Open-Source Android AI Agents Vulnerable to Invisible Screen Text Attacks Leading to Host Code Execution

Researchers have demonstrated that open-source Android AI agent frameworks are vulnerable to a novel attack chain where invisible screen text can lead to code execution on the host PC. The study, published on arXiv and revised on July 14, 2026, tested five frameworks: AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. All fell to at least six of seven attack types.

The attack exploits multiple weaknesses. First, an Android app with overlay and storage permissions can inject text into screenshots that AI agents read. The text is rendered at 2% opacity, invisible to humans but readable by vision models like GPT-4o, Claude Opus 4.5, and Gemini 3 Pro with 100% success. Second, agents use insecure shell commands (e.g., subprocess.run(adb_command, shell=True)) without proper sanitization, allowing command injection. A payload like test;pwd>rce_success can execute arbitrary commands on the host. Third, screenshot tampering via file race conditions (50-500ms window) achieves 95-100% success. Fourth, hidden pixels under screen bezels and camera cutouts can contain payloads. Fifth, fake login overlays trick agents into stealing credentials. Sixth, unsecured broadcast intents (ADB_INPUT_B64) allow any app to intercept typed text. Seventh, accessibility services can capture password fields.

No CVEs have been assigned, and the researchers found no evidence of exploitation in the wild. The affected projects have no security policies or dedicated reporting channels. Microsoft’s similar issue in Semantic Kernel led to CVE-2026-25592 and CVE-2026-26030. The researchers recommend dropping shell=True, using argument lists, streaming screenshots, and adding signature-level permissions.