Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs
Open-source Android AI agent frameworks (AppAgent, Mobile-Agent-v3, etc.) suffer from critical remote code execution vulnerabilities due to unsanitized command injection in ADB interfaces. Attackers can inject malicious commands via "invisible" text rendered at low opacity or in hardware bezel areas, which AI vision models detect despite human invisibility. File race conditions during screenshot capture allow attackers to replace legitimate images with tampered ones containing hidden payloads be
Analysis
TL;DR
- Open-source Android AI agent frameworks (AppAgent, Mobile-Agent-v3, etc.) suffer from critical remote code execution vulnerabilities due to unsanitized command injection in ADB interfaces.
- Attackers can inject malicious commands via "invisible" text rendered at low opacity or in hardware bezel areas, which AI vision models detect despite human invisibility.
- File race conditions during screenshot capture allow attackers to replace legitimate images with tampered ones containing hidden payloads before the agent processes them.
- Accessibility services and broadcast intents are exploited to intercept keystrokes and credentials without user awareness, bypassing standard security prompts.
- The research highlights a fundamental trust boundary failure where developer tools intended for automation become vectors for host machine compromise.
Why It Matters
This research exposes severe security flaws in the rapidly growing ecosystem of autonomous mobile agents, demonstrating that current open-source implementations lack basic input sanitization and secure handling of visual data. For AI practitioners and developers, it underscores the critical need to treat agent outputs as untrusted input when interfacing with host systems, particularly regarding shell commands and file operations. The findings suggest that without rigorous security audits and secure-by-design architectures, these tools pose significant risks to both device integrity and host computer safety.
Technical Details
- Command Injection: Frameworks like AppAgent use
subprocess.run(adb_command, shell=True)and directly interpolate model-generated text intoadb shell input textcommands without sanitizing shell metacharacters (e.g.,;,&,>), allowing arbitrary code execution on the host PC. - Visual Steganography: Attackers utilize 2% opacity text or render commands in the rectangular frame buffer areas hidden by rounded phone screens (bezel overflow). Vision models (GPT-4o, Claude Opus 4.5, etc.) successfully read this text, whereas human eyes typically cannot.
- File Race Conditions: By exploiting the timing gap (50-500ms) between screenshot generation (
screencap) and retrieval (adb pull), attackers can swap the image file with a tampered version containing hidden payloads using a background polling service. - Input Channel Exploitation: The study leverages
ADB Keyboardand broadcast intents (ADB_INPUT_B64,TYPE_VIEW_TEXT_CHANGED) to inject text or steal credentials. Accessibility services allow apps to read typed text in plaintext, bypassing password field protections. - Affected Frameworks: The vulnerabilities were confirmed in five major open-source agents: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA, with varying degrees of mitigation failure in their respective input handling logic.
Industry Insight
- Security Audits for Agent Frameworks: Developers must implement strict input validation and output encoding for any data passed to system shells or ADB commands. Treat AI-generated text as hostile input until proven safe.
- Rethinking Trust Boundaries: Autonomous agents should operate within sandboxed environments or use restricted user accounts on the host machine to limit the impact of potential command injection attacks.
- Standardization of Secure Input Channels: The industry needs standardized, permission-aware APIs for agent-host communication that do not rely on repurposing debug tools like
ADB Keyboardor raw broadcast intents, which lack user consent mechanisms.
Disclaimer: The above content is generated by AI and is for reference only.