Pith. sign in

REVIEW 4 major objections 6 minor 4 cited by

A zero-permission Android app can hijack a GUI agent's actions by swapping screens mid-thought.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 09:48 UTC pith:TLCISHA2

load-bearing objection Persuasive TOCTOU attack on Android GUI agents, but the 'zero dangerous permissions' claim is overstated—the full evaluated chain needs POST_NOTIFICATIONS. the 4 major comments →

arxiv 2601.12349 v3 pith:TLCISHA2 submitted 2026-01-18 cs.CR cs.AIcs.SE

Mind the Gap: Action Rebinding Attacks against Android GUI Agents

Yi Qian , Kunwei Qian , Xingbang He , Ligeng Chen , Jikang Zhang , Tiantai Zhang , Haiyang Wei , Linzhang Wang
show 2 more authors
Hao Wu Bing Mao
This is my paper
classification cs.CR cs.AIcs.SE
keywords action rebindingAndroid GUI agentsTOCTOUvisual atomicityobservation-to-action gapUI state preservationzero-permission attackmultimodal agents
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper shows that Android GUI agents—AI assistants that look at the screen and tap for the user—can be hijacked by an ordinary app that holds no dangerous permissions. The attack works because agents take a screenshot, think, then act; the app switches the foreground screen during the thinking delay, so the agent's tap lands on a sensitive button in a different app. The paper argues this breaks an implicit 'visual atomicity' assumption and demonstrates it on six widely-used Android GUI agents, achieving 100% success for single actions and multi-step chains including sending SMS, deleting files, and uninstalling apps. If true, it means current Android sandboxing and malware scanners do not protect against this class of attack.

Core claim

The central claim is that the observation-to-action gap in LMM-based GUI agents is a time-of-check-to-time-of-use vulnerability: a benign-looking attacker app can render a decoy UI to elicit a planned action, then use a standard Android Intent to bring a victim app to the foreground before the agent injects its input. Because Android delivers input to whatever occupies the screen coordinates, the agent's action is rebound to a privileged component in the victim app. The paper further shows that the agent's own task-recovery behavior can be weaponized into a programmable multi-step loop, and that an 'Intent Alignment Strategy' can make verification dialogs appear as legitimate steps, letting

What carries the argument

The central mechanism is the observation-to-action window (W_o2a), the latency between an agent's screenshot and its injected action, combined with two Android properties: unconstrained foreground transitions via Intents and UI state preservation across background-foreground moves. The attacker's app uses a 'contextual carrier'—a benign screen whose interactive elements are spatially aligned with target buttons in a victim app—so when the foreground swaps, the agent's tap at the same coordinates triggers a different action. Multi-step chains are driven by the agent's task-recovery logic, which makes it return to the attacker's app after a mismatch.

Load-bearing premise

The attack's reliability rests on the assumption that the target app's sensitive UI (button coordinates and state) remains unchanged across background-foreground transitions for the whole multi-step chain, and that the apps chosen to test this are representative rather than a favorable subset.

