Invisible Android Pixels Can Push Mobile Agents Toward Host-Side Code Execution
A security study of five open-source Android automation agents found that every framework was vulnerable to at least six of seven tested attacks. The paths begin with a hostile app on the phone—not a compromised model service—and exploit what the agent sees, how screenshots and text cross the Android Debug Bridge, and how model-generated strings become host commands.
The researchers tested AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA on unrooted Android 14 and 15 phones with a Windows 11 controller. The revised paper, published July 14 as arXiv:2607.00333v2, separates the findings into two classes: attacks on screen perception and attacks on repurposed communication channels. It does not establish that first-party phone assistants, iOS agents, or commercial products share the same implementation defects.
The strongest result is compositional. Against AppAgent, the team chained a nearly transparent visual instruction, a race against a screenshot file on shared storage, and unsafe shell command construction. A low-privilege Android app thereby caused a command to execute on the PC orchestrating the agent.
The screenshot was never a trusted sensor
These agents interpret screenshots as authoritative device state, but a screenshot contains pixels that the operator may not perceive. The researchers placed text in overlays at 2% to 20% opacity and tested six vision-language models. Across the reported matrix, extraction succeeded in 18 of 20 to 20 of 20 trials at every opacity, including the lowest setting.
A second technique wrote instructions into framebuffer regions hidden by rounded display corners or camera cutouts. All five agents extracted the test instruction from these physically occluded areas. The gap is architectural: the model receives the rectangular image while the user sees only the display’s visible geometry.
The experiment also used an overlay to imitate a WeChat login interface. In the authors’ 20 trials per framework, every tested agent attempted to enter credentials into the spoofed screen. An agent that reasons only from pixels has no platform-authenticated signal telling it which application owns a security-sensitive surface.
This extends the problem documented in agent data injection: untrusted content does not have to look like an explicit command to a human. Here, even human visual review can fail because the agent’s input and the physical display are materially different views.
Temporary screenshot files created a device-side race
Four frameworks wrote screenshots to predictable paths on shared Android storage before pulling them to the host. Source instrumentation found a 50–500 millisecond interval between screenshot creation and retrieval, averaging about 210 milliseconds across the evaluated pipelines. A malicious background service polled those paths, acquired a file lock, modified the image, and released it before the agent consumed the result.
The tampering attack succeeded in 19 of 20 AppAgent trials and 20 of 20 trials for AppAgentX, Mobile-Agent-v3, and Open-AutoGLM. MobA avoided this specific path because it streamed screenshot bytes directly to the host with exec-out rather than materializing a device-side file.
The lesson resembles click-swap attacks against computer-use agents, but the mutable object is earlier in the perception pipeline. Signing an action after model reasoning would not detect that the screenshot used to produce the action had already been replaced.
ADB convenience crossed the device boundary
The study found additional exposure in text-entry channels. Open-AutoGLM used an unprotected broadcast accepted by AdbKeyboard; Mobile-Agent-v3 and MobA used broadcast fallbacks for characters their direct ADB path could not handle. A co-installed app could register for those broadcasts and passively receive text, including multilingual input. Under the paper’s Unicode-bearing tasks, interception succeeded in all 20 trials for each exposed framework.
The host-impact path came from constructing ADB commands by concatenating model-derived text into strings executed with shell=True. Shell metacharacters were consequently interpreted by the Windows host rather than delivered literally to the phone. A calculator-launching test succeeded in 20 of 20 trials against AppAgent, AppAgentX, Mobile-Agent-v3, and MobA. Open-AutoGLM’s Base64 encoding neutralized that specific command-injection primitive.
In the end-to-end AppAgent demonstration, imperceptible overlay text first persuaded the agent to wait, enlarging the screenshot race window. The malicious app then replaced the captured image with one directing the agent to type a string containing a command separator. Unsafe host-side construction converted that string into shell execution. The model was the bridge between two ordinary mechanisms; the decisive failures were mutable input and an interpreter boundary without argument separation.
What defenders should change
- Remove the intermediate screenshot file. Stream capture output directly to isolated host memory. If a file is unavoidable, keep it in app-private storage, use unpredictable names and exclusive creation, and verify ownership and integrity before processing.
- Never build ADB commands as shell strings. Invoke subprocesses with structured argument arrays and shell expansion disabled. Treat every model-produced action parameter as untrusted data.
- Replace unauthenticated input broadcasts. Use explicit, permission-protected, identity-bound channels. Do not transmit credentials through system-wide broadcasts or accessibility paths observable by unrelated apps.
- Bind perception to display geometry and app identity. Crop physically invisible regions, reject unexpected overlays, and obtain package, activity, and trusted-UI provenance outside the model. Pixel-level classification alone cannot authenticate a login surface.
- Require independent confirmation for secrets and consequential actions. The confirmation channel must show the verified destination application and normalized action, not merely replay the same potentially manipulated screenshot.
- Minimize the controller’s authority. Run the orchestration process in a sandbox without developer credentials, broad filesystem access, or unrestricted egress. A phone-automation task should not inherit a general-purpose workstation shell.
- Test the whole perception-to-action chain. Red-team overlays, rounded-corner content, screenshot replacement, broadcast listeners, Unicode fallback behavior, and shell metacharacters together. Fixing one primitive does not remove composed paths.
Disclosure remains incomplete
The authors say they contacted relevant vendors and project channels before publication and followed a 90-day window where feasible. They also note that the open-source projects lacked consistent confidential-reporting routes and that some issues may remain unpatched. The public artifact is intentionally sanitized: it includes benign demonstrations and evaluation material, not weaponized credential theft or host-RCE payloads.
That status argues against deploying research-oriented, ADB-driven agents on a workstation with valuable authority. The findings are not proof that every mobile agent is exploitable, but they do show that Android app isolation does not protect the host when the agent treats mutable pixels as instructions and forwards their consequences through a shell.
Sources: