Pith. sign in

REVIEW 5 major objections 5 minor 3 cited by

From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read All nine mobile AI agents tested are vulnerable to targeted attacks.

desk verdict First systematic security taxonomy for mobile LLM agents, with a credible demonstration that all nine tested agents are vulnerable; sampling limits the ecosystem-wide inference, but the paper mostly scopes its claims and deserves a serious referee. read the letter →

arxiv 2505.12981 v2 pith:AKZ4YIQM submitted 2025-05-19 cs.CR cs.AIcs.HC

Liangxuan Wu , Chao Wang , Tianming Liu , Yanjie Zhao , Haoyu Wang This is my paper · ORCID
classification cs.CRcs.AIcs.HC
keywords mobileLLMagentssecurityanalysispromptinjectionUImanipulationtransparentoverlayattacksAndroidattacktaxonomyAgentScan
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is trying to establish that today's mobile LLM agents—the on-device assistants that turn natural-language requests into UI actions—are broadly and systematically unprotected against adversaries who control an installed app. It decomposes agent behavior into three layers (language reasoning, GUI interaction, and system execution), enumerates 11 attack surfaces spanning those layers, and builds a semi-automated test framework, AgentScan, to probe them. Running AgentScan against nine widely deployed agents, it finds that every agent succumbs to at least one targeted attack and that the average agent is vulnerable to 6.3 of the 11 vectors; UI-layer attacks such as transparent overlays and pop-up interference succeed against most agents and can redirect clicks, alter behavior, leak data, or hijack execution entirely. The stakes are concrete: if true, a benign-looking app could quietly turn a user's trusted assistant into an adversary.

What carries the argument

The load-bearing mechanism is the three-layer abstraction of agent operation—LLM reasoning, GUI perception and interaction, and system-level execution—together with AgentScan, a client-server framework that emulates adversarial conditions by pushing crafted APKs and overlays onto a device over ADB and observing the agent under 44 adapted real-world tasks. The taxonomy maps each attack to the workflow stage it subverts: for example, malicious instructions and glitch tokens poison the model's reasoning, transparent overlays and pop-ups deceive coordinate-based clicks, deeplink forgery hijacks the app launcher, and log leakage exposes the data pipeline. This combination lets the paper attribute observed failures to specific workflow stages and supports its claim that the vulnerabilities are structural rather than incidental.

What would settle it

An agent that revalidates the screen—comparing the view hierarchy and a fresh screenshot immediately before each tap and refusing to act on unrecognized targets—should score 0/10 against transparent-overlay and pop-up interference in AgentScan's tests; observing such an agent would contradict the paper's universality claim. Equivalently, testing a broader, independently sampled set of agents and finding several with no confirmed vectors would undercut the ecosystem-wide conclusion.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central discovery is that the unique capabilities that make mobile LLM agents useful—parsing screenshots, following natural-language instructions, and launching apps with system intents—are also the channels through which they can be subverted. The authors define a taxonomy of 11 attack vectors across three dimensions: malicious instructions and glitch tokens at the LLM layer; image forgery, viewtree interference, prompt injection via display, transparent overlays, and pop-up interference at the GUI layer; and package-name forgery, deeplink forgery, and log leakage at the system layer. Using AgentScan against nine representative agents spanning OEM assistants, third-party universal agents, and PC-connected agent frameworks, they report that all nine are vulnerable to targeted attacks, with the worst case exposing eight of eleven vectors and an average exposure of 6.3. They also demonstrate a chained three-stage attack against Mobile-Agent-v2 in which a transparent overlay, an on-screen prompt injection, and a malicious instruction combine to extract a bank-card password from agent memory, showing that individual weaknesses compose into end-to-end compromise.

Load-bearing premise

The sweeping conclusion that all mobile LLM agents are vulnerable rests on the assumption that the nine selected agents represent the wider population of mobile LLM agents, and that an installed app with overlay permissions is a realistic attacker.

