Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

Researchers at Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and QAX have discovered a significant vulnerability in five popular open-source Android mobile agent frameworks: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. These agents, designed to control device behavior, can be exploited to execute commands on the host PC, even without a malicious app installed on the device. The attack chain involves a combination of techniques, including screenshot manipulation, USB debugging, and accessibility sniffing, to bypass security measures and inject commands into the host system.

Essentially, the researchers demonstrated that an attacker can trick the agent into drawing invisible text on the screen, which is then captured by a screenshot. This screenshot can then be used to inject commands into the host PC, leveraging USB debugging and accessibility features. The vulnerability stems from the fact that these agents often pass model output directly into ADB shell input, without any sanitization, allowing for command injection.

The researchers found that these vulnerabilities are exacerbated by the lack of a dedicated reporting channel for security vulnerabilities within the open-source projects themselves. They initially contacted the project maintainers privately, but received no response. The attack chain is complex and requires several preconditions to be met, including USB debugging enabled, a running agent, and a screenshot taken.

Open-AutoGLM, a particularly popular agent with over 25,000 GitHub stars, is a prime example. Its README provides a detailed walkthrough of enabling USB debugging, sideloading the keyboard, and handing it your input – effectively creating all the necessary preconditions for the attack to succeed.

Several related-work papers have previously explored similar prompt injection techniques, including Wu et al.'s work on overlay windows against AppAgent and Mobile-Agent in May 2025, and Ding et al.'s work on prompts that surface only while an agent is looking in October. However, this research goes further by demonstrating the entire attack chain – from the screenshot on the device to the command execution on the host PC – and highlights the lack of a security reporting mechanism within the open-source projects.

Microsoft's May writeup on Semantic Kernel, its agent framework, demonstrated a similar pattern – where model output reaching a shell led to CVE-2026-25592, CVE-2026-26030, and a patched release, with the warning that "your LLM is not a security boundary." The researchers emphasize that the lack of a dedicated reporting channel for security vulnerabilities within these projects is a significant concern, as it leaves them vulnerable to exploitation without any immediate response.

To address these vulnerabilities, the researchers suggest several mitigations, including dropping shell=True, passing arguments as lists, streaming screenshots instead of writing files, using a signature-level permission on the input broadcast, and diffing foreground activity before and after each action. They also recommend a confirmation prompt on sensitive actions, although they acknowledge that this is insufficient against prompt injection and UI spoofing.

Ultimately, the research underscores the importance of security awareness and rigorous testing within the open-source community, particularly when dealing with agent frameworks that can control device behavior.