09e82a1205747de","observation_id":"304440f1-a086-4495-a037-cd6867237972","resolution":{"observed_at":"2026-08-16T00:16:52.434773Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2602.08235","last_updated":"2026-06-06T21:46:49Z","snapshot_observed_at":"2026-08-14T06:34:27.145671Z","submitted_at":"2026-02-09T03:20:11Z","title":"When Benign Inputs Lead to Severe Harms: Eliciting Unsafe Unintended Behaviors of Computer-Use Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2602.08235","snapshot_observed_at":"2026-08-16T00:16:52.438925Z","title":"When benign inputs lead to severe harms: Eliciting unsafe unintended behaviors of computer-use agents.arXiv preprint arXiv:2602.08235, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.438925Z"},"links":{"cited_paper":"/paper/2602.08235","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ad7c8155ad907ec9fb497da19e9d30df9ae158e30ce66737ac19eadc543f07fa","observation_id":"3fa22a94-faa1-4e26-89f4-769eb59c2aef","resolution":{"observed_at":"2026-08-16T00:16:52.438925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.826640Z","title":"Frans Kaashoek, Eddie Kohler, and Robert Morris","venue":null,"work_id":"8d0ab5e7-5d06-4e53-b73e-ac5608690ccb","year":2007},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.444062Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:744af0e71ec5334ff7a81a130c7cb01b5f388f8dd6d19fc68e5869d3265d555f","observation_id":"d9f6ab40-a906-4dc3-bcbc-96f77a87229d","resolution":{"observed_at":"2026-08-16T00:16:53.831339Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.811350Z","title":"Lakera guard","venue":null,"work_id":"d5984e63-c4de-4602-86ed-25d24c6afafe","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.448593Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b6f9393a92f7a23e208f016bf093a23f88c965dde6ab4123ac6f4c60c68642ff","observation_id":"bbbe41cc-bd09-411d-bdb0-31dba52f50a1","resolution":{"observed_at":"2026-08-16T00:16:53.816326Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.795780Z","title":"Inan, Sahar Abdelnabi, Janardhan Kulka- rni, Lukas Wutschitz, Reza Shokri, Christopher G","venue":null,"work_id":"946cf3fb-9942-483b-8a8e-5590cea533ea","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.452882Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:342eb94ea8d089c496dbe900fc39ceb4ddaa79039ea240870d67def37a5ec238","observation_id":"278e6b90-2561-48ca-80ea-0f884286fc83","resolution":{"observed_at":"2026-08-16T00:16:53.800917Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.780614Z","title":"Improving google a2a protocol: Protecting sensitive data and mitigating unintended harms in multi-agent systems.ACM Transactions on Software Engineering and Methodology, 2025","venue":null,"work_id":"cbe33c15-7940-48af-8050-db2c2ac6731c","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.457328Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b009a9801d481061faf87f771082b4eb2b166fbc2fbb0683689cc29f04303b17","observation_id":"c532226d-88ca-4992-b06f-1d85fee1064c","resolution":{"observed_at":"2026-08-16T00:16:53.785731Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2604.06284","last_updated":"2026-04-07T12:19:55Z","snapshot_observed_at":"2026-08-13T12:23:49.411000Z","submitted_at":"2026-04-07T12:19:55Z","title":"ClawLess: A Security Model of AI Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.06284","snapshot_observed_at":"2026-08-16T00:16:52.461950Z","title":"Clawless: A security model of ai agents.arXiv preprint arXiv:2604.06284, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.461950Z"},"links":{"cited_paper":"/paper/2604.06284","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:160ada2c1caff895dc21615525ce81c732eef0df923628ae762f3c79ea0c0314","observation_id":"e45143a1-69f0-49d0-871a-87ea66245a92","resolution":{"observed_at":"2026-08-16T00:16:52.461950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.466663Z","title":"Agentauditor: Human-level safety and security evaluation for llm agents.Advances in Neural Information Processing Systems, 