Hijacking JARVIS: Benchmarking Mobile GUI Agents against Unprivileged Third Parties

## Abstract

Abstract. Mobile GUI agents are designed to autonomously execute diverse device-control tasks by interpreting and interacting with mobile screens. Despite notable advancements, their resilience in real-world scenarios—where screen content may be partially manipulated by untrustworthy third parties—remains largely unexplored. Owing to their black-box and autonomous nature, these agents are vulnerable to manipulations that could compromise user devices.
In this work, we present the first systematic investigation into the vulnerabilities of mobile GUI agents. We introduce a scalable attack simulation framework AgentHazard , which enables flexible and targeted modifications of screen content within existing applications. Leveraging this framework, we develop a comprehensive benchmark suite comprising both a dynamic task execution environment and a static dataset of vision-language-action tuples, totaling over 3,000 attack scenarios. The dynamic environment encompasses 58 reproducible tasks in an emulator with various types of hazardous UI content, while the static dataset is constructed from 210 screenshots collected from 14 popular commercial apps. Importantly, our content modifications are designed to be feasible for unprivileged third parties.
We evaluate 7 widely-used mobile GUI agents and 5 common backbone models using our benchmark. Our findings reveal that all examined agents are significantly influenced by misleading third-party content (with an average misleading rate of 28.8% in human-crafted attack scenarios) and that their vulnerabilities are closely linked to the employed perception modalities and backbone LLMs. Furthermore, we assess training-based mitigation strategies, highlighting both the challenges and opportunities for enhancing the robustness of mobile GUI agents.

## 1. Introduction

In recent years, GUI agents powered by large language models (LLMs) and vision language models (VLMs) (Rawles et al., 2023; Deng et al., 2023; Wang et al., 2024; Zheng et al., 2024a; Wen et al., 2024a, b; Rawles et al., 2024; Hong et al., 2024; Qin et al., 2025)
have demonstrated remarkable capabilities in task automation, positioning them as promising candidates for next-generation personal assistants.
A typical GUI agent takes a user-provided task description (e.g. booking a ticket, sending a message, etc.) as input and autonomously interacts with the device (e.g. via smartphone touchscreen) to complete the task.
The major steps of an agent session include multiple rounds of perception (reading the screen content), reasoning (deciding how to proceed the task on the current screen) and action (performing the decided operation).

Figure: Figure 1. Example of agent being misled by third-party information in real-world scenarios.
Refer to caption: x1.png

However, existing agents are mostly developed and tested in simple and clean environments (e.g. emulators and apps without user accounts and dynamic Internet content).
When deployed in real-world scenarios, these agents must interact with content from untrustworthy third-party sources that could be deliberately crafted to deceive them.
For example, as depicted in Figure [1](https://arxiv.org/html/2507.04227v1#S1.F1), consider a mobile agent tasked with reading and summarizing
community posts in a social media app, attackers could manipulate the post content and inject hazardous information.
When the agent reads the post, it could be misled and perform unexpected actions including
posting uncontrolled comments on social media, navigating to unsafe external websites,
downloading potentially harmful applications, etc.
Similarly, when an agent is tasked with shopping in an e-commerce platform,
unfaithful sellers could manipulate their product descriptions to influence the decision process of the agent,
which could lead to potential financial loss for the user.
These real-world threats highlight the critical need to systematically evaluate
and improve the robustness of LLM-powered mobile agents against adversarial content.

