# Your Android AI Agent Will Type Whatever the Screen Tells It To — Including Shell Commands
The attack is elegant in the worst way. A malicious app renders text at 2% opacity on your phone screen. No human sees it. The AI agent driving your phone does — every time, at ceiling accuracy across six vision models tested. The agent, being helpful, follows the instruction. If the instruction says to type a shell metacharacter sequence into a text field, the agent types it. If that text field feeds into a subprocess call on the PC running the agent software, the host shell splits the string and executes the back half on your Windows box.
That's the chain. Researchers from Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and QAX's Xingtu Lab mapped seven distinct attack vectors across five open-source mobile AI agent frameworks — AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA — and found that all five fell to at least six of the seven. The paper went up on arXiv July 1 and was revised July 14. As of July 17, the vulnerable code paths remain on the main branches of every affected repository.
## The Command Injection Hiding in Plain Sight
Start with the easiest failure, because it's the most embarrassing. AppAgent's controller invokes ADB commands via subprocess.run(adb_command, shell=True) and builds text input by inserting model output directly into adb shell input text {input_str}. The original code had no sanitization at all. The current code strips spaces and single quotes before interpolating. It leaves semicolons, ampersands, and redirects untouched.
That's a 2019-era web security mistake. Any developer who has ever run a SQL injection tutorial knows that stripping one metacharacter while leaving others is not sanitization — it's a false sense of closure. The researchers confirmed this isn't theoretical: a payload designed to launch calc.exe succeeded 20 out of 20 trials against AppAgent, AppAgentX, Mobile-Agent-v3, and MobA. A separate end-to-end run against AppAgent used test;pwd>rce_success and wrote the host's working directory to a file on disk.
Getting that payload to the model is the other half of the problem.
## The Screenshot Race
These agents work by taking a screenshot of the phone, sending it to a vision model, getting instructions back, and acting. Between the screenshot capture and the ADB pull that retrieves it, there's a window — measured across the frameworks at 50 to 500 milliseconds, averaging around 210ms over 100 runs.
A background service polling at 5 to 10ms intervals has time to acquire a file lock, repaint the PNG with adversarial content, and release it before the agent retrieves the image. The frameworks make this practical because their screenshot paths are predictable: Open-AutoGLM writes to /sdcard/tmp.png, Mobile-Agent-v3 writes to /sdcard/screenshot.png with a half-second sleep between capture and pull, AppAgent still defaults in config.yaml to /sdcard, and AppAgentX uses timestamped, incrementing filenames an attacker can watch.
File tampering attacks landed 19 or 20 out of 20 against four of the five frameworks.
## What Vision Models See That You Don't
The more unsettling finding is the invisibility attack. The researchers rendered adversarial instructions at 2% opacity — below what a human eye reliably detects under normal viewing conditions. Every vision model tested read the text in at least 18 of 20 trials. GPT-4o, Claude Opus 4.5, Gemini 3 Pro, and GLM-4V all scored a perfect 20 out of 20. AutoGLM-Phone, a 9B on-device model, was the relative outlier at 18.
The scores don't improve as text becomes more visible because they start at the ceiling. Human perception has a threshold. Screenshots don't. That asymmetry is the attack surface.
There's also a hardware version. Phones clip their display corners and punch camera holes, but the frame buffer remains rectangular. Pixels rendered into those cutout regions sit under the physical bezel and never appear on the visible display — but they land in every screenshot. On a Pixel 4, that corner region yields roughly 78 hidden pixels of width. Short commands fit. All five agents read payloads out of the bezel region.
A third vector skips stealth entirely: an accessible Android window drawing over the screen tells the agent a network sync is running and asks it to wait three seconds. The model believes the overlay. The researchers timed how long that buys for file tampering.
## No CVEs, No Patches, No Responses
First author Zidong Zhang told The Hacker News the team emailed all five affected maintainers before posting the preprint. As of the paper's revision date, none had responded. No CVEs have been assigned. The researchers say they have no evidence of these techniques being used outside a controlled research setting — but the attack primitives are documented, the vulnerable code is public, and the affected repositories are actively used by developers building agent-driven automation.
The gap between "no evidence of exploitation" and "no exploitation" is not the same gap it used to be. When working RCE demos run 20 for 20 in a lab against code that's still live on main, the clock is running.
---
## HackWire Analysis
This research matters most not because of the specific frameworks it covers — AppAgent has a few thousand GitHub stars, not millions of enterprise deployments — but because it's the first systematic attack taxonomy for the category. Mobile AI agents are moving from research curiosities to production tools fast. Every company building an agent that controls a phone has made, or will make, at least one of these mistakes.
The shell injection finding should have been caught in any competent code review. shell=True with unvalidated model output is a failure mode that predates LLMs entirely. The fact that it shipped in a framework people are building on is a signal that the AI agent development community is repeating the mistakes of the early web era, just faster. In the 2000s, developers concatenating user input into SQL queries weren't malicious — they didn't have a shared vocabulary for the risk. The vocabulary exists now. There's no excuse.
The vision model finding is the genuinely new terrain. The attack surface of a system that sees the screen is larger than the attack surface of one that reads structured input, because the model processes everything the pixel buffer contains — not just what the user intended to show it. Transparent overlays, bezel regions, and ambient UI elements all become potential injection points. Defenders need to think about this the same way web developers eventually learned to think about the DOM: anything the renderer touches, an attacker can potentially write.
The maintainer non-response is also worth naming bluntly. If five project teams received coordinated disclosure before a preprint and couldn't muster an acknowledgment in two weeks, the open-source AI agent ecosystem has a security-culture gap. The frameworks are production tools with documented RCE paths and no patch timeline in sight. Developers running these in anything resembling a sensitive environment should be treating this as a live exposure until they hear otherwise.
The timing is sharp. As enterprise adoption of AI phone automation accelerates through 2026, the window between "researcher demo" and "commodity exploit" is narrowing. This one doesn't need novel tooling.
— HackWire Editorial
---
## Related Coverage