Editorial extensions

If this is right

  • If the results generalize, any mobile agent that executes coordinate-based taps without revalidating the screen immediately before the action can be redirected by transparent overlays or pop-ups.
  • Agents that rely on view hierarchies for element localization inherit Android's UI-metadata weaknesses; agents that rely purely on vision avoid those but fall to image forgery and on-screen prompt injection, so no tested perception strategy was secure by itself.
  • System-level OEM agents resist prompt-based attacks through logic-oriented planning, yet all four still fall to package-name forgery and deeplink forgery, showing that rigid workflows do not eliminate system-layer risk.
  • The demonstrated composite attack implies that combining a UI-layer hijack with a language-layer instruction can turn the agent itself into the data exfiltrator, including data the user never asked it to send.
  • The mitigation experiment on Mobile-Agent-v2 shows that linking actions to viewtree and screen validation reduces several attack success rates to zero or near-zero, but prompt injection via display and glitch tokens still succeed in some trials, so defensive fixes are partial.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • We infer that any mobile agent that treats all visible text as context for its LLM will remain vulnerable to on-screen prompt injection until it distinguishes instruction content from display content; the paper's own partial mitigation supports this.
  • We infer that the same structural weaknesses will appear in adjacent platforms—desktop or wearable OS agents—whenever they reason over screen pixels and act through privileged input, because the attack surface is defined by the workflow, not by Android alone.
  • A testable extension of the paper's framework would be to benchmark an agent that screenshots and parses the view hierarchy immediately before every click, predicting that transparent-overlay and pop-up attacks drop to 0/10; this would isolate the precise fix.
  • The results also suggest OS-level hardening: restricting or visibly marking SYSTEM_ALERT_WINDOW overlays during agent execution could neutralize an entire class of attacks without requiring agent-level changes.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper presents a security analysis of mobile LLM agents across three categories: OEM system-level agents, third-party universal agents, and emerging agent frameworks. It decomposes the agent workflow into five stages, defines three threat dimensions (LLM, GUI, and System), and proposes an 11-item attack taxonomy. The authors implement AgentScan, a semi-automated testing framework, and evaluate nine agents: five named academic frameworks and four anonymized commercial agents. The empirical results in Table II show that every tested agent is vulnerable to at least four attack vectors; GUI-layer attacks such as Transparent Overlay and Pop-up Interference succeed against 7 of 9 agents, and the most affected agent (AppAgent) is vulnerable to 8 of 11 vectors. The paper also demonstrates a composite attack that chains transparent overlay, prompt injection, and malicious instructions to extract a bank card password from agent memory, and it proposes mitigation strategies with a before/after evaluation on Mobile-Agent-v2.

Significance. If the findings are accepted, this is the first systematic security evaluation of mobile LLM agents and a useful reusable testing framework. The taxonomy is clearly structured, and the 10-trial protocol for the LLM/GUI attacks strengthens the core observation that current agent implementations lack basic defenses against UI manipulation and intent hijacking. The composite attack is a compelling end-to-end demonstration of impact. The main value is empirical: it should push agent developers to add screen-state validation, signature checks, and output sanitization. However, the paper's prevalence claims extend beyond the nine-agent sample, and the system-layer experiments are reported with considerably less rigor than the GUI/LLM experiments. The framework is said to be released publicly, though no repository link or artifact details are given, which limits immediate reproducibility.

major comments (5)
  1. [Section I, Section VI-B, Table II] The Introduction states that "UI manipulation attacks are universally effective—every tested agent fails to defend against Transparent Overlay and Pop-up Interference attacks." This is contradicted by Table II: Agent-A resists both Transparent Overlay and Pop-up Interference, Agent-B resists Transparent Overlay, and Agent-D resists Pop-up Interference in both of its modes. The accurate statement is that these attacks succeeded against 7 of 9 agents. Please correct this overclaim and align the abstract and conclusion with the actual counts, particularly if the abstract's "every agent is vulnerable" is meant as an ecosystem-wide statement.
  2. [Section VI-A, Section VII-A, Abstract] The headline claim is scoped by the evaluation set. Section VI-A states that the nine agents are "representative and diverse" but provides no enumeration of the population of mobile LLM agents, no inclusion criteria, and no sampling strategy. Section VII-A concedes that the tested agents "may not fully reflect the diversity of real-world agents or dynamic environments" and that this "limits the generalizability of the findings." The abstract and conclusion should therefore say "all nine tested agents" rather than "every agent" unless the authors add a systematic sampling justification.
  3. [Section V-D, Table II] System-layer attack results are reported only as binary success/failure symbols without trial counts. Section V-D1 says forged versions were created for three apps, Section V-D2 says two deeplink scenarios were implemented, and Section V-D3 says logs were monitored continuously, but no success criterion is given (e.g., what fraction of launch attempts resolved to the malicious package) and no number of repetitions is reported. This is inconsistent with the x/10 protocol used for the LLM/GUI attacks and is insufficient to support the claim that Package Name Forgery and Deeplink Forgery "exclusively affected" all four system-level agents. Add per-scenario trial counts and explicit definitions of success.
  4. [Section VI-A, Section V-C] The description of model standardization is ambiguous. The text says "all decision-making tasks were powered by GPT-4o" after stating that system-level agents were tested on commercial flagship devices. If the OEM agents run their own proprietary backends, then the comparison between system-level agents and frameworks is confounded by backend model choice; if they were forced to use GPT-4o, the procedure is not described. Clarify which agents used GPT-4o and how, and discuss how this affects the interpretation of the system-level agents' immunity to the LLM-layer attacks.
  5. [Section V-B, Table II] The success rate for Malicious Instructions is reported as a fraction of 10, but the paper does not define the success criterion beyond "the agent follows these instructions without additional user confirmation." It is unclear whether partial completion, an attempted action that is blocked by the OS, or a refusal followed by compliance after a nudge counts as success. Provide a coding rubric or examples of borderline cases so that the reported 5/10 to 9/10 figures are reproducible.
minor comments (5)
  1. [Section IV-A1] The cross-references to "LLM layer (§ III-C), GUI layer (§ III-B), and System layer (§ III-D)" point to workflow stages, not to the attack-layer definitions; the taxonomy is actually introduced in Section IV-A. Update these cross-references.
  2. [Table II] Agent-D appears as two separate columns ("Vision-Based" and "Structure-Based"), which makes statements such as "7 out of 9 agents" visually ambiguous. State explicitly how the two modes are counted in the per-agent average, or present a single aggregate column.
  3. [Table II caption] The caption defines "!", "✗", and "-" but does not explain that "!" for system-layer attacks is a confirmed success without a rate. If trial counts are added as recommended in the major comments, the caption should describe how they are reported.
  4. [Section VI-B] The text refers to "Autodroid and Droid-GPT" while the table and related work use "AutoDroid" and "DroidBot-GPT." Please standardize the naming throughout.
  5. [Section VII-B] The mitigation results in Table IV are reported for a single agent (Mobile-Agent-v2) without confidence intervals or repeated runs. Given the large claimed improvements, this should be described as a proof-of-concept rather than a validated mitigation strategy.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the 11 attack surfaces are empirically evaluated against real agents, and no fitted parameter or self-cited derivation is used to force the reported vulnerabilities.

