{"as_of":"2026-08-16T07:45:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:cddd74000061b9a3331b7f9e0ada596da50d9d63e18634fff2a8deca1bc9d402","coverage":[{"denominator":76,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":76,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-15T19:23:24.829197Z","state":"measured"},{"denominator":76,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":76,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-16T06:30:59.297886+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2608.12977/citation-record","integrity":"/paper/2608.12977/integrity","json":"/paper/2608.12977/citation-record.json","paper":"/paper/2608.12977"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.897855Z","title":"Re- act: Synergizing reasoning and acting in language models","venue":null,"work_id":"b769bdeb-aeac-491f-b20a-ff22edbb611e","year":2023},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.779389Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:3ed5b42117012552200e19001a623a93f061ef15c2c1af710613bbdfae85b0f2","observation_id":"e2e316f4-2144-4c23-afec-cc92c79d6ba1","resolution":{"observed_at":"2026-08-15T19:23:27.903094Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.877011Z","title":"Toolformer: Language models can teach them- selves to use tools","venue":null,"work_id":"aa5c23ca-0dcc-4662-9211-b994961e0f28","year":2023},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.809565Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:4b9094460fbce4df3363dce5713f61beaa98ee99063412dc930487ee9c8db043","observation_id":"4c57a5ac-0bf2-4b60-a03c-59d17129018d","resolution":{"observed_at":"2026-08-15T19:23:27.885166Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.676575Z","title":"Patil, Tianjun Zhang, Xin Wang, and Joseph E","venue":null,"work_id":"d18ec8dd-6ed9-46f1-aee3-15cf72a94544","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.827603Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:c405037890aa2280845afa67c605adbbbd5c7558d3f64069007a8a309e206536","observation_id":"20dec6e3-f9de-4ca6-9c3f-d801489ec2c7","resolution":{"observed_at":"2026-08-15T19:23:27.761473Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.658130Z","title":"Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan","venue":null,"work_id":"e3249fab-70c6-4019-ae4b-e98120c025e0","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.833925Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:4d5648071a88447f2d2915c050d6a4e279d8d189ab808e6ba62c8727c36f2de3","observation_id":"91ad0cc3-65fa-4670-9a7d-1c7b84b44e55","resolution":{"observed_at":"2026-08-15T19:23:27.664230Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.13854","last_updated":"2024-04-16T15:13:18Z","snapshot_observed_at":"2026-08-14T11:14:55.351653Z","submitted_at":"2023-07-25T22:59:32Z","title":"WebArena: A Realistic Web Environment for Building Autonomous Agents","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.13854","snapshot_observed_at":"2026-08-15T19:23:22.839499Z","title":"Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.839499Z"},"links":{"cited_paper":"/paper/2307.13854","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:ff7386645cc90c525bbf0cc5bd361ddfdb1d38d9f65d4914b6d53dc41fc855e6","observation_id":"6cb4ec6a-4bc6-45b2-a9d0-62b94857b1a5","resolution":{"observed_at":"2026-08-15T19:23:22.839499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.639993Z","title":"Maddison, and Tatsunori Hashimoto","venue":null,"work_id":"02411dca-3da4-4caf-9745-8aaa493a8058","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.845918Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:2fbc3e8d2212db0df88919bd27e5c622a8a48bf1ada9a3aaf957b33f2802271b","observation_id":"91ce4f18-1652-4079-aa93-2906529cb8c2","resolution":{"observed_at":"2026-08-15T19:23:27.645389Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.527243Z","title":"Agentharm: A benchmark for measuring harmfulness of llm agents","venue":null,"work_id":"711bd46e-d33c-4c60-895f-2f7683831d52","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.851748Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:27857703d8e748df77517f4de9db31e9dc5a6420723048605400750334696b1d","observation_id":"e87ef818-3caf-481f-bf41-a2eefae9e1e1","resolution":{"observed_at":"2026-08-15T19:23:27.595334Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.512264Z","title":"Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents","venue":null,"work_id":"2f3eae6c-6318-44c3-8f7d-ce2b5e6e124f","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.857396Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:ed53792d5468315de89a88fba57c5201201400a9c275ef6a473c9e16b4114393","observation_id":"adfe4f82-4816-4ce0-a97a-8123905ddf3a","resolution":{"observed_at":"2026-08-15T19:23:27.516920Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.495816Z","title":"Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents","venue":null,"work_id":"5af2e03e-cbed-4f53-922a-a5c420dcf6e9","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.863808Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:d2d3e8f0345934d6cf052c0654688970131f39740bfa193b9587747d09448afc","observation_id":"f523a6af-df5d-48db-a303-04e8377cf094","resolution":{"observed_at":"2026-08-15T19:23:27.501022Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2412.16682","last_updated":"2024-12-21T16:17:48Z","snapshot_observed_at":"2026-08-12T03:14:31.288757Z","submitted_at":"2024-12-21T16:17:48Z","title":"The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2412.16682","snapshot_observed_at":"2026-08-15T19:23:22.940989Z","title":"The task shield: Enforcing task alignment to defend against indirect prompt injection in llm agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:22.940989Z"},"links":{"cited_paper":"/paper/2412.16682","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:b0c79c898747c80161e3b6503307be7e8f7ab132d4e3f3b5b7e12f9ddf609f6c","observation_id":"a1fca321-2cae-4f55-980e-5d4605907cd2","resolution":{"observed_at":"2026-08-15T19:23:22.940989Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.06363","last_updated":"2024-09-25T19:48:39Z","snapshot_observed_at":"2026-08-14T19:45:16.313175Z","submitted_at":"2024-02-09T12:15:51Z","title":"StruQ: Defending Against Prompt Injection with Structured Queries","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.06363","snapshot_observed_at":"2026-08-15T19:23:23.041441Z","title":"Struq: Defending against prompt injection with structured queries","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.041441Z"},"links":{"cited_paper":"/paper/2402.06363","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:ce1fe4763bb19f5138a782a4e72abaccfcac220ba5892cd3922ad4950a3f2c8f","observation_id":"ffd2e8c0-7c86-4a9a-a4d2-fcba4a34b5c3","resolution":{"observed_at":"2026-08-15T19:23:23.041441Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2410.05451","last_updated":"2025-07-03T05:45:41Z","snapshot_observed_at":"2026-08-15T07:38:32.361902Z","submitted_at":"2024-10-07T19:34:35Z","title":"SecAlign: Defending Against Prompt Injection with Preference Optimization","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2410.05451","snapshot_observed_at":"2026-08-15T19:23:23.073914Z","title":"Secalign: Defending against prompt injection with preference optimization","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.073914Z"},"links":{"cited_paper":"/paper/2410.05451","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:9afb182bf342e3bf902ade642c1b34b37f2cf2d6f23c3303fe8a74c28c5ce984","observation_id":"a59a9ec2-571e-4052-9299-c54acff204a3","resolution":{"observed_at":"2026-08-15T19:23:23.073914Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:23.084596Z","title":"Toolsafety: A comprehensive dataset for enhancing safety in llm- based agent tool invocations","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.084596Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:4a7ece0833ac540cd953526ff6148fd64170bbd239a284022dac6a4d9fcb2db6","observation_id":"ae45350b-9e22-42bf-9513-a93d98ebe828","resolution":{"observed_at":"2026-08-15T19:23:23.084596Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2507.08270","last_updated":"2025-07-11T02:34:16Z","snapshot_observed_at":"2026-08-07T01:31:51.955348Z","submitted_at":"2025-07-11T02:34:16Z","title":"Agent Safety Alignment via Reinforcement Learning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.08270","snapshot_observed_at":"2026-08-15T19:23:23.093260Z","title":"Agent safety alignment via reinforcement learning","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.093260Z"},"links":{"cited_paper":"/paper/2507.08270","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:c3b96135bf8fb0d43f80feb98b238ab288d8ff19d9f54fc905a4cea5d4b4f184","observation_id":"9fde75e9-3488-4d78-9538-2781d2be5cef","resolution":{"observed_at":"2026-08-15T19:23:23.093260Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:23.102333Z","title":"Adversarial reinforcement learning for large language model agent safety","venue":null,"work_id":null,"year":null},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.102333Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:dd0a054fb428be0ece797f0291dd39d49a1ede8b7b969348bf0c4648ac21c5d6","observation_id":"c0c9207c-d58e-4367-87ab-862bec6881c3","resolution":{"observed_at":"2026-08-15T19:23:23.102333Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.11882","last_updated":"2026-05-12T09:56:28Z","snapshot_observed_at":"2026-08-11T20:30:03.018548Z","submitted_at":"2026-05-12T09:56:28Z","title":"On-Policy Self-Evolution via Failure Trajectories for Agentic Safety Alignment","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.11882","snapshot_observed_at":"2026-08-15T19:23:23.109851Z","title":"On-policy self- evolution via failure trajectories for agentic safety alignment","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.109851Z"},"links":{"cited_paper":"/paper/2605.11882","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:7a3b541eae88b6a94fadbc58e99c9f8ca38edf21fd68f322d906771fb867764e","observation_id":"a70265d2-98db-4f26-901d-ca99324933e7","resolution":{"observed_at":"2026-08-15T19:23:23.109851Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:23.116195Z","title":"The attack and defense landscape of agentic ai: A comprehensive survey","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.116195Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:bf9c7824c097be69a7625169b2237702bca68e5283da260228d6b8eccf0c7cab","observation_id":"f1bebccd-604f-4c28-be75-c8df45d06f1f","resolution":{"observed_at":"2026-08-15T19:23:23.116195Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.11790","last_updated":"2026-05-11T16:09:04Z","snapshot_observed_at":"2026-08-12T15:01:26.208104Z","submitted_at":"2026-04-13T17:55:11Z","title":"ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.11790","snapshot_observed_at":"2026-08-15T19:23:23.121097Z","title":"Clawguard: A runtime security framework for tool- augmented llm agents against indirect prompt in- jection","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.121097Z"},"links":{"cited_paper":"/paper/2604.11790","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:674e1b668352963000986d1395db1715e5b7283355d09d9908efac3835f0fb05","observation_id":"25c934bb-7f40-4f8e-b0b0-de0765f732f2","resolution":{"observed_at":"2026-08-15T19:23:23.121097Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:23.126307Z","title":"Openclaw prism: A zero-fork, defense- in-depth runtime security layer for tool-augmented llm agents","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.126307Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:4e961beb3936398ec63da461beb599a73513ce6a09df04b49b831db79d19c728","observation_id":"3d68d17f-917a-4be1-8d8a-d2caa9fb9835","resolution":{"observed_at":"2026-08-15T19:23:23.126307Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.327070Z","title":"Defending against indirect prompt injection attacks with