Open-Source Android AI Agents Can Let Invisible Script Run Code on Home PCs

An Android app that can draw on top of other windows and write to shared storage can slip instructions to the AI ​​agent running that phone, in text no human eye will ever see. Two more steps, and the same application executes commands on the PC running the agent.

The researchers demonstrated that sequence, along with six other attacks, against five open source mobile agent frameworks: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. Everyone is down to six out of seven.

The paper was uploaded to arXiv on July 1 and revised on July 14. The authors are from Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and the Xingtu Lab at the Chinese security company QAX.

There is nothing here with CVE, and the first author Zidong Zhang told Hacker News the team has no evidence of techniques being used outside of a controlled setting. Hacker News checked all five frameworks and found the screenshot methods, shell call, and reverse stream described by the paper sitting on their main branches as of July 17th.

Zhang said the team emailed affected caregivers privately before sending the pre-written letter and “has not received a response so far.”

Ascension is the most unusual part. The AppAgent controller uses subprocess.run(adb_command, shell=True) and creates text input by passing model output directly to the adb shell input text {input_str}. The list of this paper shows that the work has no sanitation at all.

The live code does slightly better and nowhere near enough: it strips spaces and single quotes before compiling, and leaves all other shell metacharacters alone. Not ;, not &, not >. So the string model is read on the screen and typed accordingly is split by the host shell, and the back half runs on the operator’s Windows box.

A payload designed to launch calc.exe did just that in 20 out of 20 tests against AppAgent, AppAgentX, Mobile-Agent-v3, and MobA. Running an end-to-end variant against the AppAgent used test;pwd>rce_success and wrote the host’s working directory to a file.

Getting that thread in front of the model is a race for the files. Open-AutoGLM runs screencap -p /sdcard/tmp.png and pulls a different adb. Fixed Mobile-Agent-v3 writing to /sdcard/screenshot.png and sleeping half a second between the two. AppAgentX writes to /sdcard/ under the names of time-stamped files that contain an incrementing step counter, a pattern that an attacker can see. The shipped config.yaml for AppAgent still changes its screenshot directory to /sdcard.

The researchers timed that gap in all frames at 50 to 500ms, an average of about 210ms over 100 runs. A background service polling every 5 to 10ms has a chance to take the file lock, repaint the PNG, and release before the agent collects it. Tampering went from 19/20 to 20/20 against four out of five.

To extend the window further, they show the agent an invisible overlay saying that network synchronization is active and ask it to wait three seconds. The model believed.

All six vision models the researchers tested read 2%-opacity text in at least 18 of 20 lab tests. The paper puts that level below normal human detection under normal observation. The GPT-4o, Claude Opus 4.5, Gemini 3 Pro, and GLM-4V scored 20 out of 20. The numbers do not increase as the text becomes more visible, because they start at the ceiling.

AutoGLM-Phone, the 9B model that runs on the device itself, was the weakest in six out of 18 out of 20 tests. Human perception uses a threshold. Screenshot not available.

Asymmetry has a hardware version as well. Phones round their corners and cut holes for the cameras, but the frame buffer is always rectangular, so the pixels rendered in those regions stay below the bezel and stay in all screenshots. In the Pixel 4 that leaves about 78 pixels of hidden width in one corner, a short command is enough, and all five agents learn the paid download from it.

The third trick skips the trick entirely: the access service drops the fake login function with the real app and lets the agent type in the user’s credentials. One may hesitate when prompted for an unexpected password. None of the five did, in all 100 trials.

No one has confirmed the keyboard

Agents don’t have an allowed channel on the phone, so they reuse the ones they debug, and cheap attacks on the set come from that. Open-AutoGLM base64-encodes the text you type and burns it to ADB_INPUT_B64, a transparent stream taken by ADB Keyboard, an automated testing tool designed to accept text from whatever streams it.

That’s its written intent, and it’s still being maintained, with the pre-April release carrying the Android 16 fix. ADB Keyboard does what the README promises. Agents are the ones who turn the test harness into production input pipes.

Mobile-Agent-v3 keeps a narrow allow list: letters, digits, and common punctuation are passed through the adb shell’s input text, and everything else, meaning any non-ASCII character, is passed one character at a time over ADB_INPUT_TEXT. MobA is blunter. Its type_text evaluates the entire string with text.isascii(), so a single emoji or underlined character anywhere in a message sends the entire message in one shot.

Any app that registers the same action gets the same load, and doesn’t need permission to do it, so there’s nothing to warn the user. Where an attacker has access, TYPE_VIEW_TEXT_CHANGED provides the same text in plain text, password fields included, against all five.

The terms are original. This requires a pre-installed operating system, an active agent, and USB or wireless debugging enabled. The affected software is open source developer tools, not an assistant baked into the stock handset.

First-party agents, including Samsung’s Bixby and Xiaomi’s XiaoAi were gone, and so was iOS. Zhang offered one caveat: several attacks require minimal Android permissions, and one requires none at all, which he said lowers the barrier for a motivated attacker.

One exception is it doesn’t require a malicious app either. Because the payload can ride the image’s chrominance channels instead of its brightness, an attacker who never touches the device can bury one in the image and allow the victim’s agent to capture it in the messaging app. The researchers call that an extension rather than a measured effect. It is also the only version without an installation step.

It fixes, and the other one is missing

Two out of five already shows what the right looks like. MobA streams screenshots by extraction and never has a device file to compete with. Open-AutoGLM passes arguments as a list instead of a string concatenation, and is the only one of the five that is immune to host command injection.

No project does both right. None of the following adjustments need to affect the model:

• Drop shell=True. Pass the arrgv arrays, so the metacharacts are always literal.
• Stream screenshots instead of typing and dragging. No device side file, no TOCTU window.
• Apply signature-level permission to the input stream, or use transparent targets.
• Separate the foreground work before and after each action, and maintain an allowed list of packages for each work.
• Apply a contrast enhancer over the screenshots before the model sees them. A part, not a fix.

A transparent defense is a guarantee against critical actions, and Open-AutoGLM delivers one. Fires when the model determines that the action is sensitive. The idea attack rewrites that judgment, which is why the paper balances insufficient information against subliminal injection, UI spoofing, and screenshot tampering.

Against broadcasting and sniffing access, it does nothing, because there is no affirmative action. The text is already gone. In the corner and cutting injection, the researchers are not clear: “there is no software-based solution that is specific and effective.” Hiding corners is a true hardware function.

I have nowhere to report it

Silence has structure behind it. Zhang said the team went to private email because the projects do not have a dedicated vulnerability reporting channel, and Hacker News could not find a security policy published by any of the five repositories.

The paper adds that Tencent and Alibaba were contacted first, and that research-grade open source projects remain outside of the Security Response Center’s usual scope.

Set that against Microsoft’s May write-up of the Semantic Kernel, its agent framework, where the same pattern of shell-access model leaks produced CVE-2026-25592, CVE-2026-26030, and the attached issue. Microsoft’s version of one line is passed here without editing: “your LLM is not a security barrier.”

The overlay component is not a new area. Wu et al. I implemented a quick injection with overlay windows against AppAgent and Mobile-Agent in May 2025, and Ding et al. followed in October with instructions only visible while the agent was looking.

This related work section of this paper does not cite and skips the mobile agent security literature entirely. What you add is the end of the chain: out of the screen, through the file, into the host.

Which leaves the odd part. Open-AutoGLM carries over 25,000 GitHub stars, and its README walks you through enabling USB debugging, sideloading a keyboard, and giving it your input. Follow the documentation exactly and build all the criteria needed for a limited attack without the malicious app itself. The setup guide is for every threat model.