full rationale

This paper is an empirical security evaluation rather than a derivation whose conclusions are built into its inputs. The 11 attack surfaces are identified by combining the agent workflow abstractions in Section III with established threat classes from the cited literature, and then AgentScan applies those attacks to real, independently deployed agents. The vulnerabilities in Table II are observed behaviors (e.g., transparent overlay redirecting a tap to a confirmation page), not quantities that the framework defines into existence by construction. No parameter is fitted to a subset and then renamed as a prediction, and no conclusion is justified by citing this paper's own prior work as the sole evidence for the central claim. The glitch-token scenario is replicated from the authors' earlier work [41], and one system-layer reference [53] shares an author, but these citations are supporting background for specific attack vectors rather than load-bearing steps that force the paper's main conclusion. The paper's own Limitations section (Section VII-A) concedes that the nine agents 'may not fully reflect the diversity of real-world agents or dynamic environments,' which is a scoping and generalizability caveat, not a circularity. The assessment that 'every agent is vulnerable to targeted attacks' is an inductive empirical claim about the tested set, with the sample-representativeness concern belonging to correctness risk rather than circularity. Therefore no circular step can be quoted or reduced to an equation or fitted-input equivalence.

Assumptions & free parameters 0 free parameters · 5 assumptions · 0 invented entities

No new physical or conceptual entities are postulated. AgentScan is a software framework, and the attack names are labels for known categories; the 'Poisoned CoT, Task Interruption, Activity Hijacking, Privacy Leakage' are impact categories, not invented entities.

assumptions (5)
  • domain assumption Attacker controls a benign-looking third-party app installed on the victim device, with SYSTEM_ALERT_WINDOW permission.
    Section II-B threat model; this is the assumed attacker capability that enables overlay and UI manipulation attacks.
  • domain assumption The nine selected agents are representative of the mobile LLM agent ecosystem.
    Section VI-A states the selection is representative; the prevalence claim depends on this.
  • domain assumption The generalized workflow in Figure 2 accurately abstracts the operation of all nine agents.
    Section III derives the workflow from reverse engineering; the taxonomy is built on this abstraction.
  • domain assumption Using GPT-4o as the backend for agent frameworks isolates the agent implementation as the cause of observed differences.
    Section VI-A standardizes reasoning to attribute variation to the agents; the paper acknowledges in Section VII-A that different LLMs may produce different results.
  • domain assumption Ten distinct tasks per attack provide a sufficient sample to assess an agent's vulnerability to that attack.
    Section VI-B reports x/10 outcomes; the choice of ten is arbitrary and not statistically justified.

how reviews work

0 comments
Cite this review

Pith. "Pith review of From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents." pith.science (2026). https://pith.science/paper/AKZ4YIQM

@misc{pith2026250512981,
  author       = {Pith},
  title        = {Pith review of: From Assistants to Adversaries: Exploring the Security Risks of Mobile LLM Agents},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AKZ4YIQM}},
  note         = {Machine review of arXiv:2505.12981}
}
read the original abstract

The growing adoption of large language models (LLMs) has led to a new paradigm in mobile computing--LLM-powered mobile AI agents--capable of decomposing and automating complex tasks directly on smartphones. However, the security implications of these agents remain largely unexplored. In this paper, we present the first comprehensive security analysis of mobile LLM agents, encompassing three representative categories: System-level AI Agents developed by original equipment manufacturers (e.g., YOYO Assistant), Third-party Universal Agents (e.g., Zhipu AI AutoGLM), and Emerging Agent Frameworks (e.g., Alibaba Mobile Agent). We begin by analyzing the general workflow of mobile agents and identifying security threats across three core capability dimensions: language-based reasoning, GUI-based interaction, and system-level execution. Our analysis reveals 11 distinct attack surfaces, all rooted in the unique capabilities and interaction patterns of mobile LLM agents, and spanning their entire operational lifecycle. To investigate these threats in practice, we introduce AgentScan, a semi-automated security analysis framework that systematically evaluates mobile LLM agents across all 11 attack scenarios. Applying AgentScan to nine widely deployed agents, we uncover a concerning trend: every agent is vulnerable to targeted attacks. In the most severe cases, agents exhibit vulnerabilities across eight distinct attack vectors. These attacks can cause behavioral deviations, privacy leakage, or even full execution hijacking. Based on these findings, we propose a set of defensive design principles and practical recommendations for building secure mobile LLM agents. Our disclosures have received positive feedback from two major device vendors. Overall, this work highlights the urgent need for standardized security practices in the fast-evolving landscape of LLM-driven mobile automation.

