The Hacker News16%
Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs 14%
By Swati Khandelwal10%
7/21/2026, 11:58:00 AM
BS Summary: This article contains 32 faulty reasoning types, including Appeal to Authority, Availability Heuristic, and Hasty Generalization, with Negativity Bias as the most egregious example at 25.7% saturation with 388 hits. Analysis detected 2,159 faulty-reasoning hits from 1,509 analyzed words, generating a BS Score of 30.8% and a BS Rank of 14% (16,632 of 19,194 articles). This article is better (less manipulative) than 86.70% of the article peer group.
An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see.
Two more steps, and the same app is running commands on the PC driving the agent.
Researchers demonstrated that chain, plus six other attacks, against five open-source mobile agent frameworks: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA.
Everyone fell to at least six of the seven.
The paper went up on arXiv on July 1 and was revised on July 14.
The authors are at Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and the Xingtu Lab at Chinese security firm QAX.
Nothing here has a CVE, and first author Zidong Zhang told The Hacker News the team has no evidence of the techniques being used outside a controlled setting.
The Hacker News checked all five frameworks and found the screenshot paths, the shell call, and the broadcast fallback that the paper describes still sitting on their main branches as of July 17.
Zhang said the team emailed the affected maintainers privately before posting the preprint and has "not received a response to date."
The escalation is the least exotic part.
AppAgent's controller runs subprocess.run(adb_command, shell=True) and builds text input by dropping model output straight into adb shell input text {input_str}.
The paper's listing shows that the function has no sanitization at all.
The live code does marginally better and nowhere near enough: it strips spaces and single quotes before interpolating, and leaves the rest of the shell metacharacters alone.
Not ;, not &, not >.
So a string the model reads off a screen and dutifully types gets split by the host shell, and the back half runs on the operator's Windows box.
A payload designed to launch calc.exe did exactly that in 20 of 20 trials against AppAgent, AppAgentX, Mobile-Agent-v3, and MobA.
A separate end-to-end run against AppAgent used test;pwd>rce_success and wrote the host's working directory to a file.
Open-AutoGLM runs screencap -p /sdcard/tmp.png then a separate adb pull.
Mobile-Agent-v3 writes to a fixed /sdcard/screenshot.png and sleeps half a second between the two.
AppAgentX writes to /sdcard/ under timestamped filenames carrying an incrementing step counter, a pattern an attacker can watch.
AppAgent's shipped config.yaml still defaults its screenshot directory to /sdcard.
The researchers timed that gap across the frameworks at 50 to 500ms, averaging around 210ms over 100 runs.
A background service polling every 5 to 10ms has room to take a file lock, repaint the PNG, and let go before the agent collects it.
Tampering landed 19/20 to 20/20 against four of the five.
To widen the window further, they showed the agent an invisible overlay claiming a network sync was running and asking it to wait three seconds.
The model believed it.
All six vision models the researchers tested read 2%-opacity text in at least 18 of 20 lab trials.
The paper puts that level below typical human detection under normal viewing.
GPT-4o, Claude Opus 4.5, Gemini 3 Pro, and GLM-4V scored 20 out of 20.
The numbers do not climb as the text gets more visible, because they start at the ceiling.
AutoGLM-Phone, a 9B model running on the device itself, was the weakest of the six at 18 of 20.
Human vision applies a threshold.
The screenshot does not.
The asymmetry has a hardware version too.
Phones round their corners and cut holes for cameras, but the frame buffer stays rectangular, so pixels rendered into those regions sit under the bezel and land in every screenshot.
On a Pixel 4 that leaves about 78 pixels of hidden width at one corner, enough for a short command, and all five agents read payloads out of it.
A third trick skips stealth entirely: an accessibility service drops a fake login Activity over the real app and lets the agent type the user's credentials into it.
A person might hesitate at an unexpected password prompt.
None of the five did, across 100 trials.
Nobody authenticated the keyboard
Agents have no sanctioned channel to a phone, so they repurpose the debug ones, and the cheapest attack in the set falls out of that.
