Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six other attacks, against five open-source mobile agent frameworks: AppAgent, AppAgentX,

The article describes research showing that open-source Android AI agent frameworks can be exploited by a malicious app that overlays invisible text on the screen and writes to shared storage, causing the agent to read hidden instructions and ultimately execute commands on the connected host PC.[1][2][3] These are demonstrated, practical exploit chains against multiple mobile agents (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, MobA), with all tested agents failing most of the attack scenarios and some enabling reliable arbitrary code execution on the host.[1][3] From a RealGround perspective, this is a textbook indirect prompt injection and tool-abuse problem: untrusted UI and storage content is treated as safe "observations," then passed unvalidated into high-privilege actions (ADB shell, host command runners), with no action-level authorization or system-call–level scrutiny.[1][2][9] Organizations using mobile or cross-device AI agents should implement secure agent design (no shell=True, strict tool whitelists, screenshot sanitization, confirmation for sensitive actions) and subject these agents to ongoing red teaming and business-logic audits focused on invisible U