spotlighting","venue":null,"work_id":"bf55eb90-d371-4879-9788-83ba2525cfba","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.131485Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:435a7a774e79e239e9038c00d43002add4defeee20d6456b77bc307f9880b343","observation_id":"788081a5-682c-4c97-8993-e97c5f35472c","resolution":{"observed_at":"2026-08-15T19:23:27.409925Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.311970Z","title":"GuardAgent: Safeguard LLM agents via knowledge-enabled reasoning","venue":null,"work_id":"f8feeb03-bce1-4e73-aa16-cfb3afa376d5","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.168862Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:76f831becd70ef6ed3af9e050e035286df32aa808cb8344b3ae32e9306a2d93c","observation_id":"02d939c6-06ca-4837-8d74-7520f57a7596","resolution":{"observed_at":"2026-08-15T19:23:27.316544Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.295360Z","title":"IsolateGPT: An ex- ecution isolation architecture for LLM-based agen- tic systems","venue":null,"work_id":"3ecfd071-be4f-4303-a4d5-409bcf42d914","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.274452Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:9277e5d739dceb1f0942da04bbbeecce08068e7899ca0625f5fdf86f65f6e659","observation_id":"f67b2e00-887c-4b7f-b6c8-7a20348db829","resolution":{"observed_at":"2026-08-15T19:23:27.301958Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2504.11703","last_updated":"2026-05-14T02:36:38Z","snapshot_observed_at":"2026-08-12T23:26:44.716922Z","submitted_at":"2025-04-16T01:58:40Z","title":"Progent: Securing AI Agents with Privilege Control","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2504.11703","snapshot_observed_at":"2026-08-15T19:23:23.325322Z","title":"10 Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM AgentsA PREPRINT Progent: Securing ai agents with privilege control","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.325322Z"},"links":{"cited_paper":"/paper/2504.11703","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:67c376941e6e214a28a39069c53ab96ff257433614e36b65d87a5a7d2c39e1e2","observation_id":"1c963db4-b9da-4cf5-85d0-383767a63f49","resolution":{"observed_at":"2026-08-15T19:23:23.325322Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:23.334717Z","title":"Defending against indirect prompt injection by instruction detection","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.334717Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:a7203b9dc28bc5ef0a180d00c8ef3dc9bba320ebd5e068f153278cbeb9267e18","observation_id":"041b15f2-744b-4862-8781-4a6e5146e6d9","resolution":{"observed_at":"2026-08-15T19:23:23.334717Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.00061","last_updated":"2025-03-04T03:32:46Z","snapshot_observed_at":"2026-08-15T11:48:12.400892Z","submitted_at":"2025-02-27T04:04:50Z","title":"Adaptive Attacks Break Defenses Against Indirect Prompt Injection Attacks on LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.00061","snapshot_observed_at":"2026-08-15T19:23:23.340515Z","title":"Adaptive attacks break defenses against indirect prompt injection attacks on llm agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.340515Z"},"links":{"cited_paper":"/paper/2503.00061","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:db8496dc19b128ef818da8d3d2e29c40bc5cfd89706f9f9973c365d217176683","observation_id":"e47d4d2c-b630-443a-8f7b-8c3713f333d4","resolution":{"observed_at":"2026-08-15T19:23:23.340515Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2606.10484","last_updated":"2026-06-09T06:55:37Z","snapshot_observed_at":"2026-08-14T07:53:57.222567Z","submitted_at":"2026-06-09T06:55:37Z","title":"AgentCanary: A Security Evaluation Framework for Autonomous AI Agents in Real Executable Environments","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2606.10484","snapshot_observed_at":"2026-08-15T19:23:23.346372Z","title":"AgentCanary: A secu- rity evaluation framework for autonomous ai agents in real executable environments","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.346372Z"},"links":{"cited_paper":"/paper/2606.10484","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:c59e2ea3ca5c31fb725f000644bf654bcc81eefbe6927b00c894e6582f773ca9","observation_id":"5cf22db1-1859-4bb3-a4a3-2882e2601706","resolution":{"observed_at":"2026-08-15T19:23:23.346372Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.208834Z","title":"DRIFT: Dy- namic rule-based defense with injection isolation for securing LLM agents","venue":null,"work_id":"275de21b-7ac3-4df8-bb56-798b090eabf5","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.456798Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:398c74ce8f177b3b492c2160e0c970857952ffbd30607cbb1a87916ba9814aa3","observation_id":"e2036143-2050-4bbf-b932-21ab6d608389","resolution":{"observed_at":"2026-08-15T19:23:27.265290Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2405.05175","last_updated":"2024-09-18T20:53:06Z","snapshot_observed_at":"2026-08-13T00:12:14.418752Z","submitted_at":"2024-05-08T16:12:45Z","title":"AirGapAgent: Protecting Privacy-Conscious Conversational Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.05175","snapshot_observed_at":"2026-08-15T19:23:23.594376Z","title":"Airgapagent: Protect- ing privacy-conscious conversational agents","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.594376Z"},"links":{"cited_paper":"/paper/2405.05175","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:1a69a5404d5f2265f45655b35eada8db06fe806c1142c1b7b0acc430dadac5d3","observation_id":"bc17199c-697b-4aa9-b64d-fc1f8e5a6e8b","resolution":{"observed_at":"2026-08-15T19:23:23.594376Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.02947","last_updated":"2026-04-03T10:29:31Z","snapshot_observed_at":"2026-07-29T16:09:43.498926Z","submitted_at":"2026-04-03T10:29:31Z","title":"AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.02947","snapshot_observed_at":"2026-08-15T19:23:23.602653Z","title":"AgentHazard: A benchmark for evaluating harmful behavior in computer-use