Open-AutoGLM base64-encodes the text it types and fires it at ADB_INPUT_B64, an implicit broadcast picked up by ADB Keyboard, a test automation tool built to accept text from anything that broadcasts it.
That is its documented purpose, and it is still maintained, with an April pre-release carrying an Android 16 fix.
ADB Keyboard does what its README promises.
The agents are what turned a test harness into production input plumbing.
Mobile-Agent-v3 keeps a narrow allow-list: letters, digits, and common punctuation go via adb shell input text, and everything else, meaning any non-ASCII character, goes out one character at a time over ADB_INPUT_TEXT.
MobA is blunter.
Its type_text tests the whole string with text.isascii(), so one emoji or accented letter anywhere in a message sends the entire message over the broadcast in a single shot.
Any app registering the same action receives the same payload, and it needs no permission to do it, so nothing warns the user.
Where an attacker has accessibility instead, TYPE_VIEW_TEXT_CHANGED hands over the same text in plaintext, password fields included, against all five.
The preconditions are real ones.
This wants an app already installed, an agent actually mid-task, and USB or wireless debugging enabled.
The affected software is open-source developer tooling, not the assistant baked into a stock handset.
First-party agents, including Samsung's Bixby and Xiaomi's XiaoAi were out of scope, and so was iOS.
Zhang volunteered one caveat: several of the attacks need minimal Android permissions, and one needs none at all, which he said lowers the barrier for a motivated attacker.
One variant needs no malicious app either.
Because a payload can ride in an image's chrominance channels instead of its brightness, an attacker who never touches the device could bury one in a picture and let the victim's own agent screenshot it out of a messaging app.
The researchers call that an extension rather than a measured result.
It is also the only version with no installation step.
Fixes, and one that does not exist
Two of the five already show what right looks like.
MobA streams screenshots over exec-out and never has a device-side file to race.
Open-AutoGLM passes arguments as lists instead of concatenating strings, and is the only one of the five immune to host command injection.
Neither project gets both right.
None of the fixes below requires touching the model:
* Drop shell=True.
Pass argv lists, so metacharacters stay literal.
* Stream screenshots instead of write-then-pull.
No device-side file, no TOCTOU window.
* Put a signature-level permission on the input broadcast, or use explicit intents.
* Diff the foreground activity before and after each action, and keep a per-task package allowlist.
* Run contrast enhancement over screenshots before the model sees them.
Partial, not a fix.
The obvious defense is a confirmation prompt on sensitive actions, and Open-AutoGLM ships one.
It fires when the model decides an action is sensitive.
The perception attacks rewrite that judgment, which is why the paper rates the prompt insufficient against subliminal injection, UI spoofing, and screenshot tampering.
Against the broadcast and the accessibility sniffing, it does nothing at all, because there is no action to confirm.
The text is already gone.
On the corner and cutout injection, the researchers are blunt: "there is no straightforward and effective software-based solution."
Masking corners is a workaround for a hardware fact.
Nowhere to report it
The silence has a structure behind it.
Zhang said the team went to a private email because the projects have no dedicated channel for reporting vulnerabilities, and The Hacker News found no security policy published by any of the five repositories.
The paper adds that Tencent and Alibaba were approached first, and that research-grade open-source projects sit outside the usual Security Response Center scope.
Set that against Microsoft's May writeup on Semantic Kernel, its agent framework, where the same pattern of model output reaching a shell produced CVE-2026-25592, CVE-2026-26030, and a patched release.
Microsoft's one-line version transfers here without edits: "your LLM is not a security boundary."
The overlay half is not new ground.
Wu et al. drove prompt injection through overlay windows against AppAgent and Mobile-Agent in May 2025, and Ding et al. followed in October with prompts that surface only while an agent is looking.
This paper's related-work section cites neither and skips the mobile-agent security literature entirely.
What it adds is the far end of the chain: off the screen, through the file, onto the host.
Which leaves the awkward part.
Open-AutoGLM carries more than 25,000 GitHub stars, and its README walks you through enabling USB debugging, sideloading the keyboard, and handing it your input.
Follow the docs exactly and you have built every precondition the measured attacks need except the malicious app itself.
The setup guide is the rest of the threat model.
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.