Executive Summary
Researchers showed an Android app that can draw over windows and write to shared storage can feed invisible text to an AI agent driving the phone and escalate to running commands on the host PC, among seven attacks on five open-source mobile agent frameworks.
What Happened
An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six other attacks, against five open-source mobile agent frameworks: AppAgent, AppAgentX,
Affected Products
- AppAgent
- AppAgentX
Vulnerability / Attack Technique
Invisible on-screen prompt injection escalating to host command execution
Technical Mechanism
Hidden text drawn on screen is read by the agent's vision model and treated as instructions, which can reach commands on the controlling PC.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Anything on screen is input to a GUI agent. RealGround analysis: mobile and desktop GUI agents need the same untrusted-input controls as text agents.
Recommended Controls
- Do not run GUI agents on devices with untrusted apps
- Limit what the agent's host PC exposes to it
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/open-source-android-ai-agents-could-let.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.