Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

Researchers discovered seven attacks against five open-source Android AI agent frameworks (AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA) that could let malicious apps trick the AI into running commands on a host PC. The attacks exploit weaknesses like invisible text overlays that AI vision models can read but humans cannot, file race conditions (timing gaps where attackers can modify screenshots before the AI sees them), and unsanitized shell commands that allow code injection when the AI types attacker-controlled text.