agents","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.602653Z"},"links":{"cited_paper":"/paper/2604.02947","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:2bdb7badfb129b4a3111163c473e781a460255b97de48b8272701e15135c3223","observation_id":"77ab97fe-e76d-4aab-a497-1fc40c161919","resolution":{"observed_at":"2026-08-15T19:23:23.602653Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.192552Z","title":"Pinchbench: Real-world benchmarks for ai agents","venue":null,"work_id":"82ad0224-6a5b-4221-be4a-c879d1ed2ce8","year":null},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.608832Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:09ef3a1d52348523c4dedffffd9e40a1157775676db4c92dc36f5749a6147c96","observation_id":"c2bcfba3-4a04-40ff-a61d-152dc28fcb7f","resolution":{"observed_at":"2026-08-15T19:23:27.197958Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.156891Z","title":"SecureClaw: An owasp-aligned secu- rity plugin and skill for openclaw agents","venue":null,"work_id":"7e49bac3-47db-43fe-bfd7-98916a5a64f5","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.695158Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:3c9ba1898dea2ea52d211ab4f0ad6d665b7a0d33a8d7817da568fa51686fecab","observation_id":"ff68e088-c2cc-4d7a-a46c-6ddc69981516","resolution":{"observed_at":"2026-08-15T19:23:27.162604Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:23.800011Z","title":"ClawKeeper: Comprehensive safety protection for openclaw agents through skills, plugins, and watch- ers","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.800011Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:9bc95b2d8e59c9d127a0ed45b4279b3c7c03d37502f6463e1aed87f0d57a57a9","observation_id":"761e7900-d747-4e50-8a06-7d234c852e3f","resolution":{"observed_at":"2026-08-15T19:23:23.800011Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.074105Z","title":"OpenClaw Shield: A defense-in-depth se- curity plugin for openclaw agents","venue":null,"work_id":"e8a5770a-4bee-48b0-9826-6d4d8d18ad89","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.807622Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:6b7b30774f6e56d328ad2e97c1b48d80cc31143905fc832b5261a1413d1f41a2","observation_id":"e52dc3c4-54d2-4be7-8123-07f836fbd041","resolution":{"observed_at":"2026-08-15T19:23:27.111567Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.021046Z","title":"DeepSeek-V4 technical report","venue":null,"work_id":"a9d89f70-13a6-4abd-9db6-25f88194c13b","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.813534Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:c376e154052a7f90b684192748369b056b300f4a071e1cf9ee73d8cedb216917","observation_id":"3240cbff-d4e3-4bfb-b0a6-d67750e1a739","resolution":{"observed_at":"2026-08-15T19:23:27.025868Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.005356Z","title":"GLM-5 technical report","venue":null,"work_id":"e698b3d9-66c9-4442-a2c8-a0f704873ebe","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.934613Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:cf26545f02adf844fa73fc241ad9207eb847e8b9be7c7c3d8326c24b1c0ea42b","observation_id":"f9b18c3c-7b14-4599-88ed-922b0a1ffd3e","resolution":{"observed_at":"2026-08-15T19:23:27.010087Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.988438Z","title":"GLM-5.2 technical report","venue":null,"work_id":"58804cf4-3205-4f64-9c2e-a97aa263a808","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.022092Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:a965ed01c653865ff364fbe78b1fb9631174361379e765947f5c72915fb61533","observation_id":"f1ceaf12-beaa-49b5-8fb7-fa74e39ef638","resolution":{"observed_at":"2026-08-15T19:23:26.994478Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.972618Z","title":"Claude Opus 4.6","venue":null,"work_id":"cf9f4723-7533-4ea7-9ef8-ffdc671f2485","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.041037Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:87af5be3dda0afd2d8a9ba818e2ce29dd507702ec1149b23b3cfd24a847c7fec","observation_id":"447035be-0980-422d-9931-b72792a5f624","resolution":{"observed_at":"2026-08-15T19:23:26.977576Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.873522Z","title":"Qwen3.7-Max","venue":null,"work_id":"ac7fbeed-cfe7-4b30-9dd4-563c54e582da","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.045620Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:f1e586c4f099150daf770e675c435eeff36b4cd5a151ac9478c993983985c33c","observation_id":"78dd1f9f-9cc3-4a62-86d2-0193be1f9f7d","resolution":{"observed_at":"2026-08-15T19:23:26.908268Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.831888Z","title":"GPT-5.5 system card","venue":null,"work_id":"efeeb780-50c2-47af-bfab-4666a8db1600","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.050598Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:b340560e0f6fd27ce4a481ef97284bceeac2cb9fed25728957ce20e66913bd3b","observation_id":"d494b7ff-115f-410e-9261-44d2a9a3680a","resolution":{"observed_at":"2026-08-15T19:23:26.838053Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-08-12T09:06:50.363435Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-15T19:23:24.055925Z","title":"Zico Kolter, and Matt Fredrik- son","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.055925Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:4aec02bddfdbf834576a4f83e93cd4d582bbd8f9d84f1d2a6f000954926e454c","observation_id":"a1a854b0-58b4-4352-976e-77323ddf3098","resolution":{"observed_at":"2026-08-15T19:23:24.055925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.815745Z","title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","venue":null,"work_id":"a8c8340a-c7e5-4eee-8782-3e69e36b471d","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.062496Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:82b91ef74e2f32fba327d794e3e8f0fa9af8d274df2f69ca492ef7f2d8753a8b","observation_id":"b0acf4b4-74df-497a-a4ed-f0b9376cf8f0","resolution":{"observed_at":"2026-08-15T19:23:26.820947Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2310.08419","last_updated":"2024-07-18T18:24:57Z","snapshot_observed_at":"2026-08-15T20:30:40.297931Z","submitted_at":"2023-10-12T15:38:28Z","title":"Jailbreaking