Recent research has uncovered significant vulnerabilities in several open-source Android AI agent frameworks, including AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. These flaws allow malicious applications to execute commands on host PCs by embedding invisible text within the device’s screen.
The attack sequence involves an Android app with permissions to overlay other windows and access shared storage. This app can display text invisible to the human eye, which the AI agent processes. The agent then interprets this hidden text as commands, potentially leading to unauthorized code execution on the connected host PC.
Researchers from Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and the Xingtu Lab at QAX demonstrated this vulnerability across the mentioned frameworks. Their findings, published on arXiv on July 1 and revised on July 14, indicate that all tested frameworks were susceptible to at least six out of seven attack scenarios.
One critical issue lies in how these frameworks handle text input. For instance, AppAgent’s controller utilizes the function subprocess.run(adb_command, shell=True) and constructs text input by directly inserting model output into adb shell input text {input_str}. This process lacks adequate sanitization, allowing malicious strings to be executed on the host system.
In practical tests, payloads designed to launch applications like calc.exe were successfully executed in 20 out of 20 trials against AppAgent, AppAgentX, Mobile-Agent-v3, and MobA. Additionally, an end-to-end test against AppAgent used the command test;pwd>rce_success, resulting in the host’s working directory being written to a file.
The attack exploits a timing gap between the AI agent capturing a screenshot and retrieving it. This interval, measured between 50 to 500 milliseconds (averaging around 210ms over 100 runs), provides a window for a background service to intercept and modify the screenshot file before the agent processes it. By polling every 5 to 10 milliseconds, the malicious service can lock the file, alter its content, and release it before the agent accesses it. This tampering was successful in 19 to 20 out of 20 trials against four of the five frameworks.
To further extend this window, attackers can display an invisible overlay indicating a network synchronization process, prompting the agent to wait longer. This tactic increases the likelihood of successful exploitation.
Tests with six vision models, including GPT-4o, Claude Opus 4.5, Gemini 3 Pro, and GLM-4V, revealed that all could read text with 2% opacity in at least 18 out of 20 trials. This level of opacity is typically undetectable by the human eye under normal viewing conditions. AutoGLM-Phone, a 9B model running on the device itself, was the least effective, yet still successful in 18 out of 20 trials.
These findings underscore the need for enhanced security measures in AI agent frameworks, particularly regarding input sanitization and the handling of visual data. Developers must implement robust checks to prevent the execution of unauthorized commands and ensure that AI agents do not process hidden or manipulated inputs.
As AI agents become more integrated into mobile and desktop environments, their security is paramount. This research highlights the importance of proactive vulnerability assessments and the implementation of safeguards to protect against sophisticated exploitation techniques. Users and developers should remain vigilant, regularly update their systems, and apply recommended security patches to mitigate potential risks.