Existing studies has demonstrated that GUI agents can be easily distracted by either pop-up windows,
irrelevant information, or hiding HTML elements (Zhang et al., 2024b; Ma et al., 2024; Lee et al., 2024b; Xu et al., 2024).
However, these datasets are insufficient to help understand the robustness of mobile agents in realistic scenarios,
since their assumed attacks are limited in terms of stealthiness, complexity, and feasibility.
First, stealthiness means how difficult the threats can be detected.
Existing attacks are mostly based on simple pop-up windows (Zhang et al., 2024b)
that can be easily identified by human and automated tools,
while real-world threats may be much harder to notice,
such as a title and description of a product, or the content of a post in social media.
Second, the complexity of existing threats are mostly low,
due to the relatively simple and fixed attack patterns.
Attackers can usually design tailored targeted attacks that can lead to agent misbehavior more easily.
Finally, feasibility represents whether and how possible
the attacks can be actually implemented in real applications.
Existing works mostly focus on web-based agents (Xu et al., 2024; Wu et al., 2025a; Zhang et al., 2024b),
while generating pop-up windows or inserting invisible elements
usually require high system permissions, which is infeasible for most third-party attackers on Android devices.

In order to better understand the robustness of mobile GUI agents powered by LLMs,
we perform an in-depth empirical study to reveal the impact of real-world misleading contents on seven state-of-the-art mobile agents.
We first develop a highly configurable and scalable framework, AgentHazard, to automatically render
custom contents on Android applications, making it flexible to
simulate vast amounts of real-world attack scenarios with minimal human effort.

The framework mainly consists of a GUI hijacking tool which serves as a native Android application,
and an attack module which intercepts system UI state transitions between the agent and the environment.
After loading structured attack configurations, the tool monitors system UI state transitions
by Android Accessibility events, and modifies UI state information by injecting adversarial content
into both the UI element tree and the screenshot in real-time.
When agent requests for UI state, the module will return the modified information as it was the real UI state,
and record the actions performed by the agent for later analysis.
Compared to existing work, our attacks are applied to native components with no obvious visual distinction
from the normal interface. Moreover, the attacked regions are areas that third parties have legitimate
permissions to modify. This largely addresses the challenges of stealthiness and feasibility.
It is proven that our framework is more stealthy and harder to detect compared to existing popup-based approaches,
and simple adversarial training cannot provide effective defense.

Based on our framework, we construct a fine-grained benchmark suite
that includes a dynamic task execution environment and a static dataset of vision-language-action tuples.
Through dynamic injection of misleading content into apps, our benchmark suite
simulates how third parties could mislead agents by modifying specific UI element content in real-world scenarios.
We design attack scenarios with different levels of complexity,
ranging from simple “Click here!” to complex human-crafted adversarial contents.
Our dynamic environment includes 58 reproducible tasks,
and the static dataset contains 840 vision-language-action tuples.
Based on these tasks, we generate over 3,000 attack scenarios with various settings.

Our experiments have shown that, existing mobile agents are vulnerable against
a wide range of real-world misleading contents.
On the dynamic task execution environment,
the misleading contents can lead to significant performance degradation, with
up to 36.2% success rate drop, as well as up to 73.3% misleading rate.
We also find that the performance of mobile agents is sensitive to the complexity of misleading contents.
Through a pattern combining a misleading action and a task target,
we observe an average attack misleading rate of 24.8%, up to 45.0%.
We also discuss the differences between different modalities of mobile agents,
different backend LLMs, and different misleading targets.
It is proven that, although incorporating visual modality can improve the performance of mobile agents,
it also makes them more vulnerable to misleading contents.
Through comparison among a set of backbone LLMs, we find that Claude-3.7-sonnet demonstrates the best performance,
achieving the highest post-attack accuracy score and the lowest misleading rate,
followed by DeepSeek-series and GPT-series.

Based on these findings, we finally propose suggestions for improving the robustness
and security of LLM-powered mobile agents for future research.
We suggest that agents should be equipped with discriminative and cognitive capabilities
for information sources, enabling them to consciously distinguish between information
from sources with different levels of credibility.
On the other hand,
we recommend that agents should prompt users when encountering high-severity issues or when high-privilege
operations are required, to avoid unnecessary problems.

