Full Report
An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six other attacks, against five open-source mobile agent frameworks: AppAgent, AppAgentX,
Analysis Summary
# Vulnerability: Multi-Stage RCE and Information Stealing in Android AI Agent Frameworks
## CVE Details
- **CVE ID**: None assigned (reported by researchers via arXiv)
- **CVSS Score**: N/A (Estimated Critical due to unauthenticated RCE on host PC)
- **CWE**:
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
- CWE-1027: Obfuscation in Code (Indirectly via "Invisible Text" Injection)
## Affected Systems
- **Products**:
- AppAgent
- AppAgentX
- Mobile-Agent-v3
- Open-AutoGLM
- MobA
- **Versions**: Main branches as of July 17, 2026.
- **Configurations**: Any deployment where these AI agents are "driving" an Android device via ADB (Android Debug Bridge) from a host PC (Windows/Linux).
## Vulnerability Description
Researchers discovered a chain of vulnerabilities that allow an Android app to execute commands on the host PC managing the AI agent. The flaw exists in three primary areas:
1. **Invisible Prompt Injection**: AI Vision models (GPT-4o, Claude 4.5, etc.) can read text at 2% opacity or text hidden in the hardware bezel area (non-visible pixels in the frame buffer). These models interpret this hidden text as legitimate instructions.
2. **Screenshot Race Condition (TOCTOU)**: Agents save screenshots to shared storage (e.g., `/sdcard/tmp.png`) before pulling them to the PC. A malicious app can poll this directory and overwrite the screenshot with a malicious prompt in the 50-500ms window between the file creation and the ADB pull.
3. **Command Injection**: The frameworks use unsanitized `subprocess.run(shell=True)` calls. When the AI agent processes the "injected" instructions, it converts them into ADB commands. Because the frameworks fail to sanitize shell metacharacters (`;`, `&`, `>`), a payload like `test;calc.exe` results in the host PC executing the command.
## Exploitation
- **Status**: PoC available (demonstrated by researchers in a controlled setting).
- **Complexity**: Low
- **Attack Vector**: Local (via a malicious Android app installed on the device being managed).
## Impact
- **Confidentiality**: High (Can steal credentials via fake overlays or read host files).
- **Integrity**: High (Full Remote Code Execution on the host PC).
- **Availability**: High (Can execute destructive commands on host or device).
## Remediation
### Patches
- **No official patches available**: As of July 2026, maintainers have not responded to researcher disclosures, and vulnerable code remains on main branches.
### Workarounds
- **Sanitize Input**: Manually patch `and_controller.py` or similar files to whitelist characters and avoid `shell=True` in subprocess calls.
- **Restrict Storage**: Configure agents to use private app directories instead of `/sdcard/` for screenshots to prevent the race condition.
- **Limit ADB Permissions**: Run the host-side agent with the lowest possible privileges.
- **Model Constraints**: Utilize system prompts that instruct the model to ignore text with extremely low opacity or text found in specific screen coordinates (though this is often unreliable).
## Detection
- **Indicators of Compromise**:
- Presence of `calc.exe` or unexpected `pwd` commands in ADB logs.
- Rapid file-system polling on `/sdcard/` targeting `.png` files.
- Unexpected credential prompts (Accessibility Service abuse).
- **Detection methods**: Monitor for shell metacharacters in ADB logs and audit outgoing network traffic from the host PC running the AI agent framework.
## References
- arXiv Preprint: [https://arxiv.org/abs/2607.00333](https://arxiv.org/abs/2607.00333)
- Vulnerable Component (AppAgent): [https://github[.]com/TencentQQGYLab/AppAgent/blob/main/scripts/and_controller.py](https://github[.]com/TencentQQGYLab/AppAgent/blob/main/scripts/and_controller.py)
- Vulnerable Component (Open-AutoGLM): [https://github[.]com/zai-org/Open-AutoGLM/blob/main/phone_agent/adb/screenshot.py](https://github[.]com/zai-org/Open-AutoGLM/blob/main/phone_agent/adb/screenshot.py)