Black Box Large Language Models in Twenty Queries","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.08419","snapshot_observed_at":"2026-08-15T19:23:24.068214Z","title":"Pappas, and Eric Wong","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.068214Z"},"links":{"cited_paper":"/paper/2310.08419","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:f14238fd1bc3d3aa9229e846ead92c6a5d78cf200ca3dd630462ac281e970222","observation_id":"d23c3a7b-dd63-4e58-a3be-2d717b5776aa","resolution":{"observed_at":"2026-08-15T19:23:24.068214Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.704405Z","title":"Tree of attacks: Jail- breaking black-box llms automatically","venue":null,"work_id":"3c4142d9-1b00-492f-a306-f0db72a79c72","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.074547Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:d30d40f456bade0185a85bdbf013d6757749771077cb3eadb3cfbaa43f38d421","observation_id":"7ac0eb4d-3b2d-4184-8f28-c24e802968a7","resolution":{"observed_at":"2026-08-15T19:23:26.775175Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.687293Z","title":"Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection","venue":null,"work_id":"7b1d8aa0-4b0b-4e2f-b338-0b044599b461","year":2023},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.177372Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:b15933cdbcb84a36712f8b9994b814dfa70ceb54fa5d2796a2f96ac5fdb44749","observation_id":"b5381621-f903-4e81-813b-84d462c31096","resolution":{"observed_at":"2026-08-15T19:23:26.692984Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.576664Z","title":"InjecAgent: Benchmarking indirect prompt injections in tool-integrated large language model agents","venue":null,"work_id":"22992b78-0bcf-4baf-8b3f-127371ce653a","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.235345Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:5a097d9ee0ecfe50362980fab853600a5881d0a5966cca739dcf9e052565c16d","observation_id":"e083b540-c6d9-4724-a04c-eb2e0008a4a1","resolution":{"observed_at":"2026-08-15T19:23:26.641449Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.560783Z","title":"Formalizing and bench- marking prompt injection attacks and defenses","venue":null,"work_id":"1ffcbd5f-c72f-478c-9c5c-351b3613e6e6","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.305911Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:084e34f711bc53efb60d49f2b1816f8e3213fcbf0198f53208024b7c3a72d9c0","observation_id":"71143061-6018-4965-b9d4-36e9851602dc","resolution":{"observed_at":"2026-08-15T19:23:26.565892Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.03792","last_updated":"2024-05-02T09:25:38Z","snapshot_observed_at":"2026-08-13T04:02:09.950658Z","submitted_at":"2024-03-06T15:40:30Z","title":"Neural Exec: Learning (and Learning from) Execution Triggers for Prompt Injection Attacks","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.03792","snapshot_observed_at":"2026-08-15T19:23:24.310635Z","title":"Neural exec: Learning (and learning from) execution triggers for prompt injection at- tacks","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.310635Z"},"links":{"cited_paper":"/paper/2403.03792","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:2c88afd980d035ddc1963a04667f9667ea98426cbe205dbbeb37ab950133083e","observation_id":"3c4625b0-ef24-4a83-aa75-9f0957dfb8b8","resolution":{"observed_at":"2026-08-15T19:23:24.310635Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.542060Z","title":"AgentPoison: Red-teaming LLM agents via poisoning memory or knowledge bases","venue":null,"work_id":"05699165-49d0-4c63-be32-30b279533bd0","year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.317500Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:fbb89be6523ebf379fa9b348cbc485e512d4265d427ffa8113bd02a29e386fc7","observation_id":"8ea2e180-2bd1-4c65-a211-5608300d5860","resolution":{"observed_at":"2026-08-15T19:23:26.547628Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.460280Z","title":"PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models","venue":null,"work_id":"47e1a531-0f36-4852-9e59-eb72b3011e0c","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.322584Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:49ac13a59608388d988ee42ff85485d4b13354624fa38b4bfe8e113b89363691","observation_id":"e6e8271c-2077-4d4f-a612-66afc7ac2f0a","resolution":{"observed_at":"2026-08-15T19:23:26.529674Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:24.327323Z","title":"Memory injection attacks on LLM agents via query-only interaction","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.327323Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:c2e1803d75988a3e530a2c37cd194e8926e12911f5594b8124968a2dff00fa5d","observation_id":"fab29f3c-e092-41bd-b1e1-f56cb8276ff3","resolution":{"observed_at":"2026-08-15T19:23:24.327323Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2508.14925","last_updated":"2025-08-19T10:12:35Z","snapshot_observed_at":"2026-08-13T23:21:40.784749Z","submitted_at":"2025-08-19T10:12:35Z","title":"MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Servers","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2508.14925","snapshot_observed_at":"2026-08-15T19:23:24.332483Z","title":"MCP- Tox: A benchmark for tool poisoning attack on real-world MCP servers","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.332483Z"},"links":{"cited_paper":"/paper/2508.14925","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:1fb18e6a39ebc4de42a408ef8ec5fa3e36e8cb74567243e571fbcdff3eee61fd","observation_id":"3130b42d-3d50-4847-af82-fc87021e75b9","resolution":{"observed_at":"2026-08-15T19:23:24.332483Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:24.337604Z","title":"Breaking the protocol: Security analysis of the model context protocol specification and prompt injection vul- nerabilities in tool-integrated llm