Pith. sign in

REVIEW 3 major objections 4 minor 93 references

Malicious ads hijack mobile AI agents into leaking data and installing malware

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 07:00 UTC pith:IYFS3VQY

load-bearing objection Real result, but the benign-task pairings are internally inconsistent and undermine the paper's robustness-vs-incapability distinction. the 3 major comments →

arxiv 2510.27140 v3 pith:IYFS3VQY submitted 2025-10-31 cs.CR

Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels

Chenghao Du , Quanfeng Huang , Tingxuan Tang , Zihao Wang , Adwait Nadkarni , Yue Xiao This is my paper
classification cs.CR
keywords mobile LLM agentsprompt injectionindirect prompt injectionmobile securityLLM agent safetyadversarial promptsmalware deploymentcredential theft
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that mobile LLM agents—AI assistants that read the screen and tap through apps on a user's behalf—can be reliably hijacked by malicious text hidden in ordinary third-party content such as ads, embedded web pages, and incoming notifications. The authors argue that because agents treat whatever text they see on screen as instructions, an attacker who can place a few lines of text in a banner or message can divert a benign task into credential theft, cross-app data exfiltration, or even full malware installation. Across eight state-of-the-art agents and more than 2,000 paired benign/adversarial trials, low-barrier attacks succeed most of the time, and stronger multi-app agents complete OS-warning-bypassing workflows like trojan APK installs with high reliability. The paper's paired-benign design is meant to show that many failures are not models refusing attacks but agents simply lacking the capability to execute them—so apparent resistance is often a limitation, not a defense.

Core claim

On the paper's terms, the central discovery is that mobile LLM agents are exploitable in realistic adversarial settings through indirect prompt injection: the agent concatenates the user instruction with a screen or UI snapshot, so third-party text in an ad, webview, email, or notification enters the model's context as a command. End-to-end chains are demonstrated—phishing a note task, harvesting a one-time code from the system Messages app and forwarding it, exfiltrating device data via an email app, pivoting across apps to steal a contact, and sideloading a trojan APK past the OS's harmful-file and install dialogs—and quantified by notice/attempt/execution metrics over eight agents. The pl

What carries the argument

The carrying mechanism is the prompt-plus-environment pipeline: a mobile agent concatenates the user prompt with environment data (a screenshot, accessibility tree, or UI hierarchy) and sends the combined text to the language model. Any adversarial text rendered in that environment data is thereby elevated to instruction-level status. To make the effect measurable, the paper introduces a three-stage metric—Notice (did the malicious text enter the agent's perception), Attempt (did the reasoning trace plan a harmful step), and Execution (did the full workflow complete)—and runs each adversarial case beside a matched benign task, so an agent that fails both is labelled incapable while one that

Load-bearing premise

The load-bearing premise is that hand-modified test apps with inserted ads and fake pages faithfully represent how real third-party content reaches agents, and that 'attempted' labels drawn from reasoning-trace inspection are accurate enough to separate robustness from incapability.

What would settle it

Re-run the highest-success workflows using real ad-network creatives rather than hand-inserted prompts, or have independent annotators relabel the same logged reasoning traces and show low inter-rater agreement on what counts as an 'attempt'; either result would substantially weaken the paper's central exploitability claim.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • In-app ads—especially interstitials that appear mid-task—are a dependable injection channel; an adversary who can buy or inject ad space can hijack the agent without any OS or app compromise.
  • Operating-system warnings such as harmful-file alerts and install dialogs slow capable agents but do not stop them; advanced multi-app agents complete the full sideloading chain.
  • Apparent resilience can be deceptive: an agent that ignores malicious and benign on-screen text alike is not defending itself, it is failing to perceive the screen, so future models that perceive better may become more exploitable.
  • Single-app agents resist cross-app attacks mainly because they cannot switch apps; as agent capabilities improve, cross-app workflows such as OTP harvesting and data pivoting become realistic attack paths.
  • Defenses that treat injection as a text-filtering problem are insufficient; the paper's framing points toward architectural separation of user instructions from observed content, plus runtime intent verification.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper: if the prompt-versus-environment separation were made structural—for example, UI text labelled as data rather than commands—most of these attack chains would lose their force even without better safety alignment.
  • Beyond the paper: real ad networks may filter, render, or layer content differently than the hand-inserted test prompts, so field success rates could differ; a natural next experiment is evaluating against live ad creatives or real third-party SDKs.
  • Beyond the paper: the notice/attempt/execution labels come from the authors reading logged reasoning traces; independent replication with multiple annotators and an agreement score would test whether the robustness-versus-incapability conclusion is stable.
  • Beyond the paper: the same testbed could be extended to measure whether small visual markers on trusted UI elements (for example, a dedicated agent-action affordance) reduce successful execution without hurting benign task completion.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper reports a systematic empirical study of indirect prompt-injection attacks against mobile LLM agents. It defines eight attack vectors—ranging from fraudulent ad injection to end-to-end malware sideloading—maps them to MITRE ATT&CK Mobile tactics, and evaluates eight mobile agents with different perception modalities, architectures, and backbone LLMs. Each attack is paired with a benign control (S), and attack outcomes are decomposed into Notice (N), Attempt (A), and Execution (E), with each trial repeated ten times. The central claim is that mobile agents are exploitable through realistic untrusted third-party channels such as in-app ads, webviews, email, and WhatsApp, even when OS-level warnings must be bypassed, and that apparent resistance in some agents reflects limited capability rather than security robustness.

Significance. If the results hold, this is the first systematic, end-to-end demonstration of realistic exploitability of mobile LLM agents through content that is already part of the mobile ecosystem, and it connects those findings to a standard adversary taxonomy. The paper's strengths are its breadth—eight agents, three architectures, multiple backbone LLMs, and a MITRE ATT&CK mapping—and its detailed case studies, including trace-level demonstrations of cross-app data exfiltration and malware installation. The paper also ships artifacts, attack scenarios, and scripts, which is commendable for reproducibility. However, several load-bearing methodological issues must be resolved before the central claim can be accepted as stated.

major comments (3)
  1. [§5.1, §5.4] The paired benign controls do not match the attack workflows for several vectors, undermining the S column as a capability baseline. §4.3 says the benign task for OTP harvesting is 'simply to reply to unread WhatsApp messages', but Table 6 defines it as 'Read the latest email and reply it' in Gmail. §4.4 says the System Data Discovery benign task is creating a note in Fossify Notes, while Table 6 lists the Gmail-reply task. For Malware Deployment, §4.7's original benign task is creating a note, but Table 6's benign task is 'Click DOWNLOAD button in Notes to download and install targeted app'—the very dangerous action the attack induces. Consequently, S in Table 3 for V6, V8, and V4 does not establish that an agent can perform the attack's initial workflow. This directly affects interpretations in §5.2.2, such as 'T3A is robust' (S=10 but E=0 on V6 may mean T3A cannot operate WhatsApp), '
  2. [§5.1] The N/A/E decomposition is central to the paper's robustness-versus-incapability argument, but the labeling procedure is unspecified. §5.1 says 'we analyze the agent's intermediate reasoning traces and mark a trial as attempted if a malicious action is explicitly included in its plan', without stating whether this is manual, automated, or LLM-assisted, and without reporting inter-rater agreement. This matters most in §5.4, where Gemini-1.5-pro's refusal to follow injected prompts is interpreted as 'a limitation rather than a defense' based on inspection of reasoning traces. If the trace-labeling is noisy, that interpretation loses support. The authors should specify the annotation protocol, provide examples of ambiguous traces, and report agreement statistics or a second annotator.
  3. [§3.1] The external validity of the 'realistic adversarial settings' claim rests on the assumption that hand-inserted banner ads, fake login pages, and fake download pages in modified apps faithfully represent real third-party channels. The paper does not validate this assumption; no real ad network or SDK is tested, and no evidence shows that an ad server would deliver the malicious text verbatim into the agent's perception stream. This is not an internal inconsistency, but it is load-bearing for the paper's central claim. At minimum, the limitations section should acknowledge this gap and bound the claims accordingly; ideally, the authors should test with a real ad SDK, a mock ad server that renders via an actual network path, or an equivalent realistic delivery mechanism.
minor comments (4)
  1. [§5.2] The abstract claims 'over 2,000 adversarial and paired benign trials', while §5.1 reports 1,880 test cases. With 8 agents × 8 vectors × 10 runs, the base matrix is 640 attack plus 640 benign = 1,280; the additional entrance and LLM-ablation experiments should be itemized so the count reconciles exactly.
  2. [§5.3] The text contains formatting artifacts: 'A=X6.88' and 'E=X4.63' for V2. These should be corrected to numeric values, and the corresponding table cells should be checked for the same issue.
  3. [§5.4] The average row mixes scales: individual entries are counts out of 10, but the averages are reported as percentages (98.75 / 67.50 / 65.00). Use a consistent scale throughout.
  4. [Open Science] The Gemini-1.5-pro row reports '100 0' where the other rows show counts out of 10. The '100' is likely a typo for '10', and N/A/E column labels are inconsistent with the rest of the paper.

Circularity Check

0 steps flagged

No circular derivation: results are direct empirical observations; one non-load-bearing self-citation and benign-control mismatches affect interpretation, not construction.

full rationale

The paper's findings are the outcome of a controlled measurement campaign (1880 test cases, N/A/E metrics defined in §5.1), not of a derivation from fitted parameters or from the definitions of the attack vectors. The vulnerability rates are computed by logging agent observations, reasoning traces, and executed actions; there is no equation that maps an input back to an output, and no quantity is renamed as a prediction. The only possible author self-citation is ref. [71], used in §4.6 as background for 'continuous side channels'; it is not load-bearing. The most structurally inferential part is the S-vs-(N,A,E) comparison used to separate robustness from incapability, and here the manuscript does have an internal-validity flaw: Table 6's benign controls are not matched to the attack workflows for several vectors (e.g., §4.3 defines the OTP benign task as replying to WhatsApp messages, while Table 6 uses a Gmail reply; §4.4's System Data Discovery benign task is note creation, while Table 6 again uses Gmail; for V4 Malware Deployment the 'benign' control is 'Click DOWNLOAD button in Notes to download and install targeted app', i.e., the attack's own forced action). This undermines the per-agent robustness-vs-incapability attributions, but it is not circular in the derivation sense: the E scores remain direct empirical observations, and no result is obtained by construction from a fitted input. Hence no specific circular step is exhibited.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 0 invented entities

No free parameters are fitted and no new entities are postulated; the paper is an empirical study. Its load-bearing assumptions concern threat-model realism, fidelity of the modified test apps, and reliability of the trace-labeling methodology.