Figures

Figures reproduced from arXiv: 2505.12981 by the authors.

Figure 1
Figure 1. An example of an Agent performing the task of “Send a WeChat message to John to inform him to arrive on [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Workflow of LLM-powered Mobile Agents. This workflow is fundamentally enabled by three core capabil￾ities: (1) Language understanding and reasoning, powered by LLMs, which allows the agent to interpret user intent and decompose high-level instructions; (2) User interface interaction, enabled by screen parsing and GUI manipulation techniques, through which the agent perceives and operates on visual elements; (3) Syst… view at source ↗
Figure 3
Figure 3. The workflow of AgentScan. architecture of our testing framework in § V-A, followed by the Language-Based Reasoning Attack Design in § V-B, GUI￾Based Interaction Attack Design in § V-C, and the System Capability Attack Design in § V-D. A. Overview AgentScan is built on a client-server architecture, as illustrated in [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: (a) Image Forgery for UI Elements attack: Left—spoofing a social app’s “Send” button; Right—spoofing a [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: An example of Composite Attack: Extraction of a [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Mind the Gap: Action Rebinding Attacks against Android GUI Agents

    cs.CR 2026-01 conditional novelty 6.0 of 10

    A zero-permission Android app can redirect a GUI agent's planned tap to a different app by switching the foreground during the agent's reasoning delay.

  2. Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels

    cs.CR 2025-10 conditional novelty 6.0 of 10

    Indirect prompt injection through ads, webviews, and notifications reliably diverts mobile LLM agents into leaking data and installing malware across eight evaluated agents.

  3. SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agents

    cs.AI 2025-07 conditional novelty 6.0 of 10

    A history-aware guard model with an LLM judge is reported to cut jailbreak success on mobile agent tasks from 86.1% to 8.4% while keeping task completion unchanged at 77.8%.

Reference graph

Works this paper leans on

71 extracted references · 35 canonical work pages · cited by 3 Pith papers

  1. [1]

    Large language models for software engi- neering: A systematic literature review,

    X. Hou, Y . Zhao, Y . Liu, Z. Yang, K. Wang, L. Li, X. Luo, D. Lo, J. Grundy, and H. Wang, “Large language models for software engi- neering: A systematic literature review,” ACM Transactions on Software Engineering and Methodology , vol. 33, no. 8, pp. 1–79, 2024

    2024

  2. [2]

    Gui agents with foundation models: A comprehensive survey,

    S. Wang, W. Liu, J. Chen, Y . Zhou, W. Gan, X. Zeng, Y . Che, S. Yu, X. Hao, K. Shao et al. , “Gui agents with foundation models: A comprehensive survey,” arXiv preprint arXiv:2411.04890 , 2024

    arXiv 2024

  3. [3]

    Large language model-brained gui agents: A survey,

    C. Zhang, S. He, J. Qian, B. Li, L. Li, S. Qin, Y . Kang, M. Ma, G. Liu, Q. Lin et al. , “Large language model-brained gui agents: A survey,” arXiv preprint arXiv:2411.18279 , 2024

    arXiv 2024

  4. [4]

    Foundations and recent trends in multimodal mobile agents: A survey,

    B. Wu, Y . Li, M. Fang, Z. Song, Z. Zhang, Y . Wei, and L. Chen, “Foundations and recent trends in multimodal mobile agents: A survey,” arXiv preprint arXiv:2411.02006 , 2024

    arXiv 2024

  5. [5]

    Ai agents vs. ai assistants,

    IBM, “Ai agents vs. ai assistants,” https://www .ibm.com/think/topics/ai- agents-vs-ai-assistants, 2025

    work page 2025

  6. [6]

    Agentic ai is revolutionizing business and daily life,

    BizTech, “Agentic ai is revolutionizing business and daily life,” https://biztechmagazine.com/article/2025/02/agentic-ai-revolutionizing- business-perfcon, 2025

    work page 2025

  7. [7]

    6 ai trends you’ll see more of in 2025,

    Microsoft, “6 ai trends you’ll see more of in 2025,” https://news.microsoft.com/source/features/ai/6-ai-trends-youll-see- more-of-in-2025/, 2024

    work page 2025

  8. [8]

    MagicOS,

    Honor, “MagicOS,” 2025, https://www .honor.com/cn/magic-os/

    work page 2025

Show all 71 references
  1. [9]

    Autoglm: Autonomous foundation agents for guis,

    X. Liu, B. Qin, D. Liang, G. Dong, H. Lai, H. Zhang, H. Zhao, I. L. Iong, J. Sun, J. Wang et al., “Autoglm: Autonomous foundation agents for guis,” arXiv preprint arXiv:2411.00820 , 2024

    2024 arXiv

  2. [10]

    This android skin has an ai that can order coffee and manage subscriptions,

    androidauthority, “This android skin has an ai that can order coffee and manage subscriptions,” https://www .androidauthority.com/honor- magic-os-9-0-ai-agent-3493067/, 2024

    2024

  3. [11]

    What is an ai agent?

