An Invisible Text Makes the Phone's AI Agent Execute Commands on the PC

An Android app capable of drawing over other windows and writing in shared storage can pass instructions to the AI agent that drives the smartphone, in a text that no human eye will ever see. Just two additional steps enable the same app to execute commands on the PC that controls the agent.

This is the chain documented in a study published on arXiv on July 1 and revised on the 14th, authored by researchers from Simon Fraser University, Chinese University of Hong Kong, Shandong University, and the Xingtu Lab of the Chinese security company QAX; the lead author is Zidong Zhang. The authors describe and implement seven distinct attacks and test them against five open-source frameworks of mobile agents driven by vision-language models (VLM): AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA. Each yields to at least six of the seven. In several cases, a malicious app manages to hijack the agent's actions and achieve the execution of arbitrary commands without any privileged permissions, remaining indistinguishable to the user's eyes.

At its core, there are two attack surfaces that an agent adds compared to a regular app. The first exploits the difference between what a person sees and what the machine reads: an agent perceives the state of the phone through screenshots and decides actions by reasoning with a VLM; thus, anything that enters the pixels of the screenshot is, for it, a potential command. The second intercepts or manipulates the chain through which the agent executes actions.

Perception as an Attack Surface

The first test concerns text rendered almost transparent. All six visual models tested read text at 2% opacity in at least 18 out of 20 attempts, a level that researchers place below the threshold of human perception under normal viewing conditions. GPT-4o, Claude Opus 4.5, Gemini 3 Pro, and GLM-4V scored 20 out of 20; the weakest, AutoGLM-Phone with 9 billion parameters running on the device itself, stopped at 18. The numbers do not increase as the text becomes more visible simply because they already start at the maximum: it is only the human eye that has a "threshold" beyond which it can perceive the text.

There is another interesting detail: smartphones round the corners and cut out holes for cameras, but the frame buffer remains rectangular: the pixels drawn in those regions end up under the frame and still appear in every screenshot. On a Pixel 4, about 78 pixels of width remain hidden in one corner, sufficient for a short command, and all five agents read payloads placed right in that area.

A third attack gives up on stealth entirely: an accessibility service overlays a fake login screen on top of the real one and allows the agent to type the user's credentials into the fake form. A person might hesitate at an unexpected password request; none of the five agents did so in 100 trials.

From Debug Broadcast to Command on PC

The agents do not have an official channel to the phone, so they reuse debug channels, and it is from there that the group's least refined attack emerges. Open-AutoGLM encodes the text to be typed in base64 and sends it to ADB_INPUT_B64, an implicit broadcast collected by ADB Keyboard, a testing automation tool designed to accept text from anyone who transmits it. This is its stated purpose and is still maintained. Any app registering the same action receives the same payload, and doing so requires no permission: nothing warns the user.

The partial defenses of the other frameworks are insufficient. Mobile-Agent-v3 maintains a list of allowed characters and routes anything outside of that, i.e., any non-ASCII character, to the broadcast one at a time. MobA is more coarse: its typing feature checks the entire string with text.isascii(), so a single emoji or accented letter is enough to send the entire message over the broadcast channel at once. Where the attacker has access, the event TYPE_VIEW_TEXT_CHANGED delivers the same plain text, including password fields, against all five.

The chain's end is the escalation to the PC, and this is the technically simplest part. AppAgent's controller executes subprocess.run(adb_command, shell=True) and builds the input by stuffing the model's output directly into adb shell input text. The published code does little: it removes spaces and single quotes but leaves intact other shell metacharacters, including semicolons. A string that the model reads from the screen and diligently types is thus broken by the host shell, and the second half runs on the operator's Windows machine. A payload designed to launch calc.exe did so in 20 out of 20 trials against four frameworks; a complete test on AppAgent used test;pwd>rce_success to write the host's working directory to a file.

To bring that string before the model, a time window is exploited. Several agents save the screenshot in /sdcard and then reread it in a second pass, and the interval between writing and reading, measured by researchers between 50 and 500 milliseconds and averaging around 210, is enough for a background service that checks every 5-10 milliseconds to pick up the file, rewrite the image, and release it before the agent collects it. The manipulation succeeded 19 to 20 times against four of the five frameworks.

Real Preconditions and No One to Report to

For the attack to succeed, certain conditions are necessary: an app must already be installed, an agent must be actively engaged in a task, and USB or wireless debugging must be enabled. The affected software is open-source instrumentation for developers, not the integrated assistant in a commercial smartphone. First-party agents like Samsung's Bixby and Xiaomi's XiaoAi are outside the study, as is iOS. Zhang adds a single clarification: several attacks require minimal Android permissions, and one does not require any, lowering the barrier for a motivated attacker.

A variant does not even need a malicious app. Since a payload can travel in the chrominance channels of an image rather than in the brightness, an attacker who never touches the device could hide it in a photo and let the victim’s agent capture it with a screenshot from a messaging app. The researchers present it as an extension, not as a result, but it remains the only version without any installation steps.

Fixes exist, and none require touching the model: passing arguments as lists instead of concatenating them, streaming screenshots without ever writing them to file, protecting the input broadcast with a signature-level permission. Two of the five projects already implement one each; none both. The obvious defense, a confirmation prompt on sensitive actions, proves inadequate: perception attacks rewrite the judgment with which the model decides if an action is sensitive, and against the broadcast there is nothing to confirm because the text has already left. Regarding the corners and cutouts of the screen, the authors clearly explain that there is currently no simple and effective software solution.

None of this has a CVE assigned, and Zhang states that the team has no evidence of the techniques being used outside a controlled environment. The vector of overlapping windows is not entirely novel, having already been tackled in 2025 research; the original element of this work is the end of the chain, from screen to file to host. The team privately wrote to maintainers before publishing the preprint, receiving no response, and as of mid-July the vulnerable paths remained on the main branches of the five projects.