axioms (4)
  • domain assumption Indirect prompt injection via concatenation of user prompt and environment context (p∥d) models how all evaluated mobile agents process third-party content.
    §2.1–2.2; the entire attack model depends on agents treating screen text, ads, and notifications as part of the model input without sufficient instruction hierarchy.
  • ad hoc to paper The modified test apps with hand-inserted banner ads, fake login pages, and fake download pages faithfully represent real third-party content in production mobile ecosystems.
    §4.1–4.2 and §5.1; attacks are demonstrated using author-modified apps rather than a live ad network or actual third-party SDK, so transferability to real deployments is assumed.
  • domain assumption Reasoning traces accurately reflect agent intent, and the authors' labeling of Notice/Attempt/Execution is reliable.
    §5.1 Evaluation Metrics; no labeling rubric, automated classifier, or inter-rater agreement is reported, so the N/A/E decomposition depends on unvalidated interpretation.
  • domain assumption Ten repetitions per condition are sufficient to estimate success rates without confidence intervals or statistical testing.
    §5.1 states each case is repeated ten times; no variance or significance analysis is provided, yet many conclusions rely on differences between low and high counts.

pith-pipeline@v1.3.0-alltime-deepseek · 25938 in / 14068 out tokens · 133195 ms · 2026-08-04T07:00:51.617701+00:00 · methodology

0 comments
read the original abstract

Large Language Models (LLMs) have transformed software development, enabling AI-powered applications known as LLM-based agents that promise to automate tasks across diverse apps and workflows. Yet, the security implications of deploying such agents in adversarial mobile environments remain poorly understood. In this paper, we present the first systematic study of security risks in mobile LLM agents. We design and evaluate a suite of adversarial case studies, ranging from opportunistic manipulations such as pop-up advertisements to advanced, end-to-end workflows involving malware installation and cross-app data exfiltration. Our evaluation covers eight state-of-the-art mobile agents across three architectures, with over 2,000 adversarial and paired benign trials. The results reveal systemic vulnerabilities: low-barrier vectors such as fraudulent ads succeed with over 80% reliability, while even workflows requiring the circumvention of operating-system warnings, such as malware installation, are consistently completed by advanced multi-app agents. By mapping these attacks to the MITRE ATT&CK Mobile framework, we uncover novel privilege-escalation and persistence pathways unique to LLM-driven automation. Collectively, our findings provide the first end-to-end evidence that mobile LLM agents are exploitable in realistic adversarial settings, where untrusted third-party channels (e.g., ads, embedded webviews, cross-app notifications) are an inherent part of the mobile ecosystem.

Figures

Figures reproduced from arXiv: 2510.27140 by Adwait Nadkarni, Chenghao Du, Quanfeng Huang, Tingxuan Tang, Yue Xiao, Zihao Wang.

Figure 1
Figure 1. Figure 1: Malware Deployment Attack Workflow the background; TA0029 Privilege Escalation, since it can request durable permissions such as calendar, notifica￾tions, camera, or microphone; and TA0039 Remote Service Effects, by exposing remote control surfaces through back￾ground services or scheduled jobs. The implications are se￾rious: a resident app can outlive the initial session, receive instructions indirectly, … view at source ↗
Figure 2
Figure 2. Figure 2: Mobile LLM agent Indirect Prompt Injection Pipeline. The user prompt [PITH_FULL_IMAGE:figures/full_fig_p018_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Examples of agent behaviors: (a) system data discovery and (b) cross-app data pivoting. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Phishing via Fake Login [PITH_FULL_IMAGE:figures/full_fig_p020_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Clipboard / OTP Harvesting 20 [PITH_FULL_IMAGE:figures/full_fig_p020_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: System Data Discovery [PITH_FULL_IMAGE:figures/full_fig_p021_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Cross-App Data Pivoting [PITH_FULL_IMAGE:figures/full_fig_p021_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Malicious App Deployment 21 [PITH_FULL_IMAGE:figures/full_fig_p021_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

93 extracted references · 32 linked inside Pith

  1. [1]

    ‘hey mum, i dropped my phone down the toilet’: Investigating hi mum and dad sms scams in the united kingdom

    Sharad Agarwal, Emma Harvey, Enrico Mariconti, Guillermo Suarez-Tangil, Marie Vasek, et al. ‘hey mum, i dropped my phone down the toilet’: Investigating hi mum and dad sms scams in the united kingdom. InUsenix Security Symposium, 2025

    2025

  2. [2]

    Dissect- ing ghost clicks: Ad fraud via misdirected human clicks

    Sumayah A Alrwais, Alexandre Gerber, Christopher W Dunn, Oliver Spatscheck, Minaxi Gupta, and Eric Osterweil. Dissect- ing ghost clicks: Ad fraud via misdirected human clicks. In Proceedings of the 28th Annual Computer Security Applica- tions Conference, pages 21–30, 2012

    2012

  3. [3]

    Agentharm: A benchmark for measuring harmfulness of llm agents.arXiv preprint arXiv:2410.09024, 2024

    Maksym Andriushchenko, Alexandra Souly, Mateusz Dziemian, Derek Duenas, Maxwell Lin, Justin Wang, Dan Hendrycks, Andy Zou, Zico Kolter, Matt Fredrikson, et al. Agentharm: A benchmark for measuring harmfulness of llm agents.arXiv preprint arXiv:2410.09024, 2024

    Pith/arXiv arXiv 2024

  4. [4]

    Alipay.https://www.alipay.com/

    Ant Group. Alipay.https://www.alipay.com/

  5. [5]

    Malvertising in facebook: Analysis, quan- tification and solution.Electronics, 9(8):1332, 2020

    Aritz Arrate, José González-Cabañas, Ángel Cuevas, and Rubén Cuevas. Malvertising in facebook: Analysis, quan- tification and solution.Electronics, 9(8):1332, 2020