What would settle it

Run a single trial with an Android GUI agent that binds its action to a stable view identity (e.g., a resource ID) rather than raw coordinates, and bring a target app to the foreground during the agent's reasoning; the agent taps the decoy's button, not the target's, showing the rebinding is not universal. Alternatively, use a target app that re-creates its activity on re-entry with different coordinates; the multi-step chain breaks when alignment fails.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Current Android GUI agents that rely on coordinate-based grounding are vulnerable to single-action rebinding whenever their reasoning latency exceeds the time needed to swap foreground apps.
  • The attack defeats permission-based sandboxing: the malicious app never calls privileged APIs, and the sensitive operation is executed by the agent on behalf of the user.
  • Agents that are designed to be more task-resilient (never giving up, always recovering) actually amplify the attack, enabling multi-step chains.
  • Common agent safety protocols such as forced reasoning delays widen the attack window and improve exploit reliability.
  • The 0% detection rate in commercial malware scanners is a direct consequence of the intent-capability decoupling: the app looks benign because it is only a UI orchestrator.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same temporal gap exists in desktop and web GUI agents that use screenshots and coordinates; the mechanism may generalize beyond Android, although the foreground-transition primitive differs.
  • A likely defense would require agents to bind actions to stable component identities or verify the foreground package immediately before input injection—something none of the six tested agents do.
  • If an attacker can profile the agent's latency offline, the attack can be timed deterministically, making slower (often cloud-backed) agents more attractive targets.
  • The paper's test targets were selected for known state retention, so real-world generalization of multi-step chains depends on how common such state-preserving apps are.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper introduces Action Rebinding, a TOCTOU-style attack against LMM-based Android GUI agents. A malicious app (App_atk) presents a benign-looking "contextual carrier" UI to elicit a predictable planned action from an agent, then swaps the foreground to a victim app (App_tgt) during the agent's reasoning latency, so that the agent's injected tap is delivered to a sensitive UI element in App_tgt. The paper develops three primitives: atomic action rebinding, multi-step orchestration that weaponizes the agent's task-recovery behavior, and an Intent Alignment Strategy (IAS) that frames target verification dialogs as task-consistent steps. The attack is evaluated on six open-source Android GUI agents across fifteen tasks, reporting 100% atomic rebinding success, high multi-step chain reliability, IAS success up to 100%, and 0/67 VirusTotal detection. The central conclusion is that the "Visual Atomicity" assumption of current GUI agents is invalid on Android and that permission-based and code-centric defenses are insufficient against this attack.

Significance. If the results hold, the paper identifies a real and broadly applicable vulnerability at the agent-OS execution boundary. The conceptual separation from prompt injection—targeting the execution layer rather than the reasoning layer—is valuable, and the empirical coverage of six agents strengthens the claim that the problem is architectural rather than agent-specific. The paper also makes a good-faith effort to decompose the attack into atomic, multi-step, and IAS components, and it reports scanner findings including the MobSF dangerous-permission flag. However, the strongest headline claims are not fully supported by the paper's own assumptions and measurements: the "zero dangerous permissions" statement is contradicted by the use of POST_NOTIFICATIONS in the multi-step primitive, and the multi-step generalization is based on a favorable selection of state-preserving targets. These issues are fixable but need to be addressed before the paper's central contribution can be accepted at face value.

major comments (4)
  1. [§3.2, §6.2, §7.10, Table 7] The attacker model claims "Zero Dangerous Permissions" and says App_atk requests only standard permissions such as POST_NOTIFICATIONS. On Android 13+ POST_NOTIFICATIONS is a dangerous runtime permission, and Table 7 itself shows MobSF flags it as dangerous. The notification-based recovery primitive in §6.2 and §7.10 requires this permission to post notifications. Therefore the evaluated multi-step attack framework is not zero-dangerous-permission, and a user denying notification access would break recovery for agents relying on back-navigation. The abstract's unqualified "zero dangerous permissions" and the framing "requires no sensitive permissions" are not supported. Please re-scope the claim to atomic rebinding only, or implement a permission-free recovery channel, or explicitly acknowledge and discuss the dangerous-permission requirement in the abstract and threat model.
  2. [§7.3.2] The reliability of multi-step chains depends on Target State Persistence, yet the paper states: "In our experiments, we select apps known to retain state to satisfy this." This is a favorable selection rule, and no data are given on how many candidate targets were screened or rejected, nor which apps were chosen. As written, the multi-step results do not support the general claim that action rebinding "reliably orchestrate[s] multi-step attack chains" across Android apps. The paper should report the target app selection set, justify representativeness, or reframe the contribution as feasibility under a stated precondition rather than a general bypass.
  3. [§7.3.2, Table 3] The Autonomous Recovery metric is not clearly defined. The sentence "we only record actions that change the UI state of App_tgt as a failure; others are ignored since they don't affect attacks" is ambiguous and could exclude recovery failures that leave the agent in App_tgt without changing its UI. This would inflate the recovery rates in Table 3. All trials and their outcomes should be reported, including the discarded cases, and the success criterion should be stated unambiguously (e.g., "agent returns to App_atk within N steps without human intervention"). This is central because the multi-step orchestration claim rests on recovery reliability.
  4. [§7.2, Table 2 / §7.3.1] The end-to-end results are reported only as ✓/✗ with no trial counts, per-task success rates, or a stated protocol for handling agent nondeterminism. The abstract's "100% success rate for atomic action rebinding" and the claim that "all tested agents are vulnerable" are strong statements that require a reproducible evaluation protocol: number of trials per task, seed/model settings, failure definitions, and whether the 100% figure refers to one trial or many. Table 3 provides 10-trial data for multi-step reliability, but Table 2 and §7.3.1 do not give comparable detail for the headline atomic result.
minor comments (6)
  1. [Title / Abstract] The title "Zero-Permission Manipulation" overstates the demonstrated result given the POST_NOTIFICATIONS requirement. Consider a title that reflects the timing-based mechanism rather than a permission-free claim.
  2. [§7.6] The sentence "We detail this with screenshots and analysis in" is incomplete—no figure or section reference follows.
  3. [Table 1, Table 2] There are typos and inconsistencies: "Mobie-Agent-V3" appears in Table 1 header, and Table 2 uses "Driodrun" while other tables use "Droidrun". The Purchase online row also shows "-" inconsistently.
  4. [§7.7 / Table 7] The detection section is informative, but "0% detection rate" conflates scanner votes with a security guarantee. Since MobSF already flags the notification permission as dangerous, the claim should be worded as "0/67 VirusTotal and 0/48 VirSCAN detections" rather than "0% detection rate" without qualification.
  5. [Figure 9] Figure 9 refers to "red area" and "blue area" for notification interaction regions; the submitted figure is grayscale and the regions are not legible. Add arrows or hatching.
  6. [General] Experimental artifacts and logs are only available by email request. For reproducibility in a security venue, please provide a stable artifact link or archive in the paper.

