Study Finds Seven Attack Paths in Open-Source Mobile AI Agents

The study evaluated AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM and MobA. It grouped the attacks into two broad surfaces: what an agent perceives from the screen, and the channels it uses to move screenshots or text between an Android device and a controller.

The screen attacks included low-opacity text that vision-language models could read even when people would struggle to see it, prompts rendered in display areas hidden by rounded corners or camera cutouts, fake login interfaces and races that replace a screenshot before the controller retrieves it. The channel attacks targeted broadcast-based text input, accessibility events and shell commands assembled from model output.

Across the study and the independent code review reported by The Hacker News, all five frameworks were affected by multiple techniques. Four frameworks executed a Windows calculator payload in 20 of 20 host-command-injection trials; Open-AutoGLM avoided that specific path because it passed command arguments as a list instead of constructing a shell string. The tests were controlled demonstrations. The researchers said they had no evidence of exploitation outside the lab, and the findings were not assigned CVEs.

These agents often rely on Android Debug Bridge workflows designed for development and testing. A malicious app can influence what the model sees, while the model's response can flow into screenshot files, broadcasts or host-side commands. That chain crosses several trust boundaries: app to screen, screen to model, model to controller and controller to the host computer.

The practical issue is therefore broader than prompt injection. A model can be tricked at the perception layer, but ordinary software decisions—shared storage, implicit broadcasts and shell interpolation—determine whether the mistake becomes data exposure or code execution.

Teams using third-party mobile agents should isolate test devices and controllers, avoid carrying production credentials through accessibility or broadcast-based input paths, and treat model-generated actions as untrusted input. The paper and independent review point to concrete controls: pass command arguments without a shell, stream screenshots instead of writing them to shared device paths, authenticate input channels, monitor foreground-application changes and constrain each task to an explicit package allowlist.

Those controls do not eliminate every perception attack, but they reduce the chance that a misleading screenshot can cross into a higher-privilege execution channel. The central lesson for agent builders is architectural: screenshots and model outputs are inputs, not security boundaries.