    2020

  6. [6]

    Click-fraud monetizing malware: A survey and case study

    Tommy Blizard and Nikola Livic. Click-fraud monetizing malware: A survey and case study. In2012 7th International Conference on Malicious and Unwanted Software, pages 67–

  7. [7]

    Evaluating the susceptibility of pre-trained language models via handcrafted adversarial examples.arXiv preprint arXiv:2209.02128, 2022

    Hezekiah J Branch, Jonathan Rodriguez Cefalu, Jeremy McHugh, Leyla Hujer, Aditya Bahl, Daniel del Castillo Igle- sias, Ron Heichman, and Ramesh Darwishi. Evaluating the susceptibility of pre-trained language models via handcrafted adversarial examples.arXiv preprint arXiv:2209.02128, 2022

    Pith/arXiv arXiv 2022

  8. [8]

    Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Sub- biah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners.Advances in neural information processing systems, 33:1877–1901, 2020

    1901

  9. [9]

    A large scale study of user be- havior, expectations and engagement with android permissions

    Weicheng Cao, Chunqiu Xia, Sai Teja Peddinti, David Lie, Nina Taft, and Lisa M Austin. A large scale study of user be- havior, expectations and engagement with android permissions. In30th USENIX Security Symposium (USENIX Security 21), pages 803–820, 2021

    2021

  10. [10]

    Spa-bench: A comprehensive benchmark for smartphone agent evaluation

    Jingxuan Chen, Derek Yuen, Bin Xie, Yuhao Yang, Gongwei Chen, Zhihao Wu, Li Yixing, Xurui Zhou, Weiwen Liu, Shuai Wang, et al. Spa-bench: A comprehensive benchmark for smartphone agent evaluation. InNeurIPS 2024 Workshop on Open-World Agents, 2024

    2024

  11. [11]

    Struq: Defending against prompt injection with structured queries.arXiv preprint arXiv:2402.06363, 2024

    Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wag- ner. Struq: Defending against prompt injection with structured queries.arXiv preprint arXiv:2402.06363, 2024

    Pith/arXiv arXiv 2024

  12. [12]

    Bifocals: Analyzing webview vulnerabilities in android applications

    Erika Chin and David Wagner. Bifocals: Analyzing webview vulnerabilities in android applications. InInternational Work- shop on Information Security Applications, pages 138–159. Springer, 2013

    2013

  13. [13]

    An empirical study of click fraud in mobile ad- vertising networks

    Geumhwan Cho, Junsung Cho, Youngbae Song, and Hyoung- shick Kim. An empirical study of click fraud in mobile ad- vertising networks. In2015 10th International Conference on Availability, Reliability and Security, pages 382–388. IEEE, 2015

    2015

  14. [14]

    Madfraud: Investigating ad fraud in android applications

    Jonathan Crussell, Ryan Stevens, and Hao Chen. Madfraud: Investigating ad fraud in android applications. InProceedings of the 12th annual international conference on Mobile systems, applications, and services, pages 123–134, 2014

    2014

  15. [15]

    Advancing mobile gui agents: A verifier-driven approach to practical deployment.arXiv preprint arXiv:2503.15937, 2025

    Gaole Dai, Shiqi Jiang, Ting Cao, Yuanchun Li, Yuqing Yang, Rui Tan, Mo Li, and Lili Qiu. Advancing mobile gui agents: A verifier-driven approach to practical deployment.arXiv preprint arXiv:2503.15937, 2025

    arXiv 2025

  16. [16]

    Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025

    Edoardo Debenedetti, Ilia Shumailov, Tianqi Fan, Jamie Hayes, Nicholas Carlini, Daniel Fabian, Christoph Kern, Chongyang Shi, Andreas Terzis, and Florian Tramèr. Defeating prompt injections by design.arXiv preprint arXiv:2503.18813, 2025

    Pith/arXiv arXiv 2025

  17. [17]

    Agent- dojo: A dynamic environment to evaluate attacks and defenses for llm agents.arXiv e-prints, pages arXiv–2406, 2024

    Edoardo Debenedetti, Jie Zhang, Mislav Balunovi ´c, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. Agent- dojo: A dynamic environment to evaluate attacks and defenses for llm agents.arXiv e-prints, pages arXiv–2406, 2024

    2024

  18. [18]

    Delgado-Soto, J.E.L

    J.A. Delgado-Soto, J.E.L. de Vergara, and I. González. Gpt on the wire: towards realistic network traffic conversations generated with large language models.ResearchGate, 2025

    2025

  19. [19]

    Mobile- bench: An evaluation benchmark for llm-based mobile agents

    Shihan Deng, Weikai Xu, Hongda Sun, Wei Liu, Tao Tan, Jian- feng Liu, Ang Li, Jian Luan, Bin Wang, Rui Yan, et al. Mobile- bench: An evaluation benchmark for llm-based mobile agents. arXiv preprint arXiv:2407.00993, 2024

    Pith/arXiv arXiv 2024

  20. [20]

    Fossify notes beta

    Fossify (developed by Naveen Singh). Fossify notes beta. https://play.google.com/store/apps/details? id=org.fossify.notes&hl=en_SG, 2025. Android app, Pro- ductivity category. Updated on 27 July 2025

    2025

  21. [21]

    Fraud- droid: Automated ad fraud detection for android apps

    Feng Dong, Haoyu Wang, Li Li, Yao Guo, Tegawendé F Bis- syandé, Tianming Liu, Guoai Xu, and Jacques Klein. Fraud- droid: Automated ad fraud detection for android apps. In 14 Proceedings of the 2018 26th ACM joint meeting on Euro- pean software engineering conference and symposium on the foundations of software engineering, pages 257–268, 2018