38:43241–43298, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.466663Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b9a932ef500cb86ca8249d82e229cbd3a438f97277865065976c3d96d29ab6c0","observation_id":"090b13fd-312f-4d4d-83f9-4f61e491471e","resolution":{"observed_at":"2026-08-16T00:16:52.466663Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.754375Z","title":"A holistic approach to undesired content detection in the real world.Proceedings of the AAAI Conference on Artificial Intelligence, 37(12):15009–15018, 2023","venue":null,"work_id":"e85aad0b-ca0e-4be5-ab99-ad748514c44a","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.471715Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2f0f8dba89c7807c6c8f21d45c95f0091a07e138e36a39676377e417cc6c33ad","observation_id":"442b940f-952c-4a86-a9d5-1b2a443258f3","resolution":{"observed_at":"2026-08-16T00:16:53.759446Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.739381Z","title":"Same model, different hat","venue":null,"work_id":"51a5ab86-77e0-4e1a-9e44-c21ed59a69df","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.476231Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:edac457bc8886cd77d3f5631914d2bf15d44559a85df98e85f992b8c06ccca09","observation_id":"2f405ee0-9e96-42d5-97a8-4e2301388037","resolution":{"observed_at":"2026-08-16T00:16:53.744203Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.480555Z","title":"cell- mate: Sandboxing browser ai agents.arXiv preprint arXiv:2512.12594, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.480555Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:288973c1b38f8ed23ed63da9c6e0228a712ab81cc84473f8efb78f8cd7055d7b","observation_id":"cc114753-dc35-4cc2-8ee8-5baf3c84c28f","resolution":{"observed_at":"2026-08-16T00:16:52.480555Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.485071Z","title":"Veriguard: Enhancing llm agent safety via verified code generation.arXiv preprint arXiv:2510.05156, 2025","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.485071Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:11827be215be196c6c97b74024e377012f7ce98455f6fff1a3858d4aa9d77f69","observation_id":"131827f3-1758-499a-9774-f03e7d663a3d","resolution":{"observed_at":"2026-08-16T00:16:52.485071Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.723590Z","title":"Can LLMs keep a secret? Testing privacy implications of language models via contextual in- tegrity theory","venue":null,"work_id":"b09e060f-cf58-4e57-b29b-893456bbd40b","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.489966Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ae1aae714f5b5c06c873aafb00ba136bb71cff248991f71f7f2f3fd60efb52a4","observation_id":"50dfe044-bab5-4465-88c6-05ce4b5a19bb","resolution":{"observed_at":"2026-08-16T00:16:53.728575Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.708781Z","title":"Myers and Barbara Liskov","venue":null,"work_id":"65624091-58b8-4a8b-8962-0704dcf92689","year":1997},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.495140Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:4a86ca4d977c58fb298f4d77193fb6ce6b9fb69141724a8c25ebdae453127eee","observation_id":"9b6b5d19-4a5b-4f10-ac96-cdcf9726ff52","resolution":{"observed_at":"2026-08-16T00:16:53.713491Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.499684Z","title":"Omni-leak: Orchestrator multi-agent net- work induced data leakage.arXiv preprint arXiv:2602.13477, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.499684Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:7b2e5216da0ce6998deceb7fc708f631b2983b639cf3999cac88196c6f21260f","observation_id":"069a84aa-156b-461f-81c9-a4922b5f4b3b","resolution":{"observed_at":"2026-08-16T00:16:52.499684Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2504.19956","last_updated":"2025-05-02T18:42:42Z","snapshot_observed_at":"2026-08-16T05:36:44.756300Z","submitted_at":"2025-04-28T16:29:24Z","title":"Securing Agentic AI: A Comprehensive Threat Model and Mitigation Framework for Generative AI Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.19956","snapshot_observed_at":"2026-08-16T00:16:52.504149Z","title":"Securing agentic ai: A com- prehensive threat model and mitigation framework for generative ai agents.arXiv