    G. Cloud, “What is an ai agent?” https://cloud .google.com/discover/ what-are-ai-agents, 2025

    2025

  4. [12]

    Trial and error: Exploration-based trajectory optimization for llm agents,

    Y . Song, D. Yin, X. Yue, J. Huang, S. Li, and B. Y . Lin, “Trial and error: Exploration-based trajectory optimization for llm agents,” arXiv preprint arXiv:2403.02502, 2024

    2024 arXiv

  5. [13]

    When llms go online: The emerging threat of web-enabled llms,

    H. Kim, M. Song, S. H. Na, S. Shin, and K. Lee, “When llms go online: The emerging threat of web-enabled llms,” arXiv preprint arXiv:2410.14569, 2024

    2024 arXiv

  6. [14]

    Wipi: A new web threat for llm- driven web agents,

    F. Wu, S. Wu, Y . Cao, and C. Xiao, “Wipi: A new web threat for llm- driven web agents,” arXiv preprint arXiv:2402.16965 , 2024

    2024 arXiv

  7. [15]

    Watch out for your agents! investigating backdoor threats to llm-based agents,

    W. Yang, X. Bi, Y . Lin, S. Chen, J. Zhou, and X. Sun, “Watch out for your agents! investigating backdoor threats to llm-based agents,” arXiv preprint arXiv:2402.11208, 2024

    2024 arXiv

  8. [16]

    Eia: Environmental injection attack on generalist web agents for privacy leakage,

    Z. Liao, L. Mo, C. Xu, M. Kang, J. Zhang, C. Xiao, Y . Tian, B. Li, and H. Sun, “Eia: Environmental injection attack on generalist web agents for privacy leakage,” arXiv preprint arXiv:2409.11295 , 2024

    2024 arXiv

  9. [17]

    Advweb: Controllable black-box attacks on vlm-powered web agents,

    C. Xu, M. Kang, J. Zhang, Z. Liao, L. Mo, M. Yuan, H. Sun, and B. Li, “Advweb: Controllable black-box attacks on vlm-powered web agents,” arXiv preprint arXiv:2410.17401 , 2024

    2024 arXiv

  10. [18]

    Towards action hijacking of large language model-based agent,

    Y . Zhang, K. Chen, X. Jiang, Y . Sun, R. Wang, and L. Wang, “Towards action hijacking of large language model-based agent,” arXiv preprint arXiv:2412.10807, 2024

    2024 arXiv

  11. [19]

    Translating natural language to planning goals with large-language models,

    Y . Xie, C. Yu, T. Zhu, J. Bai, Z. Gong, and H. Soh, “Translating natural language to planning goals with large-language models,” arXiv preprint arXiv:2302.05128, 2023

    2023 arXiv

  12. [20]

    Large language models versus natural language understand- ing and generation,

    N. Karanikolas, E. Manga, N. Samaridi, E. Tousidou, and M. Vassi- lakopoulos, “Large language models versus natural language understand- ing and generation,” in Proceedings of the 27th Pan-Hellenic Conference on Progress in Computing and Informatics , 2023, pp. 278–290

    2023

  13. [21]

    Droidbot: a lightweight ui-guided test input generator for android,

    Y . Li, Z. Yang, Y . Guo, and X. Chen, “Droidbot: a lightweight ui-guided test input generator for android,” in 2017 IEEE/ACM 39th International Conference on Software Engineering Companion (ICSE-C) . IEEE, 2017, pp. 23–26

    2017

  14. [22]

    “appium,” 2025, https://appium .io/

    2025

  15. [23]

    Create your own accessibility service,

    “Create your own accessibility service,” 2024, https: //developer.android.com/guide/topics/ui/accessibility/service

    2024

  16. [24]

    OriginOS,

    vivo, “OriginOS,” 2024, https://www .vivo.com.cn/originos

    2024

  17. [25]

    Android API reference,

    “Android API reference,” 2024, https://developer .android.com/reference

    2024

  18. [26]

    Mobile-agent: Autonomous multi-modal mobile device agent with visual perception,

    J. Wang, H. Xu, J. Ye, M. Yan, W. Shen, J. Zhang, F. Huang, and J. Sang, “Mobile-agent: Autonomous multi-modal mobile device agent with visual perception,” arXiv preprint arXiv:2401.16158 , 2024

    2024 arXiv

  19. [27]

    Mobile-agent-v2: Mobile device operation assistant with effective navigation via multi-agent collaboration,

    J. Wang, H. Xu, H. Jia, X. Zhang, M. Yan, W. Shen, J. Zhang, F. Huang, and J. Sang, “Mobile-agent-v2: Mobile device operation assistant with effective navigation via multi-agent collaboration,” arXiv preprint arXiv:2406.01014, 2024

    2024 arXiv

  20. [28]

    Appagent: Multimodal agents as smartphone users,

    C. Zhang, Z. Yang, J. Liu, Y . Han, X. Chen, Z. Huang, B. Fu, and G. Yu, “Appagent: Multimodal agents as smartphone users,” arXiv preprint arXiv:2312.13771, 2023

    2023 arXiv

  21. [29]

    Autodroid: Llm-powered task automation in android,

    H. Wen, Y . Li, G. Liu, S. Zhao, T. Yu, T. J.-J. Li, S. Jiang, Y . Liu, Y . Zhang, and Y . Liu, “Autodroid: Llm-powered task automation in android,” in Proceedings of the 30th Annual International Conference on Mobile Computing and Networking , 2024, pp. 543–557

    2024

  22. [30]

    Droidbot-gpt: Gpt-powered ui automation for android,

    H. Wen, H. Wang, J. Liu, and Y . Li, “Droidbot-gpt: Gpt-powered ui automation for android,” arXiv preprint arXiv:2304.07061 , 2023

    2023 arXiv

  23. [31]

    Grounding dino: Marrying dino with grounded pre-training for open-set object detection,

    S. Liu, Z. Zeng, T. Ren, F. Li, H. Zhang, J. Yang, Q. Jiang, C. Li, J. Yang, H. Su et al. , “Grounding dino: Marrying dino with grounded pre-training for open-set object detection,” in European Conference on Computer Vision. Springer, 2025, pp. 38–55

    2025

  24. [32]

    Write automated tests with UI Automator,

    “Write automated tests with UI Automator,” 2024, https:// developer.android.com/training/testing/other-components/ui-automator

    2024

  25. [33]

    Android Debug Bridge (adb) ,

    “Android Debug Bridge (adb) ,” 2024, https://developer .android.com/ tools/adb

    2024

  26. [34]

    Optimization-based prompt injection attack to llm-as-a-judge,

    J. Shi, Z. Yuan, Y . Liu, Y . Huang, P. Zhou, L. Sun, and N. Z. Gong, “Optimization-based prompt injection attack to llm-as-a-judge,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 660–674

    2024

  27. [35]

    Formalizing and benchmarking prompt injection attacks and defenses,

    Y . Liu, Y . Jia, R. Geng, J. Jia, and N. Z. Gong, “Formalizing and benchmarking prompt injection attacks and defenses,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 1831–1847

    2024

  28. [36]

    ” do anything now

    X. Shen, Z. Chen, M. Backes, Y . Shen, and Y . Zhang, “” do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models,” in Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , 2024, pp. 1671–1685

    2024

  29. [37]

    {LLM-Fuzzer}: Scaling assessment of large language model jailbreaks,

    J. Yu, X. Lin, Z. Yu, and X. Xing, “ {LLM-Fuzzer}: Scaling assessment of large language model jailbreaks,” in 33rd USENIX Security Sympo- sium (USENIX Security 24) , 2024, pp. 4657–4674

    2024

  30. [38]

    Don’t listen to me: understanding and exploring jailbreak prompts of large language models,

    Z. Yu, X. Liu, S. Liang, Z. Cameron, C. Xiao, and N. Zhang, “Don’t listen to me: understanding and exploring jailbreak prompts of large language models,” in 33rd USENIX Security Symposium (USENIX Security 24), 2024, pp. 4675–4692

    2024

  31. [39]

    An {LLM-Assisted}{Easy-to-Trigger} backdoor attack on code completion models: Injecting disguised vulnerabilities against strong detection,

    S. Yan, S. Wang, Y . Duan, H. Hong, K. Lee, D. Kim, and Y . Hong, “An {LLM-Assisted}{Easy-to-Trigger} backdoor attack on code completion models: Injecting disguised vulnerabilities against strong detection,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 1795–1812

    2024

  32. [40]

    Instruction backdoor attacks against customized {LLMs},

    R. Zhang, H. Li, R. Wen, W. Jiang, Y . Zhang, M. Backes, Y . Shen, and Y . Zhang, “Instruction backdoor attacks against customized {LLMs},” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 1849–1866

    2024

  33. [41]

    Glitch tokens in large language models: Categorization taxonomy and effective detection,

    Y . Li, Y . Liu, G. Deng, Y . Zhang, W. Song, L. Shi, K. Wang, Y . Li, Y . Liu, and H. Wang, “Glitch tokens in large language models: Categorization taxonomy and effective detection,” Proceedings of the ACM on Software Engineering , vol. 1, no. FSE, pp. 2075–2097, 2024

    2024

  34. [42]

    Glitchprober: Advancing effective detection and mitigation of glitch tokens in large language models,

    Z. Zhang, W. Bai, Y . Li, M. H. Meng, K. Wang, L. Shi, L. Li, J. Wang, and H. Wang, “Glitchprober: Advancing effective detection and mitigation of glitch tokens in large language models,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engine...

