# Prompt/Result Citation Bundles

Each bundle links one sanitized prompt/result example to source, incident, pattern, safety review, Agentic RAG answer, walkthrough, audit scenario, and eval case records.

## Counts

- Bundles: `200`
- Incomplete bundles: `0`

## Example Bundles

| Example | Incident | Agentic RAG answers | Audit scenario | Eval case | Sufficient Context |
|---|---|---|---|---|---|
| `ex-github-issue-title-ci-agent` | `clinejection-github-issue-title` | `ci-coding-agent-issue-metadata` | `audit-github-issue-title-ci-agent` | `eval-github-issue-title-ci-agent` | sufficient |
| `ex-adaptive-idpi-defense-breaks` | `research-adaptive-attacks-break-defenses-against-indirect-prompt-injection-attacks` | `adaptive-realworld-blackbox-multiagent-redteam` | `audit-adaptive-idpi-defense-breaks` | `eval-adaptive-idpi-defense-breaks` | sufficient |
| `ex-agent-backdoor-threats` | `research-watch-out-for-your-agents-investigating-backdoor-threats-to-llm-based-agen` | `web-memory-redteam-delayed-context` | `audit-agent-backdoor-threats` | `eval-agent-backdoor-threats` | sufficient |
| `ex-agent-command-bypass-record` | `nvd-cve-2026-29783-command-bypass` | `mcp-command-stored-prompt-boundaries` | `audit-agent-command-bypass-record` | `eval-agent-command-bypass-record` | sufficient |
| `ex-agent-evaluation-survey-provenance` | `research-survey-on-evaluation-of-llm-based-agents` | `agent-security-survey-taxonomy-evidence` | `audit-agent-evaluation-survey-provenance` | `eval-agent-evaluation-survey-provenance` | sufficient |
| `ex-agent-infrastructure-control-plane` | `research-infrastructure-for-ai-agents` | `agent-infrastructure-identity-policy` | `audit-agent-infrastructure-control-plane` | `eval-agent-infrastructure-control-plane` | sufficient |
| `ex-agent-interoperability-protocol-metadata` | `research-a-survey-of-agent-interoperability-protocols-model-context-protocol-mcp-ag` | `protocol-tool-threat-model-boundaries` | `audit-agent-interoperability-protocol-metadata` | `eval-agent-interoperability-protocol-metadata` | sufficient |
| `ex-agent-network-protocol-identity` | `research-agent-network-protocol-identity-and-encrypted-communication-layer` | `agent-infrastructure-identity-policy` | `audit-agent-network-protocol-identity` | `eval-agent-network-protocol-identity` | sufficient |
| `ex-agent-security-bench-formalized-attacks` | `research-agent-security-bench-asb-formalizing-and-benchmarking-attacks-and-defenses` | `web-redteam-multiagent-guardrail-benchmarks` | `audit-agent-security-bench-formalized-attacks` | `eval-agent-security-bench-formalized-attacks` | sufficient |
| `ex-agent-visibility-measures` | `research-visibility-into-ai-agents-measures-to-improve-agent-visibility` | `agent-infrastructure-identity-policy` | `audit-agent-visibility-measures` | `eval-agent-visibility-measures` | sufficient |
| `ex-agentarmor-runtime-trace` | `research-agentarmor-enforcing-program-analysis-on-agent-runtime-trace-to-defend-aga` | `monitoring-runtime-declarative-defenses` | `audit-agentarmor-runtime-trace` | `eval-agentarmor-runtime-trace` | sufficient |
| `ex-agentauditor-human-level-eval` | `research-agentauditor-human-level-safety-and-security-evaluation-for-llm-agents` | `privacy-multiagent-audit-observability` | `audit-agentauditor-human-level-eval` | `eval-agentauditor-human-level-eval` | sufficient |