agents","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.337604Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:b8e62d4713bea32210566ce13cb514fb05bbe86da6b6cdf28b7971e93126d269","observation_id":"ea463893-844b-43df-a3a2-486053c012c6","resolution":{"observed_at":"2026-08-15T19:23:24.337604Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.09378","last_updated":"2026-04-10T14:48:29Z","snapshot_observed_at":"2026-08-12T16:45:43.921974Z","submitted_at":"2026-04-10T14:48:29Z","title":"BadSkill: Backdoor Attacks on Agent Skills via Model-in-Skill Poisoning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.09378","snapshot_observed_at":"2026-08-15T19:23:24.342855Z","title":"BadSkill: Backdoor attacks on agent skills via model-in-skill poisoning","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.342855Z"},"links":{"cited_paper":"/paper/2604.09378","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:c326ce5f5940d7d091e835dd13a0d7a66e7e861cda92deda2d2ebf7af5552659","observation_id":"4d13b556-52b2-4d0f-9c30-82521fb931bb","resolution":{"observed_at":"2026-08-15T19:23:24.342855Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2604.03081","last_updated":"2026-04-03T14:58:58Z","snapshot_observed_at":"2026-08-15T02:21:36.634688Z","submitted_at":"2026-04-03T14:58:58Z","title":"Supply-Chain Poisoning Attacks Against LLM Coding Agent Skill Ecosystems","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2604.03081","snapshot_observed_at":"2026-08-15T19:23:24.395556Z","title":"Supply-chain poisoning attacks against LLM coding agent skill ecosystems","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.395556Z"},"links":{"cited_paper":"/paper/2604.03081","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:8a70188a66f71cd90a703e61c376c540976add3b42240f655b7bb14d0eca2305","observation_id":"17b8c90f-f5bf-46aa-ac25-f282a99c8faa","resolution":{"observed_at":"2026-08-15T19:23:24.395556Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.355973Z","title":"Jailbreaking leading safety- aligned LLMs with simple adaptive attacks","venue":null,"work_id":"1cdab0c7-eea6-40e9-b93f-26226e11d849","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.447419Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:2aa58917818f7123a2120595a87a8bfb65c2c27f3c2919bad8992f0a49cab77b","observation_id":"ac56b610-7aca-462b-bc60-0ec5ed13dcaa","resolution":{"observed_at":"2026-08-15T19:23:26.363117Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.337612Z","title":"AdvAgent: Controllable blackbox red- teaming on web agents","venue":null,"work_id":"5513e037-1788-4b37-b2df-648e241b20f4","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.452513Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:4160355bd466ae06628330fd143aa1122771af8013bb445aeb232cdc8e996cc3","observation_id":"71a3a7df-5262-40c6-bc3c-fdda002bdbb8","resolution":{"observed_at":"2026-08-15T19:23:26.343515Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.211398Z","title":"Great, now write an article about that: The crescendo multi-turn LLM jailbreak attack","venue":null,"work_id":"8560f91b-4035-4212-9e64-3387a59bf282","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.457674Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:21234afe7285fca228658ff657f88b0461a134466c3c62d45b0852820f0366fe","observation_id":"dfbd1a0e-fded-4518-87fb-51dd9fde217c","resolution":{"observed_at":"2026-08-15T19:23:26.285367Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2502.19820","last_updated":"2025-03-28T00:37:10Z","snapshot_observed_at":"2026-08-12T23:38:20.655752Z","submitted_at":"2025-02-27T06:49:16Z","title":"Foot-In-The-Door: A Multi-turn Jailbreak for LLMs","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2502.19820","snapshot_observed_at":"2026-08-15T19:23:24.461954Z","title":"Foot-in-the-door: A multi-turn jail- break for LLMs","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.461954Z"},"links":{"cited_paper":"/paper/2502.19820","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:470ca8cfe39208fb0aca73c35e37a20654150bd3565b528143d86a6ce3a8d714","observation_id":"d9806c4e-b8d1-4429-9e52-7a705964ac0e","resolution":{"observed_at":"2026-08-15T19:23:24.461954Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.16822","last_updated":"2024-12-11T18:07:25Z","snapshot_observed_at":"2026-08-13T04:09:48.076759Z","submitted_at":"2024-02-26T18:47:27Z","title":"Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.16822","snapshot_observed_at":"2026-08-15T19:23:24.466327Z","title":"Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker-Holder, Jakob Foerster, Tim Rocktäschel, and Roberta Raileanu","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.466327Z"},"links":{"cited_paper":"/paper/2402.16822","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:621446eebf3c06589baff56129f958b3b8d8cf38084f2453a559ccc15bd51cc7","observation_id":"d29c75d6-6fa8-4160-8d41-99c05a59beb6","resolution":{"observed_at":"2026-08-15T19:23:24.466327Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.15754","last_updated":"2025-03-20T00:13:04Z","snapshot_observed_at":"2026-08-14T12:48:52.975244Z","submitted_at":"2025-03-20T00:13:04Z","title":"AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integration","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.15754","snapshot_observed_at":"2026-08-15T19:23:24.471220Z","title":"AutoRedTeamer: Autonomous red teaming with lifelong attack inte- gration","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.471220Z"},"links":{"cited_paper":"/paper/2503.15754","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:b55bdd9acf7cdfacceb0122b61730a1161c580e605f420e005bb541162a28713","observation_id":"d9328680-fc74-4403-90e4-a2f4825009af","resolution":{"observed_at":"2026-08-15T19:23:24.471220Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.00348","last_updated":"2025-04-23T01:35:19Z","snapshot_observed_at":"2026-08-12T22:10:00.494157Z","submitted_at":"2024-11-01T04:05:59Z","title":"Attention Tracker: Detecting Prompt Injection Attacks in LLMs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.00348","snapshot_observed_at":"2026-08-15T19:23:24.475884Z","title":"Hsu, and Pin-Yu