Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

Summary: Researchers at Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and QAX's Xingtu Lab demonstrated seven attacks against five open-source Android agent frameworks - AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA - and every framework fell to at least six of the seven, per an arXiv paper posted July 1 and revised July 14. The chain starts with an app drawing over other windows or writing to shared storage to plant text the agent reads from a screenshot, then exploits unsanitized shell input and screenshot file races timed at 50 to 500ms to run commands on the host PC, with a calc.exe payload succeeding in 20 of 20 trials against four frameworks.
What you should know: Open-AutoGLM alone has more than 25,000 GitHub stars, and its README walks users through enabling USB debugging and sideloading the keyboard - the exact preconditions the measured attacks require, minus the malicious app. None of the five repositories publishes a security policy, and the researchers' private email to maintainers has gone unanswered.

Read the original at The Hacker News ↗