    2018

  22. [22]

    Why eve and mal- lory love android: An analysis of android ssl (in) security

    Sascha Fahl, Marian Harbach, Thomas Muders, Lars Baumgärt- ner, Bernd Freisleben, and Matthew Smith. Why eve and mal- lory love android: An analysis of android ssl (in) security. In Proceedings of the 2012 ACM conference on Computer and communications security, pages 50–61, 2012

    2012

  23. [23]

    Not what you’ve signed up for: Compromising real-world llm-integrated ap- plications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated ap- plications with indirect prompt injection. InProceedings of the 16th ACM workshop on artificial intelligence and security, pages 79–90, 2023

    2023

  24. [24]

    Defending against phishing attacks: taxonomy of methods, cur- rent issues and future directions.Telecommunication Systems, 67(2):247–267, 2018

    Brij B Gupta, Nalin AG Arachchilage, and Kostas E Psannis. Defending against phishing attacks: taxonomy of methods, cur- rent issues and future directions.Telecommunication Systems, 67(2):247–267, 2018

    2018

  25. [25]

    Medusa attack: Exploring security hazards of {in- app}{QR} code scanning

    Xing Han, Yuheng Zhang, Xue Zhang, Zeyuan Chen, Mingzhe Wang, Yiwei Zhang, Siqi Ma, Yu Yu, Elisa Bertino, and Juanru Li. Medusa attack: Exploring security hazards of {in- app}{QR} code scanning. In32nd USENIX Security Sympo- sium (USENIX Security 23), pages 4607–4624, 2023

    2023

  26. [26]

    Securing llm systems against prompt injec- tion.Online], https://developer

    Rich Harang. Securing llm systems against prompt injec- tion.Online], https://developer. nvidia. com/blog/securing-llm- systems-against-prompt-injection, 2023

    2023

  27. [27]

    Os agents: A survey on mllm-based agents for gen- eral computing devices use.arXiv preprint arXiv:2508.04482, 2025

    Xueyu Hu, Tao Xiong, Biao Yi, Zishu Wei, Ruixuan Xiao, Yurun Chen, Jiasheng Ye, Meiling Tao, Xiangxin Zhou, Ziyu Zhao, et al. Os agents: A survey on mllm-based agents for gen- eral computing devices use.arXiv preprint arXiv:2508.04482, 2025

    Pith/arXiv arXiv 2025

  28. [28]

    Trustagent: To- wards safe and trustworthy llm-based agents.arXiv preprint arXiv:2402.01586, 2024

    Wenyue Hua, Xianjun Yang, Mingyu Jin, Zelong Li, Wei Cheng, Ruixiang Tang, and Yongfeng Zhang. Trustagent: To- wards safe and trustworthy llm-based agents.arXiv preprint arXiv:2402.01586, 2024

    Pith/arXiv arXiv 2024

  29. [29]

    ileakage: browser-based timerless speculative execu- tion attacks on apple devices

    Jason Kim, Stephan Van Schaik, Daniel Genkin, and Yuval Yarom. ileakage: browser-based timerless speculative execu- tion attacks on apple devices. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 2038–2052, 2023

    2023

  30. [30]

    S. Kim, Y . Yu, and H. Seo. Artificial intelligence orchestration for text-based ultrasonic simulation via self-review by multi- large language model agents.Scientific Reports, 2025

    2025

  31. [31]

    Refusal-trained llms are easily jailbroken as browser agents.arXiv preprint arXiv:2410.13886, 2024

    Priyanshu Kumar, Elaine Lau, Saranya Vijayakumar, Tu Trinh, Scale Red Team, Elaine Chang, Vaughn Robinson, Sean Hendryx, Shuyan Zhou, Matt Fredrikson, et al. Refusal-trained llms are easily jailbroken as browser agents.arXiv preprint arXiv:2410.13886, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    Deep learning.nature, 521(7553):436–444, 2015

    Yann LeCun, Yoshua Bengio, and Geoffrey Hinton. Deep learning.nature, 521(7553):436–444, 2015

    2015

  33. [33]

    sudo rm-rf agentic_security.arXiv preprint arXiv:2503.20279, 2025

    Sejin Lee, Jian Kim, Haon Park, Ashkan Yousefpour, Sangyoon Yu, and Min Song. sudo rm-rf agentic_security.arXiv preprint arXiv:2503.20279, 2025

    Pith/arXiv arXiv 2025

  34. [34]

    Don’t kill my ads! balancing privacy in an ad-supported mobile application market

    Ilias Leontiadis, Christos Efstratiou, Marco Picone, and Ce- cilia Mascolo. Don’t kill my ads! balancing privacy in an ad-supported mobile application market. InProceedings of the Twelfth Workshop on Mobile Computing Systems & Applica- tions, pages 1–6, 2012

    2012

  35. [35]

    Commercial llm agents are already vulnerable to simple yet dangerous attacks.arXiv preprint arXiv:2502.08586, 2025

    Ang Li, Yin Zhou, Vethavikashini Chithrra Raghuram, Tom Goldstein, and Micah Goldblum. Commercial llm agents are already vulnerable to simple yet dangerous attacks.arXiv preprint arXiv:2502.08586, 2025

    Pith/arXiv arXiv 2025

  36. [36]