Chen","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.475884Z"},"links":{"cited_paper":"/paper/2411.00348","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:db6ca61449c80d0fe85c54363203c2befe5e8e64f439a5eb9202d2a354202d96","observation_id":"7d3c065b-9347-474a-8a72-e9211a621ee2","resolution":{"observed_at":"2026-08-15T19:23:24.475884Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.192761Z","title":"MELON: Provable defense against indirect prompt injection attacks in ai agents","venue":null,"work_id":"5b0523b0-9de4-4c5f-aa35-abeefed00b04","year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.542261Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:f32fcc19bc8ac8cbbb114f009bc05ce6d2627531d0827a5a5566b341ee1c9306","observation_id":"7fe0d7ea-de04-4fc9-a3b0-3ca6239c32fd","resolution":{"observed_at":"2026-08-15T19:23:26.198415Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2505.03574","last_updated":"2025-05-06T14:34:21Z","snapshot_observed_at":"2026-08-15T23:45:54.048231Z","submitted_at":"2025-05-06T14:34:21Z","title":"LlamaFirewall: An open source guardrail system for building secure AI agents","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.03574","snapshot_observed_at":"2026-08-15T19:23:24.603209Z","title":"LlamaFirewall: An open source guardrail system for building secure ai agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.603209Z"},"links":{"cited_paper":"/paper/2505.03574","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:d3d09e9531487ceb4e40b8d4f3e7c9156461395bbfcec32c8a51ff5b0d74591b","observation_id":"0c40dc41-5df5-4ade-918d-97f270bf2415","resolution":{"observed_at":"2026-08-15T19:23:24.603209Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2409.19091","last_updated":"2024-10-10T15:29:07Z","snapshot_observed_at":"2026-08-15T01:29:02.183615Z","submitted_at":"2024-09-27T18:41:58Z","title":"System-Level Defense against Indirect Prompt Injection Attacks: An Information Flow Control Perspective","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2409.19091","snapshot_observed_at":"2026-08-15T19:23:24.635486Z","title":"System-level defense against indirect prompt injec- tion attacks: An information flow control perspec- tive","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.635486Z"},"links":{"cited_paper":"/paper/2409.19091","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:b3d66befd02dc9891d63b238507810c7b8c07a31a6dc72c1b1d5a80d29d80aff","observation_id":"087971ee-205c-4594-9a1b-8f777b528b8f","resolution":{"observed_at":"2026-08-15T19:23:24.635486Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2503.18813","last_updated":"2025-06-24T08:05:33Z","snapshot_observed_at":"2026-08-13T15:19:02.871791Z","submitted_at":"2025-03-24T15:54:10Z","title":"Defeating Prompt Injections by Design","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2503.18813","snapshot_observed_at":"2026-08-15T19:23:24.640513Z","title":"Defeating prompt injections by design","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.640513Z"},"links":{"cited_paper":"/paper/2503.18813","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:454832a5df333917e6892407324d22da7ff9f02fb630b7902971230c312541ac","observation_id":"8dc96646-8955-497a-9419-d378b775c8fb","resolution":{"observed_at":"2026-08-15T19:23:24.640513Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.175146Z","title":"Poskitt, and Jun Sun","venue":null,"work_id":"20acfcd4-34c3-4272-bf9c-170d17e45c7d","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.646151Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:98ab163198d6124a8c3b8b42d2c6d7994d2f9d581ce760ef52493629b07a94fb","observation_id":"b86f02fe-c06f-4ef0-9bae-b8b4f25c9135","resolution":{"observed_at":"2026-08-15T19:23:26.181036Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:26.095376Z","title":"Firewalls to secure dynamic LLM agentic net- works.Transactions on Machine Learning Re- search, 2026","venue":null,"work_id":"ea7108cb-cd48-400a-8c7b-0f9877c8f196","year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.651782Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:3a7df931e7691616e4000df11278d4f17b450f7dcfbae73c5f18d4a195b08277","observation_id":"96d5e586-6c1f-407b-870b-c50c4ce17869","resolution":{"observed_at":"2026-08-15T19:23:26.161165Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2507.19457","last_updated":"2026-02-14T11:42:30Z","snapshot_observed_at":"2026-08-14T13:34:39.415942Z","submitted_at":"2025-07-25T17:42:32Z","title":"GEPA: Reflective Prompt Evolution Can Outperform Reinforcement Learning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2507.19457","snapshot_observed_at":"2026-08-15T19:23:24.657083Z","title":"Dimakis, Ion Stoica, Dan Klein, Matei Zaharia, and Omar Khattab","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.657083Z"},"links":{"cited_paper":"/paper/2507.19457","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:6a2bc6534526eb4bbe78868fc04b2a5e487b4d348999de697e3de22a9385c81f","observation_id":"55805c6b-39f5-4ce9-a281-cd22c1c61c3b","resolution":{"observed_at":"2026-08-15T19:23:24.657083Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2408.08435","last_updated":"2025-03-02T05:13:28Z","snapshot_observed_at":"2026-08-06T11:45:45.286982Z","submitted_at":"2024-08-15T21:59:23Z","title":"Automated Design of Agentic Systems","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2408.08435","snapshot_observed_at":"2026-08-15T19:23:24.663813Z","title":"Auto- mated design of agentic systems","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.663813Z"},"links":{"cited_paper":"/paper/2408.08435","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:392917cd793755a1a64dad04db2c42b28fe3b7f2a62197495d667c71b6c50868","observation_id":"f72103cf-2a16-486f-8ba3-45c191f327d5","resolution":{"observed_at":"2026-08-15T19:23:24.663813Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2505.22954","last_updated":"2026-03-12T23:47:40Z","snapshot_observed_at":"2026-08-13T19:47:12.152634Z","submitted_at":"2025-05-29T00:26:15Z","title":"Darwin Godel Machine: Open-Ended Evolution of Self-Improving