    2024

  35. [43]

    Ui obfuscation and its effects on automated ui analysis for android apps,

    H. Zhou, T. Chen, H. Wang, L. Yu, X. Luo, T. Wang, and W. Zhang, “Ui obfuscation and its effects on automated ui analysis for android apps,” in Proceedings of the 35th IEEE/ACM International Conference on Automated Software Engineering , 2020, pp. 199–210

    2020

  36. [44]

    Detecting mobile application spoofing attacks by leveraging user visual similarity perception,

    L. Malisa, K. Kostiainen, and S. Capkun, “Detecting mobile application spoofing attacks by leveraging user visual similarity perception,” in Proceedings of the Seventh ACM on Conference on Data and Application Security and Privacy , 2017, pp. 289–300

    2017

  37. [45]

    Android ui deception revisited: Attacks and defenses,

    E. Fernandes, Q. A. Chen, J. Paupore, G. Essl, J. A. Halderman, Z. M. Mao, and A. Prakash, “Android ui deception revisited: Attacks and defenses,” in Financial Cryptography and Data Security: 20th International Conference, FC 2016, Christ Church, Barbados, February 22–26, 2016...

    2016

  38. [46]

    Android ui deception revisited: Attacks and defenses,

    ——, “Android ui deception revisited: Attacks and defenses,” in Finan- cial Cryptography and Data Security: 20th International Conference, FC 2016, Christ Church, Barbados, February 22–26, 2016, Revised Selected Papers 20. Springer, 2017, pp. 41–59

    2016

  39. [47]

    Trapped by the ui: The android case,

    E. Alepis and C. Patsakis, “Trapped by the ui: The android case,” in Research in Attacks, Intrusions, and Defenses: 20th International Symposium, RAID 2017, Atlanta, GA, USA, September 18–20, 2017, Proceedings. Springer, 2017, pp. 334–354

    2017

  40. [48]

    Understanding and detecting overlay-based android malware at market scales,

    Y . Yan, Z. Li, Q. A. Chen, C. Wilson, T. Xu, E. Zhai, Y . Li, and Y . Liu, “Understanding and detecting overlay-based android malware at market scales,” in Proceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services , 2019, pp. 168–179

    2019

  41. [49]

    Uncovering intent based leak of sensitive data in android framework,

    H. Zhou, X. Luo, H. Wang, and H. Cai, “Uncovering intent based leak of sensitive data in android framework,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security , 2022, pp. 3239–3252

    2022

  42. [50]

    Improving android ap- plication security for intent based attacks,

    B. Khadiranaikar, P. Zavarsky, and Y . Malik, “Improving android ap- plication security for intent based attacks,” in 2017 8th IEEE Annual Information Technology, Electronics and Mobile Communication Con- ference (IEMCON). IEEE, 2017, pp. 62–67

    2017

  43. [51]

    All your app links are belong to us: understanding the threats of instant apps based attacks,

    Y . Tang, Y . Sui, H. Wang, X. Luo, H. Zhou, and Z. Xu, “All your app links are belong to us: understanding the threats of instant apps based attacks,” in Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of ...

    2020

  44. [52]

    Measuring the insecurity of mobile deep links of android,

    F. Liu, C. Wang, A. Pico, D. Yao, and G. Wang, “Measuring the insecurity of mobile deep links of android,” in 26th USENIX security symposium (USENIX Security 17) , 2017, pp. 953–969

    2017

  45. [53]

    Born with a silver spoon: On the (in) security of native granted app privileges in custom android roms,

    C. Wang, Y . Zhao, J. Deng, and H. Wang, “Born with a silver spoon: On the (in) security of native granted app privileges in custom android roms,” in 2025 IEEE Symposium on Security and Privacy (SP) . IEEE Computer Society, 2024, pp. 17–17

    2025

  46. [54]

    From logging to leakage: A study of privacy leakage in android app logs,

    Z. Chen, S. S. Deo, P. C. R. Puttaparthi, Y . Tang, X. Zhang, and W. Shang, “From logging to leakage: A study of privacy leakage in android app logs,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering , 2024, pp. 2484–2485

    2024

  47. [55]

    A comprehensive study of privacy leakage vulnerability in android app logs,

    Z. Chen, “A comprehensive study of privacy leakage vulnerability in android app logs,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering , 2024, pp. 2510–2513

    2024

  48. [56]

    Sycophancy in large language models: Causes and mitigations,

    L. Malmqvist, “Sycophancy in large language models: Causes and mitigations,” arXiv preprint arXiv:2411.15287 , 2024

    2024 arXiv

  49. [57]

    Simple synthetic data reduces sycophancy in large language models,

    J. Wei, D. Huang, Y . Lu, D. Zhou, and Q. V . Le, “Simple synthetic data reduces sycophancy in large language models,” arXiv preprint arXiv:2308.03958, 2023

    2023 arXiv

  50. [58]

