mobile AI agent
An Android app that can overlay other windows and write to shared storage can feed instructions into the artificial intelligence agent running the phone through invisible text. Just two more steps later, and the application is now issuing orders to the PC running the agent.
The researchers found that chain, along with six more attacks, worked on all of the five open-source mobile agent systems: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. All of the seven attacks succeeded at attacking all five frameworks.
The findings were published in a paper on arXiv. The authors are from Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and the Xingtu Lab at Chinese security firm QAX.
The Host Command Injection Problem
AppAgent's controller uses subprocess.run(adb_command, shell=True) and builds text input by feeding model output directly into adb shell input text. The function has no sanitization.
The live code strips spaces and single quotes but leaves shell metacharacters untouched. Not ;, not &, not >. A string the model reads off a screen gets split by the host shell, and the second half runs on the operator's Windows machine.
A payload designed to launch calc.exe succeeded in 20 out of 20 trials against AppAgent, AppAgentX, Mobile-Agent-v3, and MobA. Another run used test;pwd>rce_success and wrote the host's working directory to a file.
The Screenshot Race Condition
Getting that string in front of the model requires a file race. Open-AutoGLM runs screencap -p /sdcard/tmp.png then a separate adb pull. Mobile-Agent-v3 writes to a fixed /sdcard/screenshot.png and sleeps half a second between writing and pulling. AppAgentX writes to timestamped filenames with an incrementing step counter. AppAgent's default screenshot directory is /sdcard.
The researchers timed the gap across the frameworks at 50 to 500ms, averaging around 210ms. A background service polling every 5 to 10ms can take a file lock, repaint the PNG, and release it before the agent retrieves it. Tampering succeeded in 19 to 20 out of 20 trials against four of the five frameworks.
To make the window wider, they showed the agent an invisible overlay claiming a network sync was running and asking it to wait three seconds. The model complied.
Invisible Text That Models Read
All six vision models the researchers tested read text at 2% opacity in at least 18 of 20 lab trials. GPT-4o, Claude Opus 4.5, Gemini 3 Pro, and GLM-4V scored 20 out of 20. AutoGLM-Phone, a 9B model running on the device itself, was the weakest at 18 of 20.
The numbers do not climb as the text gets more visible because they start at the ceiling. Human vision cannot see it. The screenshot does not care.
Corner and Cutout Injection
Phones round their corners and cut holes for cameras. The frame buffer stays rectangular, so pixels rendered into those regions sit under the bezel and land in every screenshot. On a Pixel 4, that leaves about 78 pixels of hidden width at one corner enough for a short command. All five agents read payloads out of it.
Accessibility Service Sniffing
An accessibility service drops a fake login Activity over the real app and lets the agent type the user's credentials into it. None of the five agents hesitated across 100 trials.
ADB Keyboard Abuse
Open-AutoGLM base64-encodes the text it types and fires it at ADB_INPUT_B64, an implicit broadcast picked up by ADB Keyboard. Mobile-Agent-v3 keeps a narrow allow-list for ASCII and sends everything else over ADB_INPUT_TEXT.
MobA tests the whole string with text.isascii(), so one emoji or accented letter sends the entire message over the broadcast in a single shot.
Any app registering the same action receives the same payload. It needs no permission. Where an attacker has accessibility instead, TYPE_VIEW_TEXT_CHANGED hands over the same text in plaintext, password fields included.
What Works
Two of the five projects get some things right. MobA streams screenshots over exec-out and never has a device-side file to race. Open-AutoGLM passes arguments as lists instead of concatenating strings and is the only one immune to host command injection.
What to Do
Project maintainers need to take several steps:
- Drop shell=True. Pass argv lists instead.
- Stream screenshots instead of write-then-pull.
- Put a signature-level permission on the input broadcast.
- Diff the foreground activity before and after each action.
- Run contrast enhancement over screenshots before the model sees them.
The Bottom Line
Mobile AI agent command injection attacks reveal a clear gap between research-grade frameworks and security-hardened software. The attacks work. The projects have no security policies. No CVE numbers exist.
The setup guide for these frameworks walks users through enabling USB debugging and sideloading the keyboard. That is the rest of the threat model. Everything after that depends on what the agent sees.
FAQ Section
What are mobile AI agent frameworks?
Mobile AI agent frameworks are open-source tools that let AI models control Android devices. They read screenshots, type text, and execute commands.
How does the hidden text attack work?
The attacker draws text with 2% opacity over the screen. The vision model reads it, but the human user cannot see it. The agent follows the hidden instructions.
What is the screenshot race condition attack?
The agent first stores the screenshot in a specific place and retrieves it later. A malicious application can use the window of opportunity to replace the file with an altered one.
How does host command injection work?
The agent builds shell commands by concatenating model output. Shell metacharacters are not escaped, allowing arbitrary command execution on the host PC.
Which frameworks were tested?
AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA were tested. All fell to at least six of seven attacks.
Is there a fix?
No patches have been released. The maintainers have not responded to the researchers' disclosures.