Agents","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2505.22954","snapshot_observed_at":"2026-08-15T19:23:24.669078Z","title":"Darwin godel machine: Open-ended evolution of self-improving agents","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.669078Z"},"links":{"cited_paper":"/paper/2505.22954","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:66593bd32a6457e271c795bcbe8ba58ab8902a7a2466042a339be13688ee38e4","observation_id":"c78c964a-4af1-4fa5-9ddb-708aa2d9ade7","resolution":{"observed_at":"2026-08-15T19:23:24.669078Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.22166","last_updated":"2026-05-27T04:34:36Z","snapshot_observed_at":"2026-07-06T23:32:30.578213Z","submitted_at":"2026-05-21T08:36:49Z","title":"Adapting the Interface, Not the Model: Runtime Harness Adaptation for Deterministic LLM Agents","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.22166","snapshot_observed_at":"2026-08-15T19:23:24.742465Z","title":null,"venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.742465Z"},"links":{"cited_paper":"/paper/2605.22166","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:01a8bab1ea920c4d2041f086bb4f1bc965c4757c1e7664dae6f2831038871315","observation_id":"58825cca-05e2-42e7-93b9-fe4c973ab8f8","resolution":{"observed_at":"2026-08-15T19:23:24.742465Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2603.28052","last_updated":"2026-03-30T05:33:50Z","snapshot_observed_at":"2026-08-11T05:18:08.192130Z","submitted_at":"2026-03-30T05:33:50Z","title":"Meta-Harness: End-to-End Optimization of Model Harnesses","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2603.28052","snapshot_observed_at":"2026-08-15T19:23:24.799776Z","title":"Meta- harness: End-to-end optimization of model har- nesses","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.799776Z"},"links":{"cited_paper":"/paper/2603.28052","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:b49af92403ef78ed5b514db1777429d14a93727c94b947a14b1316c987de08ae","observation_id":"ca211a88-9649-43b9-ae83-e6ad7a7e2f25","resolution":{"observed_at":"2026-08-15T19:23:24.799776Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.16291","last_updated":"2023-10-19T16:27:03Z","snapshot_observed_at":"2026-08-13T16:55:46.498156Z","submitted_at":"2023-05-25T17:46:38Z","title":"Voyager: An Open-Ended Embodied Agent with Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.16291","snapshot_observed_at":"2026-08-15T19:23:24.818301Z","title":"V oyager: An open-ended em- bodied agent with large language models","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.818301Z"},"links":{"cited_paper":"/paper/2305.16291","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:e805fa2c022c7a6ac43702fc3a087bcea5e827f1e7bc43d4961f1589d93a081d","observation_id":"d8286467-81d4-4a9a-9fc3-74e5329b345a","resolution":{"observed_at":"2026-08-15T19:23:24.818301Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2605.23904","last_updated":"2026-05-25T17:58:16Z","snapshot_observed_at":"2026-08-05T06:54:08.846880Z","submitted_at":"2026-05-22T17:59:50Z","title":"SkillOpt: Executive Strategy for Self-Evolving Agent Skills","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2605.23904","snapshot_observed_at":"2026-08-15T19:23:24.823874Z","title":"Skillopt: Executive strategy for self-evolving agent skills","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.823874Z"},"links":{"cited_paper":"/paper/2605.23904","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:8f6fccc8e0eaae0375ecc88a00d9ca5fa9ea56e0ee386f49ba54d85e75c3a54e","observation_id":"5d259132-fe80-4853-a04c-eeea50ad899f","resolution":{"observed_at":"2026-08-15T19:23:24.823874Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2606.05743","last_updated":"2026-06-04T06:14:08Z","snapshot_observed_at":"2026-08-12T15:35:20.345190Z","submitted_at":"2026-06-04T06:14:08Z","title":"Membrane: A Self-Evolving Contrastive Safety Memory for LLM Agent Defense","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2606.05743","snapshot_observed_at":"2026-08-15T19:23:24.829197Z","title":"decisions","venue":null,"work_id":null,"year":2026},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:24.829197Z"},"links":{"cited_paper":"/paper/2606.05743","citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:bcc5dfc1c1ce2b72177dfd9092216001b4cff98d3a8fa2ce9728f1ed09a66b0a","observation_id":"fe23aa23-019a-466e-a666-4720aaf5f33a","resolution":{"observed_at":"2026-08-15T19:23:24.829197Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-15T19:23:27.175082Z","title":null,"venue":null,"work_id":"45f608bd-c046-4aa3-a6bc-276bf22bf3cb","year":null},"citing_paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents","version":1},"reference_index":2026,"source":"pdf_text","source_observed_at":"2026-08-15T19:23:23.614898Z"},"links":{"citing_paper":"/paper/2608.12977"},"observation_digest":"sha256:bf568cfbb3502f849983d517f58151648ca9678492a312d249abb283f580ca9e","observation_id":"bb1eaa3d-9d47-4ded-8a55-8a4e758fdbaf","resolution":{"observed_at":"2026-08-15T19:23:27.181684Z","resolver_source":"raw_fallback","status":"parse_uncertain"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-16T06:30:59.297886+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"state":"measured"}}],"paper":{"arxiv_id":"2608.12977","last_updated":"2026-08-13T08:57:04Z","latest_version":1,"primary_category":"cs.CR","snapshot_observed_at":"2026-08-16T07:14:12.536178Z","submitted_at":"2026-08-13T08:57:04Z","title":"Beyond Handcrafted Security: Towards Self-Evolving Defense for LLM Agents"},"reference_resolution":{"displayed":76,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":1,"unresolved":41,"verified_exact":0,"verified_fuzzy":34},"total_outbound_references":76},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-16T06:30:59.297886+00:00","source":"crossref"},{"observed_at":"2026-08-16T06:30:54.164669+00:00","source":"retraction_watch"}],"thesis":"As of 16 August 2026, this Paper Citation Record lists 76 of 76 outbound references and 0 inbound Pith citation observations for arXiv:2608.12977."}