    Knowing your enemy: understanding and detecting malicious web advertising

    Zhou Li, Kehuan Zhang, Yinglian Xie, Fang Yu, and XiaoFeng Wang. Knowing your enemy: understanding and detecting malicious web advertising. InProceedings of the 2012 ACM conference on Computer and communications security, pages 674–686, 2012

    2012

  37. [37]

    {DECAF}: Detecting and characterizing ad fraud in mobile apps

    Bin Liu, Suman Nath, Ramesh Govindan, and Jie Liu. {DECAF}: Detecting and characterizing ad fraud in mobile apps. In11th USENIX symposium on networked systems design and implementation (NSDI 14), pages 57–70, 2014

    2014

  38. [38]

    Maddroid: Characterizing and detecting devious ad contents for android apps

    Tianming Liu, Haoyu Wang, Li Li, Xiapu Luo, Feng Dong, Yao Guo, Liu Wang, Tegawendé Bissyandé, and Jacques Klein. Maddroid: Characterizing and detecting devious ad contents for android apps. InProceedings of The Web Conference 2020, pages 1715–1726, 2020

    2020

  39. [39]

    X. Liu. Exploring the power of large language models: Au- tomated compliance checks in architecture engineering and construction industries. Technical report, Cardiff University, 2025

    2025

  40. [40]

    Formalizing and benchmarking prompt injection attacks and defenses

    Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhen- qiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In33rd USENIX Security Symposium (USENIX Security 24), pages 1831–1847, 2024

    2024

  41. [41]

    Agen- trewardbench: Evaluating automatic evaluations of web agent trajectories.arXiv preprint arXiv:2504.08942, 2025

    Xing Han Lù, Amirhossein Kazemnejad, Nicholas Meade, Arkil Patel, Dongchan Shin, Alejandra Zambrano, Karolina Sta´nczak, Peter Shaw, Christopher J Pal, and Siva Reddy. Agen- trewardbench: Evaluating automatic evaluations of web agent trajectories.arXiv preprint arXiv:2504.08942, 2025

    arXiv 2025

  42. [42]

    Careful about what app promotion ads recommend! detecting and explaining malware promotion via app promotion graph.arXiv preprint arXiv:2410.07588, 2024

    Shang Ma, Chaoran Chen, Shao Yang, Shifu Hou, Toby Jia-Jun Li, Xusheng Xiao, Tao Xie, and Yanfang Ye. Careful about what app promotion ads recommend! detecting and explaining malware promotion via app promotion graph.arXiv preprint arXiv:2410.07588, 2024

    Pith/arXiv arXiv 2024

  43. [43]

    When advertising turns nasty.Net- work Security, 2015(11):5–8, 2015

    Steve Mansfield-Devine. When advertising turns nasty.Net- work Security, 2015(11):5–8, 2015

    2015

  44. [44]

    A study of mac address randomization in mobile devices and when it fails.arXiv preprint arXiv:1703.02874, 2017

    Jeremy Martin, Travis Mayberry, Collin Donahue, Lucas Foppe, Lamont Brown, Chadwick Riggins, Erik C Rye, and Dane Brown. A study of mac address randomization in mobile devices and when it fails.arXiv preprint arXiv:1703.02874, 2017

    Pith/arXiv arXiv 2017

  45. [45]

    The price of free: Privacy leakage in personalized mobile in-apps ads

    Wei Meng, Ren Ding, Simon P Chung, Steven Han, and Wenke Lee. The price of free: Privacy leakage in personalized mobile in-apps ads. InNDSS, pages 1–15, 2016

    2016

  46. [46]

    Whatsapp

    Meta Platforms, Inc. Whatsapp. https://www.whatsapp. com/

  47. [47]

    What’s clicking what? techniques and innova- tions of today’s clickbots

    Brad Miller, Paul Pearce, Chris Grier, Christian Kreibich, and Vern Paxson. What’s clicking what? techniques and innova- tions of today’s clickbots. InInternational Conference on Detection of Intrusions and Malware, and Vulnerability Assess- ment, pages 164–183. Springer, 2011. 15

    2011

  48. [48]

    Dial one for scam: A large-scale analysis of technical support scams

    Najmeh Miramirkhani, Oleksii Starov, and Nick Nikiforakis. Dial one for scam: A large-scale analysis of technical support scams. In24th Annual Network and Distributed System Se- curity Symposium, NDSS 2017, San Diego, California, USA, February 26 - March 1, 2017. The Internet Society, 2017

    2017

  49. [49]

    Mobile tactics

    MITRE ATT&CK. Mobile tactics. https://attack.mitre. org/tactics/mobile/, 2025

    2025

  50. [50]

    On sms phishing tactics and infrastructure

    Aleksandr Nahapetyan, Sathvik Prasad, Kevin Childs, Adam Oest, Yeganeh Ladwig, Alexandros Kapravelos, and Bradley Reaves. On sms phishing tactics and infrastructure. In2024 IEEE Symposium on Security and Privacy (SP), pages 1–16. IEEE, 2024

    2024

  51. [51]

    Ignore previous prompt: Attack techniques for language models.arXiv preprint arXiv:2211.09527, 2022

    Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models.arXiv preprint arXiv:2211.09527, 2022

    Pith/arXiv arXiv 2022

  52. [52]

    Tricking llms into disobedience: For- malizing, analyzing, and detecting jailbreaks.arXiv preprint arXiv:2305.14965, 2023

    Abhinav Rao, Sachin Vashistha, Atharva Naik, Somak Aditya, and Monojit Choudhury. Tricking llms into disobedience: For- malizing, analyzing, and detecting jailbreaks.arXiv preprint arXiv:2305.14965, 2023

    Pith/arXiv arXiv 2023

  53. [53]

