🟠 High | Source: The Hacker News
Researchers have demonstrated that malicious Android apps can embed invisible text instructions into the screen to manipulate AI agents controlling a mobile device — a technique known as indirect prompt injection. By exploiting common Android permissions such as drawing over windows and accessing shared storage, an attacker can chain these injections to execute arbitrary commands on the host PC driving the agent. The attack was validated across five open-source mobile agent frameworks, highlighting a systemic vulnerability in how AI agents process untrusted on-screen content.
Security Architect’s Take: If your organisation is piloting or deploying mobile AI agents — even in internal tooling or DevOps pipelines — treat any agent with Android device access as a high-risk execution boundary. Enforce strict sandboxing between the agent’s host environment and the Android device, apply least-privilege controls on shared storage, and do not allow agent frameworks to execute host-side commands without explicit human-in-the-loop approval.
Original advisory: Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs