Android AI agents let invisible screen text run code on host PCs

Researchers demonstrated that an Android app capable of drawing over other windows and writing to shared storage can slip instructions into the AI agent driving the phone, which then executes those instructions on a host PC. The chain requires only ordinary permissions granted by users when installing such apps. In experiments, researchers showed this attack path along with six additional attacks against five open-source mobile agent frameworks, including AppAgent and its successor framework AppAgentX. Once the invisible overlay is placed, the same app writes data to shared storage that the AI agent reads, translating that data into executable commands for the PC it controls. ¹

The vulnerability hinges on accessibility features built into Android—specifically “drawing over other apps”—intended to aid users with disabilities but also providing a stealth channel for command execution. Because the overlay remains invisible to human eyes, an attacker could embed malicious instructions without alerting the user or triggering standard security checks. When combined with the continuous operation of LLM-powered agents such as AppAgentX, which interpret ambiguous instructions across multiple sessions without explicit prompts from users, the risk escalates beyond earlier methods requiring constant user input, such as phishing. This persistence makes the flaw especially dangerous for developers building these open‑source agents rather than individual end consumers given its current complexity level.

In practice, similar techniques were used successfully against mobile banking authentication systems back in 2024; a fake login screen would overlay the real one and steal credentials before they were ever entered by the user. That incident highlighted how invisible UI manipulation can compromise sensitive personal information stored overseas, potentially violating GDPR revisions finalized last year. Experts warn that generative AIs getting better at understanding human intent from limited text input will make this type of attack more common.

The new chain demonstrates that once a phone’s AI agent is compromised, attackers can leverage the device as a pivot point to run code on any connected PC, effectively bypassing traditional sandbox boundaries.

The implications extend beyond privacy: cloud infrastructure environments where corporate networks lack proper segmentation controls between tiers based upon criticality levels may be exposed if employees use devices running vulnerable frameworks. If a malicious actor gains access through a mobile endpoint managed via VPN tunnels, the attacker could manipulate host PCs within the same network segment, potentially accessing confidential data or disrupting operations.

Organizations should therefore prioritize reducing their “attack surface” – minimizing exposed services and limiting permissions granted to accounts – instead of focusing solely on patch speed.