preprint arXiv:2504.19956, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.504149Z"},"links":{"cited_paper":"/paper/2504.19956","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:00347fed190a36c4c72edb06d1c7cda0e5253e75689471575cd37f052da5977b","observation_id":"5511faee-4228-44ad-9675-d5451e996a66","resolution":{"observed_at":"2026-08-16T00:16:52.504149Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.695263Z","title":"Privacy as contextual integrity.Washington Law Review, 79(1):119–157, 2004","venue":null,"work_id":"e35ed19a-1c13-4788-9e9e-f1c7fcac3d00","year":2004},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.509103Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:9fe1b879ce56661ad0e0a578dd580b089a8630e501a9793db220af575549b59a","observation_id":"8ce2dff6-41c4-42ae-98b4-c42a38b1fe79","resolution":{"observed_at":"2026-08-16T00:16:53.699595Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.681657Z","title":"Why traditional security fails in the age of non- deterministic AI","venue":null,"work_id":"85d53a5e-3016-4be6-b3ce-4dd274334992","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.513767Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:553ed2cc1e7925a3d65f21b7a6c4e9616c6238fa3d08bd0f0f7ffd155daa5c62","observation_id":"4a089823-b7eb-4048-963d-ad3800069634","resolution":{"observed_at":"2026-08-16T00:16:53.685891Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.16248","last_updated":"2025-07-09T01:38:20Z","snapshot_observed_at":"2026-08-16T12:48:14.367296Z","submitted_at":"2025-03-20T15:44:31Z","title":"Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.16248","snapshot_observed_at":"2026-08-16T00:16:52.518336Z","title":"Real ai agents with fake memories: Fatal context manipulation attacks on web3 agents.arXiv preprint arXiv:2503.16248, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.518336Z"},"links":{"cited_paper":"/paper/2503.16248","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:1fb527ac7564e233ea123a50f10044c85e09115bca48ea73ec0ef96ae820a696","observation_id":"3d25ab42-31cf-458e-94d5-2162e3228003","resolution":{"observed_at":"2026-08-16T00:16:52.518336Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.523086Z","title":"Agentbay: A hybrid interaction sandbox for seamless human-ai intervention in agentic systems.arXiv preprint arXiv:2512.04367, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.523086Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:8f40f3508d2ff718ba81ad4fce39dff30e5cf13b6556fac428f15b8c6dd890bb","observation_id":"9ab5920f-18cb-49f4-b5b9-91884042d05a","resolution":{"observed_at":"2026-08-16T00:16:52.523086Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.18583","last_updated":"2026-05-18T16:00:41Z","snapshot_observed_at":"2026-07-06T23:29:29.105126Z","submitted_at":"2026-05-18T16:00:41Z","title":"Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.18583","snapshot_observed_at":"2026-08-16T00:16:52.527562Z","title":"Overeager coding agents: Measuring out-of-scope actions on benign tasks.arXiv preprint arXiv:2605.18583, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.527562Z"},"links":{"cited_paper":"/paper/2605.18583","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:10fd87583402ada2a5ee288a1776e240dde16fcb3c4249835cfd4fd87c82ba35","observation_id":"921df08d-5ba6-4670-a5c6-4363430229fb","resolution":{"observed_at":"2026-08-16T00:16:52.527562Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.667852Z","title":"NeMo guardrails: A toolkit for controllable and safe LLM applications with programmable rails","venue":null,"work_id":"0787a4ac-946d-4c4e-8eae-a42a37453bc6","year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.532549Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:c0da6e56682eeb14b01e3ed2015b057a006b0b233678096573b75675b37df897","observation_id":"2b87b12c-7b12-4222-bb91-42439fdce24d","resolution":{"observed_at":"2026-08-16T00:16:53.672607Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.652405Z","title":"Zero trust