Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

Researchers published a preprint demonstrating seven attacks against five open-source Android mobile-agent frameworks (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, MobA) that let adversaries slip commands to AI agents and escalate them to host command execution via unsanitized adb input, screenshot TOCTOU races, invisible overlays, and broadcast/accessibility channels; the PoCs were highly effective in lab tests, affect widely used projects with insecure defaults, and the authors report limited or no coordinated disclosure response.