Our contributions can be summarized as follows:

- •
We design and implement a highly configurable and scalable mobile adversarial attack simulation framework,
which could inject specified contents as native GUI elements on Android applications without hacking or manual modification.
- •
We construct a fine-grained benchmark suite that includes a dynamic task execution environment
and a static dataset of vision-language-action tuples, consisting of more than 3,000 attack scenarios.
- •
We obtain several valuable insights about the robustness of mobile agents against adversarial attacks through misleading contents,
and provide guidelines for future agent design.

The benchmark will be open-sourced to the community.

## 2. Background and Related Work

### 2.1. GUI Agents

Large language models (LLMs) (Minaee et al., 2024) and multimodal models (VLMs) (Zhang et al., 2024a) have demonstrated increasingly sophisticated capabilities in human-like reasoning.
Based on these models, researchers have developed various autonomous agents (Xi et al., 2023) that interact with different environments
to complete tasks through information analysis and decision making.

Among these, GUI agents (Nguyen et al., 2024) have emerged as a significant category, capable of understanding graphical user interfaces and executing
a series of operations that simulate user actions (e.g. clicking and typing).
These agents (Hong et al., 2024; Qin et al., 2025; Wen et al., 2024a, b; Gou et al., 2024; Yang et al., 2024; Lai et al., 2024) are widely deployed in both Web and mobile applications,
establishing their understanding of interfaces through multiple modalities,
including visual information from interface screenshots and textual data such as HTML code
for web pages or XML interface information for Android mobile devices.
Leveraging the understanding and reasoning capabilities of models,
GUI agents operate based on their perception of the interface and the current task state,
calling upon potential tools or external knowledge bases to plan tasks,
ultimately executing actions and updating their state,
entering the next round of the “perception-planning-acting” cycle.
To enhance the performance of GUI agents, numerous studies have been conducted within this framework,
such as employing more efficient interface description schemes (Wen et al., 2024a; Lai et al., 2024),
utilizing knowledge bases and memory modules (Wen et al., 2024b; Zhou et al., 2024),
or training grounding models (Wu et al., 2024; Gou et al., 2024; Hong et al., 2024; Lee et al., 2024a) to achieve more efficient and precise action execution.

### 2.2. GUI Agent Benchmarks

To effectively evaluate the capabilities of autonomous agents in task execution,
researchers have developed numerous benchmarks that fall into two main categories: static and dynamic.

Static benchmarks (Deng et al., 2023; Li et al., 2020; Joyce et al., 2021; Rawles et al., 2023; Venkatesh et al., 2023; Cheng et al., 2024; Xing et al., 2024) provide predefined
input data such as GUI screenshots and textual interface information (HTML, DOM trees),
focusing on specific evaluation metrics like interface comprehension and element localization accuracy,
typically assessed through exact matching criteria with predefined ground truth.
These static benchmarks enable efficient and convenient evaluation processes,
though they lack flexibility in assessing real-world interactions.
In contrast, dynamic benchmarks offer interactive environments
such as websites (Shi et al., 2017; Zhou et al., 2024; He et al., 2024) or Android emulators (Rawles et al., 2024; Wen et al., 2024a)
where agents can operate with greater freedom within defined parameters.
While evaluation in these environments tends to be slower due to their interactive nature,
these dynamic frameworks better assess agents’ holistic capabilities
by allowing them to navigate and complete complex tasks in realistic environments,
providing a more comprehensive evaluation of their performance across various scenarios.

### 2.3. Security and Robustness of GUI Agents

As the capabilities of autonomous GUI agents continue to advance,
the issue of security and robustness has become increasingly prominent as well.
Drived by language models, agents are exposed to the risk of being attacked
by prompt injection (Apruzzese et al., 2022), jailbreaking (Shen et al., 2024) and backdoor attacks (Zhao et al., 2023),
or other adversarial attacks (Akhtar and Mian, 2018; Carlini and Wagner, 2018).
Prior work has explored the security vulnerabilities of GUI agents,
showing that they can be easily misled by adversarial elements
(e.g. pop-ups, environmental distractions, malicious tool usage instructions) (Zhang et al., 2024b; Ma et al., 2024; Lee et al., 2024b; Wu et al., 2025b).

