(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents
AAIF 摘要
论文研究第三方 Android 移动 Agent 的新攻击面：VLM 通过截图感知设备状态，再经由 ADB、广播、输入法或 shell 通道执行动作。作者把风险拆成屏幕感知攻击和误用通道攻击，指向截图 TOCTOU、不可见像素、shell 拼接和明文输入泄漏等具体工程边界。
English abstract
Third-party mobile agents powered by Vision-Language Models (VLMs) have emerged as a promising paradigm for automating smartphone interactions. These agents act as high-privilege decision-makers, perceiving device states through screenshots and executing actions via VLM reasoning, transforming how an agent app interacts with the environment (i.e., other apps or the OS). Correspondingly, this transformation introduces new attack surfaces or transforms benign/harmless interfaces into exploitable ones for mobile devices. In this paper, we summarize key differences between third-party mobile agent apps and general apps when interacting with the environment, analyze the security posture of agents, and identify two unique attack surfaces compared to general mobile apps: the Screen Perception Attack Surface, which exploits the gap between human and machine vision, and the Misused Channel Attack Surface, which intercepts or manipulates the agent's execution pipeline. We design and implement seven concrete attacks, from subliminal text injection and invisible pixel zone exploitation to screenshot tampering and host PC command injection. Our evaluation of five popular mobile agent frameworks demonstrates that a malicious app can hijack agent actions and achieve arbitrary command execution even without any privilege permissions, while remaining visually indistinguishable to users. These findings reveal a fundamental trust mismatch in autonomous agent design and highlight the urgent need for perception-aware security models on multi-tenant platforms.
Intake rationale
移动 Agent 的风险来自截图、ADB、广播和输入通道的组合，而不是单一模型漏洞。
Obsidian evidence excerpt: 论文聚焦第三方 Android 移动 agent：VLM 通过截图感知手机状态，再通过 ADB/广播/输入通道执行动作。作者把攻击面分成屏幕感知攻击和误用通道攻击，并实现了七类攻击。The Hacker News 在 2026-07-21 的报道补充了更工程化的描述：截图落到 /sdcard 后再 pull 会留下 50–500ms 的 TOCTOU 窗口，shell=True 和广播键盘会把模型输出变成主机命令或明文输入泄漏。
Metadata
- Authors: Zidong Zhang, Zhentao Xie, Wenrui Diao, Jianliang Wu
- Original date: 2026-07-01
- Source: https://arxiv.org/abs/2607.00333
- Local intake source:
OpenClaw定时任务/论文流水线/2026-07-25-论文流水线.md