architecture","venue":null,"work_id":"d93dda17-ee1d-413b-b6d6-4710217ea97c","year":2020},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.537273Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:2be22a46027492bf08e5b51b66b459818456a262e6d218b0cba0d80e5d4e8272","observation_id":"b8655260-9447-4835-b15f-934814a0e315","resolution":{"observed_at":"2026-08-16T00:16:53.657947Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.635538Z","title":"Saltzer, David P","venue":null,"work_id":"80cc60f1-44f4-4c61-a3dc-b4086f6b3802","year":1984},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.541066Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:d599bb84bf460b7b91dd6c39a2e831ba80b2d304e767fc46b515cd9ee3daacc1","observation_id":"c3cf9970-a376-4692-9cd8-1ea295bc4162","resolution":{"observed_at":"2026-08-16T00:16:53.641760Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.620693Z","title":"Saltzer and Michael D","venue":null,"work_id":"f9ed1b28-ee1b-41f7-b0be-4ee287dcff96","year":1975},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.545194Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:6ae859e5d7dae36bc76e5c7fdd9e852553f13340b642d64bf7b4dd8c40ae24f5","observation_id":"38eed1c4-1e1e-456b-a39e-017d6868533b","resolution":{"observed_at":"2026-08-16T00:16:53.625403Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.605066Z","title":"Sandhu, Edward J","venue":null,"work_id":"7a64d38d-8fd3-411d-92f4-c9aaf3a0ef68","year":1996},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.548940Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:1fe5a32fba2553128ce044308f2884d8a3f59db76ee7b0a3fe2d2bda4e9072cf","observation_id":"e940e040-cba9-4421-9736-6850d2a20f13","resolution":{"observed_at":"2026-08-16T00:16:53.610001Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.589374Z","title":"Pri- vacyLens: Evaluating privacy norm awareness of language models in action","venue":null,"work_id":"ad1df516-bb17-449c-b0a1-d3966d708efa","year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.552823Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:d5a210e50901cf8f092813512c6495f736e7b7edfcdb8a961f2af6c25811835b","observation_id":"7a57f245-ebd7-4ee6-8e9c-2307eb25f17a","resolution":{"observed_at":"2026-08-16T00:16:53.594727Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.573981Z","title":"Rollback-recovery for middleboxes","venue":null,"work_id":"a159cd5b-383d-4133-a09f-5a785d3797d2","year":2015},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.557035Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ebc4ddc96c80464f070b39e1213a699eff24f0c14c0766e3b7234b21a1bd1ede","observation_id":"e7da0d6e-0a99-42be-9729-2f18aa7f6977","resolution":{"observed_at":"2026-08-16T00:16:53.578873Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.557346Z","title":"Making middleboxes someone else’s problem: Network processing as a cloud service","venue":null,"work_id":"75487493-341d-4532-b733-a29c8e5c6685","year":2012},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.561326Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:02b66a3a658b1f26f8e290f40afc25e11fcbdc32810603d3e43c209e7f66161d","observation_id":"a2d74c86-6d82-4e25-9cc5-cfb8197de3e3","resolution":{"observed_at":"2026-08-16T00:16:53.563237Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.541738Z","title":"BlindBox: Deep packet inspection over encrypted traffic","venue":null,"work_id":"a3500252-8330-4cba-a0e1-ac75d140e64e","year":2015},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.565286Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:a7d682170da8af1559d4b071846d5f33a2e2cee030fff7ebb3d277cc4ca3e564","observation_id":"35ffd793-4f73-4ec1-9e49-f064a3a4a900","resolution":{"observed_at":"2026-08-16T00:16:53.546824Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.525190Z","title":"Progent: Programmable privilege control for llm agents.arXiv e-prints, pages arXiv–2504, 