Most existing work focuses on web-based attacks,
implementing attacks against agents by modifying HTML (Xu et al., 2024) or adding pop-ups (Zhang et al., 2024b),
while lacking research on mobile agents. Unlike web environments,
mobile operating systems like Android have higher security requirements and stricter control over user privacy,
application permissions, and third-party content access.
To achieve attacks similar to web-based pop-ups or invisible interface elements,
typically only app developers have the necessary permissions.
Such apps would not only struggle to pass security reviews but would also rarely be encountered during normal agent usage,
making it impractical to directly transfer existing web-based attack approaches to mobile platforms.

However, mobile platforms are not entirely secure. When agents operate in real-world environments,
they often interact with information from numerous third-party sources of unauthorized or untrusted origin.
This information is legitimately published across various applications
(e.g. posts on social media platforms, product descriptions in shopping apps, etc.)
and can be arbitrarily modified and controlled by third parties.
If agents are misled by such information while executing tasks,
the consequences could be irreversible.
Research in this area remains largely unexplored.
Our study is the first to systematically analyze the robustness and behavior of agents executing tasks in realistic
scenarios where potentially misleading information may exist.

## 3. Threat Model

Consider a mobile GUI agent executing tasks in a real-world Android environment.
There are several key roles involved in the execution process.
The user initiates the interaction by issuing tasks to the agent.
The agent, driven by its underlying model, processes these tasks and interacts with various applications.
These applications often display content from third-party sources, such as product listings from sellers,
social media posts from users, and advertisements from marketers.
Additionally, the Android operating system provides the runtime environment and necessary APIs
for the agent to interact with these applications.

Our work focuses specifically on threats from untrusted third-party content sources,
assuming all other components remain secure and reliable.
The attackers can publish and control misleading information through legitimate channels
(e.g. product descriptions, social media posts, reviews)
but cannot modify application resources (e.g. APKs) or system-controlled components.
The attack surface primarily consists of user-generated content and third-party information
that appears in applications’ interfaces. Examples of security threats include
(1) Financial Fraud: Malicious sellers may craft deceptive product descriptions and pricing information to trick agents into making unauthorized purchases or exposing payment details;
(2) Privacy Breach: Attackers could post designed content to manipulate agents into sharing users’ private data (e.g. contacts, photos) through seemingly legitimate sharing features;
(3) Malware Installation: Bad actors may create misleading app store listings or advertisement content to deceive agents into downloading malicious applications.

## 4. AgentHazard

We introduce AgentHazard, a scalable and flexible attack simulation framework
designed to systematically modify screen content in Android applications.
Our framework addresses two key challenges in benchmarking mobile GUI agent robustness:
feasibility and scalability.

Through a precise element locating mechanism, the framework can identify target UI components
in applications and overlay adversarial content in real-time. This approach bypasses the need
to modify application databases directly, making the simulated content independent of
recommendation systems and internal data structures. Additionally, the framework enables
rapid generation of diverse attack scenarios through both human expert design and LLM-based generation.

We develop a comprehensive benchmark suite consisting of a dynamic task execution environment for evaluating agent behavior in real-time (Section [4.1](https://arxiv.org/html/2507.04227v1#S4.SS1)) and a static dataset of vision-language-action tuples for controlled testing (Section [4.2](https://arxiv.org/html/2507.04227v1#S4.SS2)).

Figure: Figure 2. Overview of the AgentHazard dynamic task execution environment.
Refer to caption: x2.png

### 4.1. Dynamic Task Execution Environment

The structure of our dynamic task execution environment is shown in Figure [2](https://arxiv.org/html/2507.04227v1#S4.F2).
We choose Android World (Rawles et al., 2024) as the base benchmarking environment,
which already supports the execution and evaluation of mobile GUI agents.
We select 8 apps and curated 58 reproducible tasks suitable for robustness evaluation.
We extend Android World with our dynamic attacking framework,
which mainly includes a GUI hijacking tool and an attack module.