    Are these ads safe: Detecting hidden attacks through the mobile app-web interfaces

    Vaibhav Rastogi, Rui Shao, Yan Chen, Xiang Pan, Shihong Zou, and Ryan D Riley. Are these ads safe: Detecting hidden attacks through the mobile app-web interfaces. InNDSS, 2016

    2016

  54. [54]

    ANDROIDWORLD: A DYNAMIC BENCHMARKING ENVIRONMENT FOR AUTONOMOUS AGENTS

    Christopher Rawles, Sarah Clinckemailliet, Yifan Chang, Jonathan Waltz, Gabrielle Lau, Marybeth Fair, Alice Li, William Bishop, Wei Li, Folawiyo Campbell-Ajala, Daniel Toyama, Robert Berry, Divya Tyamagundlu, Timothy Lilli- crap, and Oriana Riva. ANDROIDWORLD: A DYNAMIC BENCHMARKING ENVIRONMENT FOR AUTONOMOUS AGENTS. InInternational Conference on Learning...

    Pith/arXiv arXiv 2025

  55. [55]

    Ba- belview: Evaluating the impact of code injection attacks in mobile webviews

    Claudio Rizzo, Lorenzo Cavallaro, and Johannes Kinder. Ba- belview: Evaluating the impact of code injection attacks in mobile webviews. InInternational Symposium on Research in Attacks, Intrusions, and Defenses, pages 25–46. Springer, 2018

    2018

  56. [56]

    Identifying the risks of lm agents with an lm-emulated sandbox.arXiv preprint arXiv:2309.15817, 2023

    Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J Maddi- son, and Tatsunori Hashimoto. Identifying the risks of lm agents with an lm-emulated sandbox.arXiv preprint arXiv:2309.15817, 2023

    Pith/arXiv arXiv 2023

  57. [57]

    Understanding in-app ads and detecting hidden attacks through the mobile app-web interface

    Rui Shao, Vaibhav Rastogi, Yan Chen, Xiang Pan, Guanyu Guo, Shihong Zou, and Ryan Riley. Understanding in-app ads and detecting hidden attacks through the mobile app-web interface. IEEE Transactions on Mobile Computing, 17(11):2675–2688, 2018

    2018

  58. [58]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. " do anything now": Characterizing and evalu- ating in-the-wild jailbreak prompts on large language models. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685, 2024

    2024

  59. [59]

    What mo- bile ads know about mobile users

    Sooel Son, Daehyeok Kim, and Vitaly Shmatikov. What mo- bile ads know about mobile users. In23rd Annual Network and Distributed System Security Symposium, NDSS 2016, San Diego, California, USA, February 21-24, 2016. The Internet Society, 2016

    2016

  60. [60]

    Scan- droid: Automated side-channel analysis of android apis

    Raphael Spreitzer, Gerald Palfinger, and Stefan Mangard. Scan- droid: Automated side-channel analysis of android apis. In Proceedings of the 11th acm conference on security & privacy in wireless and mobile networks, pages 224–235, 2018

    2018

  61. [61]

    Autoeval: A practical framework for autonomous evaluation of mobile agents.arXiv preprint arXiv:2503.02403, 2025

    Jiahui Sun, Zhichao Hua, and Yubin Xia. Autoeval: A practical framework for autonomous evaluation of mobile agents.arXiv preprint arXiv:2503.02403, 2025

    arXiv 2025

  62. [62]

    Understanding and detecting mobile ad fraud through the lens of invalid traf- fic

    Suibin Sun, Le Yu, Xiaokuan Zhang, Minhui Xue, Ren Zhou, Haojin Zhu, Shuang Hao, and Xiaodong Lin. Understanding and detecting mobile ad fraud through the lens of invalid traf- fic. InProceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 287–303, 2021

    2021

  63. [63]

    Data breaches, phishing, or malware? understanding the risks of stolen credentials

    Kurt Thomas, Frank Li, Ali Zand, Jacob Barrett, Juri Ranieri, Luca Invernizzi, Yarik Markov, Oxana Comanescu, Vijay Er- anti, Angelika Moscicki, et al. Data breaches, phishing, or malware? understanding the risks of stolen credentials. InPro- ceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 1421–1434, 2017

    2017

  64. [64]

    Understanding influences on SMS phishing de- tection: User behavior, demographics, and message attributes

    Daniel Timko, Daniel Hernandez Castillo, and Muhammad Lut- for Rahman. Understanding influences on SMS phishing de- tection: User behavior, demographics, and message attributes. InSymposium on Usable Security and Privacy (USEC). NDSS Symposium, February 2025

    2025

  65. [65]

    Safearena: Evaluating the safety of autonomous web agents.arXiv preprint arXiv:2503.04957, 2025

    Ada Defne Tur, Nicholas Meade, Xing Han Lù, Alejandra Zambrano, Arkil Patel, Esin Durmus, Spandana Gella, Karolina Sta´nczak, and Siva Reddy. Safearena: Evaluating the safety of autonomous web agents.arXiv preprint arXiv:2503.04957, 2025

    Pith/arXiv arXiv 2025

  66. [66]

    Vladika, A

    J. Vladika, A. Fichtl, and F. Matthes. Investigating expectations and needs of medical professionals regarding the use of large language models.Research Square, 2025

    2025

  67. [67]

    The instruction hierarchy: Train- ing llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024

    Eric Wallace, Kai Xiao, Reimar Leike, Lilian Weng, Johannes Heidecke, and Alex Beutel. The instruction hierarchy: Train- ing llms to prioritize privileged instructions.arXiv preprint arXiv:2404.13208, 2024