Circularity Check

0 steps flagged

No significant circularity: the core attack mechanism is derived from Android's unprivileged Intent transitions and the agents' coordinate-based action injection, then evaluated against six external agents.

full rationale

The central derivation chain—App_atk renders a contextual carrier, swaps foreground during the observation-to-action window W_o2a, and the agent's coordinate-grounded action lands in App_tgt—is a direct consequence of Android's standard Intent-based foreground transitions and the agents' spatial grounding, not of any fitted parameter or prior result imported from the authors. The attack is then tested on six external GUI agents, and the scanners used for evasion testing are external tools, so the evaluation is self-contained rather than circular. The conditional structure in §7.3.2 ('we select apps known to retain state to satisfy this') means the reported 100% atomic and multi-step figures are precondition-restricted success rates, and the carrier-acceptance and auto-recovery numbers in Table 3 are reported separately; this is a generalizability caveat, not a circular derivation. Similarly, §3.2's treatment of POST_NOTIFICATIONS as a 'standard' permission conflicts with Table 7's MobSF 'dangerous' flag, and the 0% scanner detection is largely entailed by the app intentionally containing no malicious payloads; these are correctness/overclaim issues about the threat model's framing, not circular steps in the attack's derivation. No self-citation chain is load-bearing; the closest related TOCTOU work ([23], [26]) is by other authors and is used as background. Overall, no claim reduces by construction to its own inputs.

Axiom & Free-Parameter Ledger

2 free parameters · 5 axioms · 0 invented entities

The attack rests on Android OS behaviors (foreground transitions, UI state preservation), empirical properties of current agents (reasoning latency, no identity re-check, recovery behavior), and attacker configuration (profiled coordinates/delays). These are not derived within the paper; they are measured or assumed.