| `ex-agentbench-general-agent-eval` | `research-agentbench-evaluating-llms-as-agents` | `agent-benchmark-tool-email-boundaries` | `audit-agentbench-general-agent-eval` | `eval-agentbench-general-agent-eval` | sufficient |
| `ex-agentdojo-dynamic-attack-defense` | `research-agentdojo-a-dynamic-environment-to-evaluate-attacks-and-defenses-for-llm-a` | `agent-security-benchmark-eval-corpora` | `audit-agentdojo-dynamic-attack-defense` | `eval-agentdojo-dynamic-attack-defense` | sufficient |
| `ex-agentflayer-chatgpt-drive-connector` | `agentflayer-chatgpt-connectors-google-drive` | `copilot-chatgpt-connector-persistence` | `audit-agentflayer-chatgpt-drive-connector` | `eval-agentflayer-chatgpt-drive-connector` | sufficient |
| `ex-agentflayer-copilot-studio-platform` | `agentflayer-copilot-studio-platform` | `enterprise-agent-service-tool-boundaries` | `audit-agentflayer-copilot-studio-platform` | `eval-agentflayer-copilot-studio-platform` | sufficient |
| `ex-agentflayer-cursor-enterprise-agent` | `agentflayer-cursor-enterprise-agent` | `cursor-comet-browser-agent-audit-boundaries` | `audit-agentflayer-cursor-enterprise-agent` | `eval-agentflayer-cursor-enterprise-agent` | sufficient |
| `ex-agentforce-crm-indirect-prompt` | `forcedleak-agentforce-indirect-prompt` | `crm-calendar-record-content` | `audit-agentforce-crm-indirect-prompt` | `eval-agentforce-crm-indirect-prompt` | sufficient |
| `ex-agentic-ai-taxonomy-instruction-boundary` | `research-ai-agents-vs-agentic-ai-a-conceptual-taxonomy-applications-and-challenge` | `agent-security-survey-taxonomy-evidence` | `audit-agentic-ai-taxonomy-instruction-boundary` | `eval-agentic-ai-taxonomy-instruction-boundary` | sufficient |
| `ex-agentic-ai-threat-model-framework` | `research-securing-agentic-ai-a-comprehensive-threat-model-and-mitigation-framework` | `protocol-tool-threat-model-boundaries` | `audit-agentic-ai-threat-model-framework` | `eval-agentic-ai-threat-model-framework` | sufficient |
| `ex-agentic-browser-audit-cluster` | `agentic-browser-prompt-injection-audit-cluster` | `web-agent-benchmark-browser-boundaries` | `audit-agentic-browser-audit-cluster` | `eval-agentic-browser-audit-cluster` | sufficient |
| `ex-agentic-systems-theory-boundary` | `research-agentic-ai-needs-a-systems-theory-ibm-research` | `systems-sandbox-computer-use-threat-models` | `audit-agentic-systems-theory-boundary` | `eval-agentic-systems-theory-boundary` | sufficient |
| `ex-agentpoison-memory-knowledge-base` | `research-agentpoison-red-teaming-llm-agents-via-poisoning-memory-or-knowledge-bases` | `web-memory-redteam-delayed-context` | `audit-agentpoison-memory-knowledge-base` | `eval-agentpoison-memory-knowledge-base` | sufficient |
| `ex-agentspec-runtime-enforcement` | `research-agentspec-customizable-runtime-enforcement-for-safe-and-reliable-llm-agent` | `privilege-memory-rag-runtime-controls` | `audit-agentspec-runtime-enforcement` | `eval-agentspec-runtime-enforcement` | sufficient |
| `ex-agentvigil-black-box-redteam` | `research-agentvigil-generic-black-box-red-teaming-for-indirect-prompt-injection-aga` | `adaptive-realworld-blackbox-multiagent-redteam` | `audit-agentvigil-black-box-redteam` | `eval-agentvigil-black-box-redteam` | sufficient |
| `ex-agrail-lifelong-guardrail` | `research-agrail-a-lifelong-agent-guardrail-with-effective-and-adaptive-safety-detec` | `formal-mobile-adaptive-guardrails` | `audit-agrail-lifelong-guardrail` | `eval-agrail-lifelong-guardrail` | sufficient |