    Pith/arXiv arXiv 2024

  68. [68]

    Mobile-agent: Autonomous multi-modal mobile device agent with visual per- ception.arXiv preprint arXiv:2401.16158, 2024

    Junyang Wang, Haiyang Xu, Jiabo Ye, Ming Yan, Weizhou Shen, Ji Zhang, Fei Huang, and Jitao Sang. Mobile-agent: Autonomous multi-modal mobile device agent with visual per- ception.arXiv preprint arXiv:2401.16158, 2024

    Pith/arXiv arXiv 2024

  69. [69]

    Mo- bileagentbench: An efficient and user-friendly benchmark for mobile llm agents.arXiv preprint arXiv:2406.08184, 2024

    Luyuan Wang, Yongyu Deng, Yiwei Zha, Guodong Mao, Qin- min Wang, Tianchen Min, Wei Chen, and Shoufa Chen. Mo- bileagentbench: An efficient and user-friendly benchmark for mobile llm agents.arXiv preprint arXiv:2406.08184, 2024

    Pith/arXiv arXiv 2024

  70. [70]

    Mobile-agent- e: Self-evolving mobile assistant for complex tasks.arXiv preprint arXiv:2501.11733, 2025

    Zhenhailong Wang, Haiyang Xu, Junyang Wang, Xi Zhang, Ming Yan, Ji Zhang, Fei Huang, and Heng Ji. Mobile-agent- e: Self-evolving mobile assistant for complex tasks.arXiv preprint arXiv:2501.11733, 2025

    Pith/arXiv arXiv 2025

  71. [71]

    The danger of minimum exposures: Understanding cross-app information leaks on ios through multi-side-channel learning

    Zihao Wang, Jiale Guan, XiaoFeng Wang, Wenhao Wang, Luyi Xing, and Fares Alharbi. The danger of minimum exposures: Understanding cross-app information leaks on ios through multi-side-channel learning. InProceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Secu- rity, pages 281–295, 2023. 16

    2023

  72. [72]

    Jailbreak and guard aligned language models with only few in-context demonstrations.arXiv preprint arXiv:2310.06387, 2023

    Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. Jailbreak and guard aligned language models with only few in-context demonstrations.arXiv preprint arXiv:2310.06387, 2023

    Pith/arXiv arXiv 2023

  73. [73]

    Autodroid: Llm-powered task automation in android

    Hao Wen, Yuanchun Li, Guohong Liu, Shanhui Zhao, Tao Yu, Toby Jia-Jun Li, Shiqi Jiang, Yunhao Liu, Yaqin Zhang, and Yunxin Liu. Autodroid: Llm-powered task automation in android. In Weisong Shi, Deepak Ganesan, and Nicholas D. Lane, editors,Proceedings of the 30th Annual International Conference on Mobile Computing and Networking, ACM Mo- biCom 2024, Wash...

    2024

  74. [74]

    Droidbot-gpt: Gpt-powered UI automation for android.CoRR, abs/2304.07061, 2023

    Hao Wen, Hongming Wang, Jiaxuan Liu, and Yuanchun Li. Droidbot-gpt: Gpt-powered UI automation for android.CoRR, abs/2304.07061, 2023

    Pith/arXiv arXiv 2023

  75. [75]

    Dissecting ad- versarial robustness of multimodal lm agents.arXiv preprint arXiv:2406.12814, 2024

    Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhut- dinov, Daniel Fried, and Aditi Raghunathan. Dissecting ad- versarial robustness of multimodal lm agents.arXiv preprint arXiv:2406.12814, 2024

    Pith/arXiv arXiv 2024

  76. [76]

    From assistants to adversaries: Exploring the security risks of mobile llm agents.arXiv preprint arXiv:2505.12981, 2025

    Liangxuan Wu, Chao Wang, Tianming Liu, Yanjie Zhao, and Haoyu Wang. From assistants to adversaries: Exploring the security risks of mobile llm agents.arXiv preprint arXiv:2505.12981, 2025

    Pith/arXiv arXiv 2025

  77. [77]

    Guardagent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning.arXiv preprint arXiv:2406.09187, 2024

    Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qin- bin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, et al. Guardagent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning.arXiv preprint arXiv:2406.09187, 2024

    Pith/arXiv arXiv 2024

  78. [78]

    Under- standing and detecting overlay-based android malware at mar- ket scales

    Yuxuan Yan, Zhenhua Li, Qi Alfred Chen, Christo Wilson, Tianyin Xu, Ennan Zhai, Yong Li, and Yunhao Liu. Under- standing and detecting overlay-based android malware at mar- ket scales. InProceedings of the 17th Annual International Conference on Mobile Systems, Applications, and Services, pages 168–179, 2019

    2019

  79. [79]

    {Iframes/Popups} are dangerous in mobile {WebView}: Studying and mitigating differential context vulnerabilities

    Guangliang Yang, Jeff Huang, and Guofei Gu. {Iframes/Popups} are dangerous in mobile {WebView}: Studying and mitigating differential context vulnerabilities. In28th USENIX Security Symposium (USENIX Security 19), pages 977–994, 2019

    2019

  80. [80]

    In-context de- fense in computer agents: An empirical study.arXiv preprint arXiv:2503.09241, 2025

    Pei Yang, Hai Ci, and Mike Zheng Shou. In-context de- fense in computer agents: An empirical study.arXiv preprint arXiv:2503.09241, 2025

    Pith/arXiv arXiv 2025

Showing first 80 references.