free parameters (2)
  • Foreground transition trigger delay = Profiled per agent, e.g., set to median W_l2o + small offset (< W_o2a)
    App_tatk is configured with a fixed delay after its own onResume to launch App_tgt; the delay is derived from offline profiling of each agent's W_l2o and W_o2a (§3.2, §5.1). It is empirically tuned per agent, not derived from first principles.
  • Target UI coordinate map = Screen coordinates of App_tgt components from offline profiling
    The attack requires spatially aligning the carrier button with the target component; this mapping is obtained on a reference device and assumed to transfer across devices (§3.2, §6.1).
axioms (5)
  • domain assumption A foreground app can start another app via standard Intent without any dangerous permission during its foreground lifetime.
    Used in Stage 3/§5.2. Android's background-activity-launch restrictions do not apply because App_tatk is foreground at the trigger instant.
  • domain assumption Android preserves the UI state (activity stack, dialogs, input contents) of backgrounded tasks across foreground transitions.
    Used in §2.2 and Stage 5; enables multi-step chains. The authors explicitly select targets 'known to retain state' (§7.3.2), so the axiom is not universal.
  • domain assumption The agent does not verify the identity of the foreground app between observation and action injection; its action is delivered to whatever window is at the specified coordinates.
    Core premise of the attack, validated empirically for six agents but not guaranteed for all agent designs (§4, §7).
  • domain assumption LMM reasoning latency W_o2a is positive, stable, and large enough for a foreground transition (measured 4.18-15.43s).
    Empirical regularity from Table 5; the attack would fail for agents with near-zero or atomic execution.
  • domain assumption Agents' task-recovery logic will relaunch App_tatk or accept notification-based recovery.
    Weaponized for multi-step orchestration; recovery rates vary (45.7%-100%, Table 3), so it is not universal.

pith-pipeline@v1.3.0-alltime-deepseek · 18403 in / 14186 out tokens · 139491 ms · 2026-08-03T09:48:08.407288+00:00 · methodology

0 comments
read the original abstract

Large multimodal model powered GUI agents are emerging as high-privilege operators on mobile platforms, entrusted to perceive screen content and inject inputs across application boundaries. While these agents aim to automate complex tasks, we demonstrate that their design introduces a fundamental conflict with Android's strict application sandboxing. We present a novel cross-application Action Rebinding attack, which allows a malicious application with zero dangerous permissions to hijack the agent's execution and perform privileged operations on behalf of the attacker. Our attack exploits the inevitable observation-action gap inherent in the agent's reasoning pipeline. A malicious app can render a benign ``contextual carrier'' to elicit a planned action, and then swap the foreground to a sensitive target application during the reasoning latency. The agent, unaware of the transition, unwittingly executes the action in the privileged context. We further advance this attack by weaponizing the agent's own task-recovery logic to create programmable, multi-step exploit loops , and introducing an Intent Alignment Strategy (IAS) that manipulates the agent's reasoning to rationalize the hijacked state. We evaluate our attack on six widely-used Android GUI agents. Our results demonstrate a 100% success rate for atomic action hijacking and the ability to orchestrate high-impact exploits, including unauthorized file deletion, SMS transmission, and app uninstallation, without the attacker holding any corresponding permissions. Furthermore, since the malicious application separates intent from capability and contains no privileged API calls, it achieves a 0% detection rate across commercial malware scanners (e.g., VirusTotal), highlighting a critical blind spot in current mobile security analysis. To access experimental logs and demonstration videos, please contact yi_qian@smail.nju.edu.cn.

Figures

Figures reproduced from arXiv: 2601.12349 by Bing Mao, Haiyang Wei, Hao Wu, Jikang Zhang, Kunwei Qian, Ligeng Chen, Linzhang Wang, Tiantai Zhang, Xingbang He, Yi Qian.

Figure 1
Figure 1. Figure 1: The agent’s action to send a message is misbound [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: An example of rebinding a tap to purchase. The agent plans to tap the new notes button in the NOTES App based on its [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Workflow of action rebinding attack. During𝑊𝑙2𝑜 , 𝐴𝑝𝑝𝑎𝑡𝑘 must render the contextual carrier, a benign UI state designed to elicit a specific, predictable action from the agent. Observation-to-Action Window (𝑊𝑜2𝑎): Following the observa￾tion, the agent’s LMM processes 𝑂 to determine and inject the corresponding action 𝐴 at time 𝑇𝑎. We define this critical attack window as: 𝑊𝑜2𝑎 =𝑇𝑎 −𝑇𝑜, (2) This window repr… view at source ↗
Figure 4
Figure 4. Figure 4: The action planned for clicking the back button is [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Comparison of carrier with (right) and without (left) [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Thoughts of Task Recovery [PITH_FULL_IMAGE:figures/full_fig_p009_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: The Agent thinks through verification gates [PITH_FULL_IMAGE:figures/full_fig_p009_7.png] view at source ↗
Figure 9
Figure 9. Figure 9: On Pixel 14, clicking the red area returns to the app, [PITH_FULL_IMAGE:figures/full_fig_p011_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 4 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agents

