(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents
2026-07-01 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors study special mobile apps called third-party mobile agents that use vision-language models to interact with smartphones by seeing screenshots and deciding actions. They find these agents create new security risks that normal apps don't have, such as tricks involving how machines see screens differently from humans and ways attackers can interfere with the agents' decision-making. The authors demonstrate seven real attacks that can take control of these agents without raising user suspicion. Their work shows current autonomous agents have security weaknesses and suggests new security models are needed for safely using these agents.
Third-party mobile agentsVision-Language Models (VLMs)Screen Perception Attack SurfaceMisused Channel Attack SurfaceScreenshot tamperingSubliminal text injectionMobile securityAutonomous agentsMulti-tenant platformsCommand injection
Authors
Zidong Zhang, Zhentao Xie, Wenrui Diao, Jianliang Wu
Abstract
Third-party mobile agents powered by Vision-Language Models (VLMs) have emerged as a promising paradigm for automating smartphone interactions. These agents act as high-privilege decision-makers, perceiving device states through screenshots and executing actions via VLM reasoning, transforming how an agent app interacts with the environment (i.e., other apps or the OS). Correspondingly, this transformation introduces new attack surfaces or transforms benign/harmless interfaces into exploitable ones for mobile devices. In this paper, we summarize key differences between third-party mobile agent apps and general apps when interacting with the environment, analyze the security posture of agents, and identify two unique attack surfaces compared to general mobile apps: the Screen Perception Attack Surface, which exploits the gap between human and machine vision, and the Misused Channel Attack Surface, which intercepts or manipulates the agent's execution pipeline. We design and implement seven concrete attacks, from subliminal text injection and invisible pixel zone exploitation to screenshot tampering and host PC command injection. Our evaluation of five popular mobile agent frameworks demonstrates that a malicious app can hijack agent actions and achieve arbitrary command execution even without any privilege permissions, while remaining visually indistinguishable to users. These findings reveal a fundamental trust mismatch in autonomous agent design and highlight the urgent need for perception-aware security models on multi-tenant platforms.