    Towards understanding sycophancy in language models,

    M. Sharma, M. Tong, T. Korbak, D. Duvenaud, A. Askell, S. R. Bowman, N. Cheng, E. Durmus, Z. Hatfield-Dodds, S. R. Johnston et al., “Towards understanding sycophancy in language models,”arXiv preprint arXiv:2310.13548, 2023

    2023 arXiv

  51. [59]

    An- droidinthewild: A large-scale dataset for android device control,

    C. Rawles, A. Li, D. Rodriguez, O. Riva, and T. Lillicrap, “An- droidinthewild: A large-scale dataset for android device control,” Ad- vances in Neural Information Processing Systems , vol. 36, pp. 59 708– 59 728, 2023

    2023

  52. [60]

    Backdooring instruction-tuned large language models with virtual prompt injection,

    J. Yan, V . Yadav, S. Li, L. Chen, Z. Tang, H. Wang, V . Srinivasan, X. Ren, and H. Jin, “Backdooring instruction-tuned large language models with virtual prompt injection,” arXiv preprint arXiv:2307.16888, 2023

    2023 arXiv

  53. [61]

    Learn to disguise: Avoid refusal responses in llm’s defense via a multi-agent attacker-disguiser game,

    Q. Xu, Z. Tian, H. Wu, Z. Huang, Y . Song, F. Liu, and D. Li, “Learn to disguise: Avoid refusal responses in llm’s defense via a multi-agent attacker-disguiser game,” 2024. [Online]. Available: https://arxiv.org/abs/2404.02532

    2024 arXiv

  54. [62]

    Role play with large language models,

    M. Shanahan, K. McDonell, and L. Reynolds, “Role play with large language models,” Nature, vol. 623, no. 7987, pp. 493–498, 2023

    2023

  55. [63]

    Jail- break attacks and defenses against large language models: A survey,

    S. Yi, Y . Liu, Z. Sun, T. Cong, X. He, J. Song, K. Xu, and Q. Li, “Jail- break attacks and defenses against large language models: A survey,” arXiv preprint arXiv:2407.04295 , 2024

    2024 arXiv

  56. [64]

    Visiontasker: Mobile task automation using vision based ui understanding and llm task planning,

    Y . Song, Y . Bian, Y . Tang, G. Ma, and Z. Cai, “Visiontasker: Mobile task automation using vision based ui understanding and llm task planning,” in Proceedings of the 37th Annual ACM Symposium on User Interface Software and Technology, 2024, pp. 1–17

    2024

  57. [65]

    Comprehensive cognitive llm agent for smartphone gui automation,

    X. Ma, Z. Zhang, and H. Zhao, “Comprehensive cognitive llm agent for smartphone gui automation,” arXiv preprint arXiv:2402.11941 , 2024

    2024 arXiv

  58. [66]

    Appagent v2: Advanced agent for flexible mobile interactions,

    Y . Li, C. Zhang, W. Yang, B. Fu, P. Cheng, X. Chen, L. Chen, and Y . Wei, “Appagent v2: Advanced agent for flexible mobile interactions,” arXiv preprint arXiv:2408.11824 , 2024

    2024

  59. [67]

    Mobile-bench: An evaluation benchmark for llm-based mobile agents,

    S. Deng, W. Xu, H. Sun, W. Liu, T. Tan, J. Liu, A. Li, J. Luan, B. Wang, R. Yan et al. , “Mobile-bench: An evaluation benchmark for llm-based mobile agents,” arXiv preprint arXiv:2407.00993 , 2024

    2024 arXiv

  60. [68]

    Mobileagentbench: An efficient and user-friendly benchmark for mobile llm agents,

    L. Wang, Y . Deng, Y . Zha, G. Mao, Q. Wang, T. Min, W. Chen, and S. Chen, “Mobileagentbench: An efficient and user-friendly benchmark for mobile llm agents,” arXiv preprint arXiv:2406.08184 , 2024

    2024 arXiv

  61. [69]

    Ufo: A ui-focused agent for windows os interaction,

    C. Zhang, L. Li, S. He, X. Zhang, B. Qiao, S. Qin, M. Ma, Y . Kang, Q. Lin, S. Rajmohan et al. , “Ufo: A ui-focused agent for windows os interaction,” arXiv preprint arXiv:2402.07939 , 2024

    2024 arXiv

  62. [70]

    Screenagent: A vision language model-driven computer control agent,

    R. Niu, J. Li, S. Wang, Y . Fu, X. Hu, X. Leng, H. Kong, Y . Chang, and Q. Wang, “Screenagent: A vision language model-driven computer control agent,” arXiv preprint arXiv:2402.07945 , 2024

    2024 arXiv

  63. [71]

    Windows agent arena: Evalu- ating multi-modal os agents at scale,

    R. Bonatti, D. Zhao, F. Bonacci, D. Dupont, S. Abdali, Y . Li, Y . Lu, J. Wagle, K. Koishida, A. Bucker et al., “Windows agent arena: Evalu- ating multi-modal os agents at scale,” arXiv preprint arXiv:2409.08264, 2024. APPENDIX This appendix presents three datasets supporting ...

    2024 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.