    cs.CR 2026-04 unverdicted novelty 7.0

    Desktop GUI agents face TOCTOU attacks from UI state changes during the ~6.5s observation-to-action gap, with a three-layer pre-execution verification defense achieving 100% interception on two attack types but failin...

  2. Safe, or Simply Incapable? Rethinking Safety Evaluation for Phone-Use Agents

    cs.CL 2026-05 unverdicted novelty 6.0

    Phone-use agents avoid harm more often through inability to act than through deliberate safe choices, so benchmarks must separate unsafe judgment from capability failure.

  3. DRIVE: Modeling Skills at the Reasoning and Interaction Levels for Web Agents under Continual Learning

    cs.AI 2026-04 unverdicted novelty 6.0

    DRIVE disentangles reasoning and interaction skills for web agents via dual-level modeling and scene-aware coordination, reaching 52.8% success on WebArena tasks.

  4. Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability

    cs.CL 2026-05 unverdicted novelty 4.0

    The paper develops a unified framework that organizes computer-use agent reliability around perception-decision-execution layers and creation-deployment-operation-maintenance stages to map security and alignment inter...

Reference graph

Works this paper leans on

56 extracted references · 14 linked inside Pith · cited by 4 Pith papers

  1. [1]

    Philipp Beer, Marco Squarcina, Sebastian Roth, and Martina Lindorfer. 2025. {TapTrap}:{Animation-Driven} Tapjacking on Android. In34th USENIX Security Symposium (USENIX Security 25). 3317–3335

    2025

  2. [2]

    Matt Bishop, Michael Dilger, et al . 1996. Checking for race conditions in file accesses.Computing systems2, 2 (1996), 131–152

    1996

  3. [3]

    ByteDance. 2025. Doubao. https://o.doubao.com/

    2025

  4. [4]

    Chiyu Chen, Xinhao Song, Yunkai Chai, Yang Yao, Haodong Zhao, Lijun Li, Jie Li, Yan Teng, Gongshen Liu, and Yingchun Wang. 2025. GhostEI-Bench: Do Mobile Agents Resilience to Environmental Injection in Dynamic On-Device Environments?arXiv preprint arXiv:2510.20333(2025)

    arXiv 2025

  5. [5]

    Chaoran Chen, Zhiping Zhang, Bingcan Guo, Shang Ma, Ibrahim Khalilov, Sim- ret A Gebreegziabher, Yanfang Ye, Ziang Xiao, Yaxing Yao, Tianshi Li, et al

  6. [6]

    Qi Alfred Chen, Zhiyun Qian, and Z Morley Mao. 2014. Peeking into your app without actually seeing it:{UI} state inference and novel android attacks. In23rd USENIX Security Symposium (USENIX Security 14). 1037–1052

    2014

  7. [7]

    Yurun Chen, Xueyu Hu, Keting Yin, Juncheng Li, and Shengyu Zhang. 2025. Evaluating the Robustness of Multimodal Agents Against Active Environmental Injection Attacks. InProceedings of the 33rd ACM International Conference on Multimedia(Dublin, Ireland)(MM ’25). Association for Computing Machinery, New York, NY, USA, 11648–11656. doi:10.1145/3746027.3755646

    arXiv 2025

  8. [8]

    Yurun Chen, Xueyu Hu, Keting Yin, Juncheng Li, and Shengyu Zhang. 2025. Evaluating the robustness of multimodal agents against active environmental injection attacks. InProceedings of the 33rd ACM International Conference on Multimedia. 11648–11656

    2025

  9. [9]

    Xiangxiang Chu, Limeng Qiao, Xinyu Zhang, Shuang Xu, Fei Wei, Yang Yang, Xiaofei Sun, Yiming Hu, Xinyang Lin, Bo Zhang, et al. 2024. Mobilevlm v2: Faster and stronger baseline for vision language model.arXiv preprint arXiv:2402.03766 (2024)

    Pith/arXiv arXiv 2024

  10. [10]

    Drew Dean and Alan J Hu. 2004. Fixing races for fun and profit: how to use access (2).. InUSENIX security symposium. 195–206

    2004

  11. [11]

    Droidrun [n. d.]. Droidrun. https://github.com/droidrun/droidrun

  12. [12]

    Yanick Fratantonio, Chenxiong Qian, Simon P Chung, and Wenke Lee. 2017. Cloak and dagger: from two permissions to complete control of the UI feedback loop. In2017 IEEE Symposium on Security and Privacy (SP). IEEE, 1041–1057

    2017

  13. [13]

    Jingwen Fu, Xiaoyi Zhang, Yuwang Wang, Wenjun Zeng, and Nanning Zheng

  14. [14]

    Google. 2025. Android APIs. https://developer.android.com/reference

    2025

  15. [15]

    Google. 2025. Android back stack. https://developer.android.com/guide/ components/activities/tasks-and-back-stack

    2025

  16. [16]

    Google. 2025. Android permissions. https://developer.android.com/guide/topics/ permissions/overview

    2025

  17. [17]

    Google. 2025. Android Sandbox. https://source.android.com/docs/security/app- sandbox

    2025

  18. [18]

    Chenkai Guo, Tianhong Wang, Qianlu Wang, Naipeng Dong, Xiangyang Luo, and Zheli Liu. 2025. Fratricide! Hijacking in Android Multi-Window.IEEE Transactions on Dependable and Secure Computing(2025)

    2025

  19. [19]

    Wenyi Hong, Weihan Wang, Qingsong Lv, Jiazheng Xu, Wenmeng Yu, Junhui Ji, Yan Wang, Zihan Wang, Yuxiao Dong, Ming Ding, et al. 2024. Cogagent: A visual language model for gui agents. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 14281–14290

    2024

  20. [20]

    Honor. 2025. MagicOS. https://www.honor.com/cn/magic-os/

    2025

  21. [21]

    Hybrid-analysis [n. d.]. Hybrid-analysis. https://hybrid-analysis.com/

  22. [22]

    Wenjia Jiang, Yangyang Zhuang, Chenxi Song, Xu Yang, Joey Tianyi Zhou, and Chi Zhang. 2025. Appagentx: Evolving gui agents as proficient smartphone users. arXiv preprint arXiv:2503.02268(2025)

    Pith/arXiv arXiv 2025

  23. [23]

    Daniel Jones, Giorgio Severi, Martin Pouliot, Gary Lopez, Joris de Gruyter, Santi- ago Zanella-Beguelin, Justin Song, Blake Bullwinkel, Pamela Cortez, and Amanda Minnich. 2025. A Systematization of Security Vulnerabilities in Computer Use Agents.arXiv preprint arXiv:2507.05445(2025)

    Pith/arXiv arXiv 2025

  24. [24]

    Toby Jia-Jun Li, Amos Azaria, and Brad A Myers. 2017. SUGILITE: creating multimodal smartphone automation by demonstration. InProceedings of the 2017 CHI conference on human factors in computing systems. 6038–6049

    2017

  25. [25]

    Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. 2024. Eia: Environmental injection attack on generalist web agents for privacy leakage.arXiv preprint arXiv:2409.11295(2024)

    Pith/arXiv arXiv 2024

  26. [26]

    Derek Lilienthal and Sanghyun Hong. 2025. Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents.arXiv preprint arXiv:2508.17155(2025)

    Pith/arXiv arXiv 2025

  27. [27]

    Guohong Liu, Jialei Ye, Jiacheng Liu, Yuanchun Li, Wei Liu, Pengzhi Gao, Jian Luan, and Yunxin Liu. 2025. Hijacking jarvis: Benchmarking mobile gui agents against unprivileged third parties. InProceedings of the 2nd International Workshop on Edge and Mobile Foundation Models. 12–18