2025","venue":null,"work_id":"ef7235f7-58c3-4643-87d2-8acccd978e2b","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.570710Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:f7eec155ed06d7de2d65f0e2475a607ee635a1c1bab221e49181c513c4987a34","observation_id":"4ee59f58-654d-4619-8d57-9397e3a25186","resolution":{"observed_at":"2026-08-16T00:16:53.530999Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2605.31042","last_updated":"2026-05-29T09:19:07Z","snapshot_observed_at":"2026-08-18T00:24:11.519463Z","submitted_at":"2026-05-29T09:19:07Z","title":"From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.31042","snapshot_observed_at":"2026-08-16T00:16:52.575056Z","title":"From prompt injection to persistent control: Defending agentic harness against trojan backdoors.arXiv preprint arXiv:2605.31042, 2026","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.575056Z"},"links":{"cited_paper":"/paper/2605.31042","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:67999a726b99231123b28351c71e3715a637fd1290ff52e0283c5caa6f74f98d","observation_id":"2174ba0f-82f6-4ec8-af11-665a1b2323b0","resolution":{"observed_at":"2026-08-16T00:16:52.575056Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.508597Z","title":"AI agents are becoming authorization bypass paths","venue":null,"work_id":"22f6135c-e033-4fb4-9c6c-71007c8c76b8","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.579775Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:ad6d3ad68be9cf254e3dd5ba4759ff4fa017e244b417fce945436c4b453072c4","observation_id":"bddfdab1-8b69-45c3-a993-89ccd1560a7f","resolution":{"observed_at":"2026-08-16T00:16:53.513775Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2404.13208","last_updated":"2024-04-19T22:55:23Z","snapshot_observed_at":"2026-08-11T23:45:02.178667Z","submitted_at":"2024-04-19T22:55:23Z","title":"The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.13208","snapshot_observed_at":"2026-08-16T00:16:52.583963Z","title":"The instruction hierarchy: Training llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.583963Z"},"links":{"cited_paper":"/paper/2404.13208","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:8d8baee149b283efb51f15166d97def862b945f9f60f4986aa291011bbc09ff0","observation_id":"798cea79-2e4d-4e8e-ba7b-28b3843d9506","resolution":{"observed_at":"2026-08-16T00:16:52.583963Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.493029Z","title":"Privacy in action: Towards realistic privacy mitigation and evaluation for LLM-powered agents","venue":null,"work_id":"099eb368-ff05-4276-b557-5b122659cdb2","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.588580Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:562662cf2792446eb921b3efb8287bbe4477fe20fd7b094933f0b272a55da723","observation_id":"3cbe6a92-cb31-4c05-874e-93726b8777f5","resolution":{"observed_at":"2026-08-16T00:16:53.498000Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.477327Z","title":"Sok: Evaluating jailbreak guardrails for large language models","venue":null,"work_id":"9bd96874-03e5-47c0-8d27-f63837527b6b","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.593006Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:59b4333ceae3121299cddf4c55b0852df14d75a6561b2b7457f383edbc0685fe","observation_id":"81453714-72fd-42b8-b3fc-6b302b4f9afc","resolution":{"observed_at":"2026-08-16T00:16:53.482391Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.04960","last_updated":"2025-01-30T22:55:18Z","snapshot_observed_at":"2026-08-16T14:11:47.014972Z","submitted_at":"2024-03-08T00:02:30Z","title":"IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.04960","snapshot_observed_at":"2026-08-16T00:16:52.597372Z","title":"Isolategpt: An execution isolation architecture for llm- based agentic systems.arXiv preprint arXiv:2403.04960, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.597372Z"},"links":{"cited_paper":"/paper/2403.04960","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b0229f8c283e8e9e649124e42dab9f9a127f2232b911240ac681943ae4c96ce3","observation_id":"55a336a1-8651-4753-8173-270eafd5b5e7","resolution":{"observed_at":"2026-08-16T00:16:52.597372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.09187","last_updated":"2025-05-29T03:09:05Z","snapshot_observed_at":"2026-07-06T18:30:23.849880Z","submitted_at":"2024-06-13T14:49:26Z","title":"GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.09187","snapshot_observed_at":"2026-08-16T00:16:52.602071Z","title":"Guarda- gent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning.arXiv