Android AI Agents Vulnerable to Invisible Screen Text Attacks
Researchers have demonstrated a novel attack chain where an Android app can leverage invisible screen text to send instructions to an AI agent, enabling command execution on the host PC.
Researchers have uncovered a significant security vulnerability in several open-source Android AI agent frameworks, allowing malicious applications to execute arbitrary commands on a host PC. The attack chain begins with an Android app that can draw over other windows and write to shared storage. This app can then inject invisible text instructions into the AI agent controlling the phone, which are then relayed to the host PC.
The proof-of-concept demonstrated by the team targeted five popular open-source mobile AI agent frameworks: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. The researchers found that all five frameworks were susceptible to at least six out of seven demonstrated attack vectors, highlighting a widespread risk.
The core of the exploit lies in how these AI agents process input from the Android device. For instance, AppAgent's controller directly interpolates model output into an adb shell input text command without adequate sanitization. This allows malicious text, such as shell metacharacters, to be interpreted by the host PC's shell, leading to unintended command execution.
To achieve command execution, the attacker must first get the malicious instructions onto the AI agent's screen, which is then captured and processed. This is achieved through a race condition involving screen capture and file access. Attackers can exploit a small time window, typically between 50 to 500 milliseconds, to replace the legitimate screenshot with one containing invisible text commands before the AI agent processes it.
Further enhancing the attack's stealth, the researchers found that AI vision models are highly susceptible to reading text rendered with very low opacity (as little as 2%). Even text drawn in areas obscured by phone bezels or camera cutouts can be read by the AI agent, providing a covert channel for command injection. Additionally, a fake accessibility service can overlay a malicious login screen, tricking the agent into inputting user credentials.
The attack leverages existing debug channels, such as ADB Keyboard, which are designed to accept text input from various sources. By sending specially crafted payloads, attackers can bypass security measures and execute commands like launching calc.exe or exfiltrating directory information on the host machine. In controlled trials, payloads successfully executed in 20 out of 20 attempts against multiple frameworks.
While the researchers have not found evidence of these techniques being used in the wild, and the affected frameworks have not yet responded to private notifications, the vulnerabilities remain present in the main branches of the codebases. The preconditions for this attack include an already installed malicious app, an active AI agent session, and enabled USB or wireless debugging, but the minimal permissions required lower the barrier for motivated attackers.
This research underscores the critical need for robust input sanitization and secure communication channels within AI agent frameworks. As AI agents become more integrated into development and operational workflows, securing these systems against novel attack vectors like invisible text injection is paramount.