    2025

  28. [28]

    Xiao Liu, Bo Qin, Dongzhu Liang, Guang Dong, Hanyu Lai, Hanchen Zhang, Han- lin Zhao, Iat Long Iong, Jiadai Sun, Jiaqi Wang, et al. 2024. Autoglm: Autonomous foundation agents for guis.arXiv preprint arXiv:2411.00820(2024)

    Pith/arXiv arXiv 2024

  29. [29]

    Yijie Lu, Tianjie Ju, Manman Zhao, Xinbei Ma, Yuan Guo, and ZhuoSheng Zhang

  30. [30]

    Tongbo Luo, Xing Jin, Ajai Ananthanarayanan, and Wenliang Du. 2012. Touch- jacking attacks on web in android, ios, and windows phone. InInternational symposium on foundations and practice of security. Springer, 227–243

    2012

  31. [31]

    mobile-use [n. d.]. mobile-use. https://github.com/minitap-ai/mobile-use

  32. [32]

    arXiv preprint arXiv:2505.14289(2025)

    EVA: Red-Teaming GUI Agents via Evolving Indirect Prompt Injection. arXiv preprint arXiv:2505.14289(2025)

    Pith/arXiv arXiv 2025

  33. [33]

    Chuangang Ren, Yulong Zhang, Hui Xue, Tao Wei, and Peng Liu. 2015. Towards discovering and understanding task hijacking in android. In24th USENIX Security Symposium (USENIX Security 15). 945–959

    2015

  34. [34]

    Qiushi Sun, Mukai Li, Zhoumianze Liu, Zhihui Xie, Fangzhi Xu, Zhangyue Yin, Kanzhi Cheng, Zehao Li, Zichen Ding, Qi Liu, et al. 2025. Os-sentinel: Towards safety-enhanced mobile gui agents via hybrid validation in realistic workflows. arXiv preprint arXiv:2510.24411(2025)

    Pith/arXiv arXiv 2025

  35. [35]

    MobSF [n. d.]. mobSF. https://github.com/MobSF/Mobile-Security-Framework- MobSF

  36. [36]

    VirScan [n. d.]. VirScan. https://www.virscan.org/

  37. [37]

    virustotal [n. d.]. virustotal. https://www.virustotal.com/

  38. [38]

    Evgenii Vinarskii, Natalia Kushik, Nina Yevtushenko, Jorge López, and Djamal Zeghlache. 2023. Timed transition tour for race detection in distributed systems. In18th International Conference on Evaluation of Novel Approaches to Software Engineering (ENASE), Vol. 1. SCITEPRESS-Science and Technology Publications, 613–620

    2023

  39. [39]

    Xianbo Wang, Shangcheng Shi, Yikang Chen, and Wing Cheong Lau. 2022. PHY- jacking: Physical Input Hijacking for Zero-Permission Authorization Attacks on Android.. InNDSS

    2022

  40. [40]

    Zhun Wang, Vincent Siu, Zhe Ye, Tianneng Shi, Yuzhou Nie, Xuandong Zhao, Chenguang Wang, Wenbo Guo, and Dawn Song. 2025. AGENTVIGIL: Automatic Black-Box Red-teaming for Indirect Prompt Injection against LLM Agents. In Findings of the Association for Computational Linguistics: EMNLP 2025. 23159– 23172

    2025

  41. [41]

    Vivo. 2024. OriginOS. https://www.vivo.com.cn/originos

    2024

  42. [42]

    Hao Wen, Yuanchun Li, Guohong Liu, Shanhui Zhao, Tao Yu, Toby Jia-Jun Li, Shiqi Jiang, Yunhao Liu, Yaqin Zhang, and Yunxin Liu. 2024. Autodroid: Llm-powered task automation in android. InProceedings of the 30th Annual International Con- ference on Mobile Computing and Networking. 543–557

    2024

  43. [43]

    Liangxuan Wu, Chao Wang, Tianming Liu, Yanjie Zhao, and Haoyu Wang. 2025. From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents.arXiv preprint arXiv:2505.12981(2025)

