Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

Researchers uncovered multiple vulnerabilities in five open-source Android AI agent frameworks—AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA—that could allow attackers to execute arbitrary code on connected host computers. By injecting invisible or misleading text into screenshots processed by these agents, malicious apps can trick the AI into performing unintended actions, such as launching programs or stealing credentials. The flaws stem from unsafe handling of model outputs, lack of input sanitization, and insecure broadcast mechanisms. Despite being reported privately, no official patches have been issued, and none of the projects currently list a formal vulnerability disclosure process.