| `ex-ai-agents-under-threat-risk-map` | `research-ai-agents-under-threat-a-survey-of-key-security-challenges-and-future-path` | `agent-security-survey-taxonomy-evidence` | `audit-ai-agents-under-threat-risk-map` | `eval-ai-agents-under-threat-risk-map` | sufficient |
| `ex-aios-agent-os-policy-boundary` | `research-aios-llm-agent-operating-system` | `agent-benchmark-tool-email-boundaries` | `audit-aios-agent-os-policy-boundary` | `eval-aios-agent-os-policy-boundary` | sufficient |
| `ex-airgapagent-privacy-boundary` | `research-airgapagent-protecting-privacy-conscious-conversational-agents` | `privacy-multiagent-audit-observability` | `audit-airgapagent-privacy-boundary` | `eval-airgapagent-privacy-boundary` | sufficient |
| `ex-amp-agent-credential-boundary` | `amp-agent-api-key-exfiltration` | `privilege-memory-rag-runtime-controls` | `audit-amp-agent-credential-boundary` | `eval-amp-agent-credential-boundary` | sufficient |
| `ex-androidworld-mobile-app-context` | `research-androidworld-a-dynamic-benchmarking-environment-for-autonomous-agents` | `computer-use-mobile-os-boundaries` | `audit-androidworld-mobile-app-context` | `eval-androidworld-mobile-app-context` | sufficient |
| `ex-anthropic-namespace-skill-provenance` | `anthropic-namespace-skills` | `agent-skill-provenance-runtime-review` | `audit-anthropic-namespace-skill-provenance` | `eval-anthropic-namespace-skill-provenance` | sufficient |
| `ex-antigravity-browser-subagent` | `google-antigravity-browser-subagent-exfiltration` | `mobile-url-ide-subagent-context` | `audit-antigravity-browser-subagent` | `eval-antigravity-browser-subagent` | sufficient |
| `ex-automatic-universal-prompt-injection` | `research-automatic-and-universal-prompt-injection-attacks-against-large-language-mo` | `detector-automatic-goal-guided-prompt-risks` | `audit-automatic-universal-prompt-injection` | `eval-automatic-universal-prompt-injection` | sufficient |
| `ex-autonomous-agent-review-context` | `research-from-llm-reasoning-to-autonomous-ai-agents-a-comprehensive-review` | `agent-security-survey-taxonomy-evidence` | `audit-autonomous-agent-review-context` | `eval-autonomous-agent-review-context` | sufficient |
| `ex-brave-local-agent-tab-context` | `brave-local-agent-idpi` | `web-multimodal-idpi-prevalence` | `audit-brave-local-agent-tab-context` | `eval-brave-local-agent-tab-context` | sufficient |
| `ex-browser-phishing-delegation` | `comet-browser-phishing-payload-injection` | `agentic-browser-phishing-summary-content` | `audit-browser-phishing-delegation` | `eval-browser-phishing-delegation` | sufficient |
| `ex-byzantine-embodied-agent-poisoning` | `research-navigation-as-attackers-wish-towards-the-building-byzantine-robust-embodie` | `systems-sandbox-computer-use-threat-models` | `audit-byzantine-embodied-agent-poisoning` | `eval-byzantine-embodied-agent-poisoning` | sufficient |
| `ex-calendar-invite-workspace-agent` | `gemini-calendar-invite-authorization-bypass` | `crm-calendar-record-content` | `audit-calendar-invite-workspace-agent` | `eval-calendar-invite-workspace-agent` | sufficient |
| `ex-camel-design-instruction-quarantine` | `research-defeating-prompt-injections-by-design-camel` | `design-ifc-prompt-flow-defenses` | `audit-camel-design-instruction-quarantine` | `eval-camel-design-instruction-quarantine` | sufficient |

## Runtime API

- Collection: `/api/prompt-result-citation-bundles`
- Single bundle: `/api/prompt-result-citation-bundles/{example_id}`