preprint arXiv:2406.09187, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.602071Z"},"links":{"cited_paper":"/paper/2406.09187","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:6056c78e5c1558dd1a45d7651b32fc7ea161384f38fd1f70153d98a9f3b3ba5d","observation_id":"74e8b5f8-adc1-4ee6-b059-2ff98c63d02e","resolution":{"observed_at":"2026-08-16T00:16:52.602071Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.461197Z","title":"SIFF: A stateless internet flow filter to mitigate DDoS flooding attacks","venue":null,"work_id":"5d3161e3-b315-4d76-a970-694e191cec51","year":2004},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.607052Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:84872db0e2d1fdc9f6907882de3a8a420b2d4c8eb2761914c285e3e7cffbc3d4","observation_id":"4a45c84b-e8d1-4c47-81fc-feee9fb2654b","resolution":{"observed_at":"2026-08-16T00:16:53.466718Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.445925Z","title":"A DoS- limiting network architecture","venue":null,"work_id":"4b3032bd-7fcc-43c1-b0f0-0ff7d47a2023","year":2005},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.611415Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:eab12916ff89d5feaa8e1aa83a71927f5b3ae790b6d4517026347a81a8699c49","observation_id":"c3312728-17f5-4e05-8cba-74ada3c8feb5","resolution":{"observed_at":"2026-08-16T00:16:53.450831Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.616158Z","title":"ReAct: Synergizing reasoning and acting in language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.616158Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:9f5e3f1628d21b9e1b5b46a666ac78b5c156744e74a7dd94dd5272fd43dc59bb","observation_id":"b02123c1-dbfb-497b-a416-dee577e8c4a3","resolution":{"observed_at":"2026-08-16T00:16:52.616158Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.420131Z","title":"Temporal dynamics of mem- ory poisoning in web3-style llm agents.IEEE Access, 2026","venue":null,"work_id":"36c7a129-94a3-4bed-ac18-9690d238ff91","year":2026},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.620509Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:e55f60e76ffbe00f8033cd433ebff1c5bfd12a139581487546232c80dedc8bbf","observation_id":"d749151e-5914-4f48-8875-690664504b3c","resolution":{"observed_at":"2026-08-16T00:16:53.425044Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.403812Z","title":"Making information flow explicit in HiStar","venue":null,"work_id":"19c6966c-c4af-41a6-87d2-934beebbbf11","year":2006},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.625041Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:35776c38e839c9f218bd11c9a446a64a03608f33fed2a943f78602b87687527e","observation_id":"524731c4-3e4c-4b1a-bd71-5b83f9c00d9c","resolution":{"observed_at":"2026-08-16T00:16:53.409351Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.629850Z","title":"Injecagent: Benchmarking indirect prompt injections in tool-integrated large lan- guage model agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.629850Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b7d0cc74f7e109fc2226a735f3d3dc6fd8d2c539650859f5dcc21e73d2420c50","observation_id":"26f6f9af-a124-467e-b693-d47653751744","resolution":{"observed_at":"2026-08-16T00:16:52.629850Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2412.10807","last_updated":"2025-06-12T10:17:02Z","snapshot_observed_at":"2026-08-15T20:23:53.531433Z","submitted_at":"2024-12-14T12:11:26Z","title":"Towards Action Hijacking of Large Language Model-based Agent","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.10807","snapshot_observed_at":"2026-08-16T00:16:52.634434Z","title":"Towards action hijacking of large language model-based agent.arXiv preprint arXiv:2412.10807, 2024","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.634434Z"},"links":{"cited_paper":"/paper/2412.10807","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:21a402a80c7f9bf07f88a0c39e221d1095639db123c7c7e417e2ffbd7054c214","observation_id":"e9121ddc-0084-4c58-b0a5-a12b43efabfc","resolution":{"observed_at":"2026-08-16T00:16:52.634434Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.377900Z","title":"AgentDAM: Privacy leakage evaluation for autonomous web agents","venue":null,"work_id":"d8f44d39-c7cf-4ce8-a7a1-f6b0e5b7dc13","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.639378Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:f063e76f0425e1722ff5c3a8a8698752fc2e08bebbc79d679b4184e8737cad53","observation_id":"fe36e78b-b5bf-4996-8d88-d11f94fc0f72","resolution":{"observed_at":"2026-08-16T00:16:53.382866Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.08966","last_updated":"2025-02-14T04:16:40Z","snapshot_observed_at":"2026-08-07T23:01:30.196995Z","submitted_at":"2025-02-13T05:06:22Z","title":"RTBAS: Defending LLM Agents Against Prompt Injection and Privacy Leakage","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.08966","snapshot_observed_at":"2026-08-16T00:16:52.643873Z","title":"Rtbas: Defending llm agents against prompt injection and privacy leakage.arXiv preprint arXiv:2502.08966, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.643873Z"},"links":{"cited_paper":"/paper/2502.08966","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:bdd831ea0d7573dd96d8853e3de647f4c4cfaac41a8a51fa2470ca9a8d9a6ac0","observation_id":"8e10ec44-80f8-4ff2-94f6-1c098895bc68","resolution":{"observed_at":"2026-08-16T00:16:52.643873Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:53.355300Z","title":"Rescriber: Smaller- LLM-powered user-led data minimization for LLM-based chatbots","venue":null,"work_id":"f62e55b8-8f05-4018-afe4-eb97689c8e6c","year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.648792Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:4ff0f7eb1691b8ddda574593437925fbe1c628f0668d2707315990abbda92532","observation_id":"a11e147c-8315-4aff-9114-684a09cfc24b","resolution":{"observed_at":"2026-08-16T00:16:53.363098Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-18T06:34:40.430872+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2503.17332","last_updated":"2025-06-24T04:10:59Z","snapshot_observed_at":"2026-08-16T12:47:52.443525Z","submitted_at":"2025-03-21T17:32:32Z","title":"CVE-Bench: A Benchmark for AI Agents' Ability to Exploit Real-World Web Application Vulnerabilities","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.17332","snapshot_observed_at":"2026-08-16T00:16:52.653903Z","title":"Cve-bench: a benchmark for ai agents’ ability to exploit real-world web application vulnerabilities.arXiv preprint arXiv:2503.17332, 2025","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.653903Z"},"links":{"cited_paper":"/paper/2503.17332","citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:b6ac07b83b30cf2297974b89758a588ca4e032b646abf7888b57dda0c0ad3141","observation_id":"97d3c3fa-887f-4d8e-bf85-d9d2c3c98277","resolution":{"observed_at":"2026-08-16T00:16:52.653903Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-16T00:16:52.318565Z","title":null,"venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem","version":1},"reference_index":2024,"source":"pdf_text","source_observed_at":"2026-08-16T00:16:52.318565Z"},"links":{"citing_paper":"/paper/2608.12172"},"observation_digest":"sha256:620c092323e7a4c4b9b3474899bee58a699712d5dbc22b6e81c6005c354912fe","observation_id":"51282d5b-1aa8-4e13-afdd-045001046885","resolution":{"observed_at":"2026-08-16T00:16:52.318565Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2608.12172","last_updated":"2026-08-12T15:29:51Z","latest_version":1,"primary_category":"cs.MA","snapshot_observed_at":"2026-08-18T13:59:01.040559Z","submitted_at":"2026-08-12T15:29:51Z","title":"Rethinking Agent Security as a Networking Problem"},"reference_resolution":{"displayed":77,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":31,"verified_exact":0,"verified_fuzzy":46},"total_outbound_references":77},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-18T06:34:40.430872+00:00","source":"crossref"},{"observed_at":"2026-08-18T06:34:34.496301+00:00","source":"retraction_watch"}],"thesis":"As of 18 August 2026, this Paper Citation Record lists 77 of 77 outbound references and 0 inbound Pith citation observations for arXiv:2608.12172."}