    Pith/arXiv arXiv 2025

  44. [44]

    Jinpeng Wei and Calton Pu. 2005. TOCTTOU Vulnerabilities in UNIX-Style File Systems: An Anatomical Study.. InFAST, Vol. 5. 12–12

    2005

  45. [45]

    Zihe Yan and Zhuosheng Zhang. 2025. Lasm: Layer-wise scaling mechanism for defending pop-up attack on gui agents.arXiv preprint arXiv:2507.10610(2025)

    Pith/arXiv arXiv 2025

  46. [46]

    Pei Yang, Hai Ci, and Mike Zheng Shou. 2025. In-context defense in computer agents: An empirical study.arXiv preprint arXiv:2503.09241(2025)

    Pith/arXiv arXiv 2025

  47. [47]

    Yuxuan Yan, Zhenhua Li, Qi Alfred Chen, Christo Wilson, Tianyin Xu, Ennan Zhai, Yong Li, and Yunhao Liu. 2019. Understanding and detecting overlay-based android malware at market scales. InProceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services. 168–179

    2019

  48. [48]

    Cheng Zhang, Erhu Feng, Xi Zhao, Yisheng Zhao, Wangbo Gong, Jiahui Sun, Dong Du, Zhichao Hua, Yubin Xia, and Haibo Chen. 2025. MobiAgent: A Systematic Framework for Customizable Mobile Agents.arXiv preprint arXiv:2509.00531 (2025)

    Pith/arXiv arXiv 2025

  49. [49]

    Chi Zhang, Zhao Yang, Jiaxuan Liu, Yanda Li, Yucheng Han, Xin Chen, Zebiao Huang, Bin Fu, and Gang Yu. 2025. Appagent: Multimodal agents as smartphone users. InProceedings of the 2025 CHI Conference on Human Factors in Computing Systems. 1–20

    2025

  50. [50]

    Jiabo Ye, Xi Zhang, Haiyang Xu, Haowei Liu, Junyang Wang, Zhaoqing Zhu, Ziwei Zheng, Feiyu Gao, Junjie Cao, Zhengxi Lu, et al. 2025. Mobile-agent-v3: Fundamental agents for gui automation.arXiv preprint arXiv:2508.15144(2025)

    Pith/arXiv arXiv 2025

  51. [51]

    Li Zhang, Shihe Wang, Xianqing Jia, Zhihan Zheng, Yunhe Yan, Longxi Gao, Yuanchun Li, and Mengwei Xu. 2024. Llamatouch: A faithful and scalable testbed for mobile ui automation task evaluation.CoRR(2024)

    2024

  52. [52]

    Yanzhe Zhang, Tao Yu, and Diyi Yang. 2025. Attacking vision-language computer agents via pop-ups. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 8387–8401

    2025

  53. [53]

    Fuyao Zhang, Jiaming Zhang, Che Wang, Xiongtao Sun, Yurong Hao, Guowei Guan, Wenjie Li, Longtao Huang, and Wei Yang Bryan Lim. 2025. DualTAP: A Dual-Task Adversarial Protector for Mobile MLLM Agents.arXiv preprint arXiv:2511.13248(2025)

    arXiv 2025

  54. [56]

    Zhong Zhang, Yaxi Lu, Yikun Fu, Yupeng Huo, Shenzhi Yang, Yesai Wu, Han Si, Xin Cong, Haotian Chen, Yankai Lin, Jie Xie, Wei Zhou, Wang Xu, Yuan- heng Zhang, Zhou Su, Zhongwu Zhai, Xiaoming Liu, Yudong Mei, Jianming Xu, Hongyan Tian, Chongyi Wang, Chi Chen, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2025. AgentCPM-GUI: Building Mobile-Use Agents with Reinfor...

    2025

  55. [2024]

    Understanding mobile GUI: From pixel-words to screen-sentences.Neuro- computing601 (2024), 128200

    2024

  56. [2025]

    The Obvious Invisible Threat: LLM-Powered GUI Agents’ Vulnerability to Fine-Print Injections.arXiv preprint arXiv:2504.11281(2025)

    Pith/arXiv arXiv 2025