#### 4.1.1. Attack Simulation Framework

We develop the GUI hijacking tool as a native Android application, which could be easily installed on Android devices.
During task execution process, it monitors system UI state transitions through Android Accessibility events,
and modifies the UI state information by injecting adversarial content into both the UI element tree and the screenshot in real-time.
In order to facilitate the design of attack scenarios, we also introduce a structured attack configuration pattern matched with the tool,
which specifies the content, position, and properties of malicious information.
The configurations will be loaded into the tool to render adversarial content over the target UI element
either through user interface operations or command line.

Figure: Figure 3. Example configuration of one target screen, with two target elements to be modified.

Figure [3](https://arxiv.org/html/2507.04227v1#S4.F3) shows an structured example configuration following our pattern,
which defines a target screen on which the adversarial content will be injected.
Each target screen consists of two parts, an identifier which defines the target app and activity,
and a list of target elements which specifies the details of the malicious information.
Target element is the core component of one configuration,
which defines the content, position, and other necessary properties,
such as alignment, font size, background & foreground color, etc.
These properties could be customized to make the rendered content more natural and realistic.
We support flexible location mechanisms, including resource identifier, text, class name, etc,
and index-based relative location.
Besides, we also introduce conditions for more precise targeting.
The location mechanism will only happen when all “exists” conditioned elements are present,
as well as none of the “not_exists” conditioned elements is present.

After the configuration is loaded into the tool, it will start monitoring the system UI state transitions on activation.
It will analyze the current UI state aquired from Android Accessibility events and evaluate it against the predefined attack configurations.
When a target element is successfully detected, the tool will render the adversarial content
over the original UI elements to simulate realistic attack scenarios.
Simultaneously, it updates the UI element tree to ensure consistency with the visual alterations.

The attack module is a Python module that coorperates with the tool to intercept agent requests for UI state information.
When the agent is executing a task, the module will load specific configurations into the tool and activate it.
The module is plugged into the Android World environment, responsible for returning the modified UI state to the agent.
It will also record the agent’s action and behavior,
checking whether the agent’s action matches the predefined misleading action in the current scenario.
These behavioral signals are systematically recorded for subsequent analysis.

#### 4.1.2. Benchmarking Suite

Based on the attack simulation framework, we create a comprehensive benchmark suite,
covering 8 apps, 58 tasks with over 500 attack scenarios.
The apps including Expense, Markor, Recipe, Retro Music, Simple Calendar, etc.
The task distribution is illustrated in Figure [4](https://arxiv.org/html/2507.04227v1#S4.F4),
ranging from creating new playlist in music app to sending a new message in SMS.
For each task, we design a set of scenarios to simulate different third-party-sourced misleading contents.

Figure: Figure 4. Task number of each app in the dynamic benchmarking environment.
Refer to caption: x3.png

We design attack scenarios in two aspects, namely the complexity level and the misleading action.
First, we categorize attacks into three levels of complexity: Simple, Medium, and Complex,
designed to systematically evaluate agent robustness against varying degrees of attack complexity and task relevance.
Among these levels, Simple and Medium patterns are generated programmatically,
while Complex patterns are manually crafted by human experts, as examples shown in Table [1](https://arxiv.org/html/2507.04227v1#S4.T1).
Simple patterns are direct instructions of misleading actions (e.g. “click here”),
which stands for the simplest and weakest attack.
Medium patterns are contextually integrated into the task execution sequence,
requiring more sophisticated decision-making from the agent (e.g. “click the button to enable a feature”).
Complex patterns are manually crafted by human experts, feature content highly relevant to the original task
or pretending to be system or application notifications,
demanding comprehensive understanding of both the task objectives and application context from the agent.
Second, we analyze the impact of different misleading actions that agents can perform during task execution.
From the set of possible actions, we focus on three representative types:
“click” (e.g. clicking and entering a fake post that disrupts the task flow),
“navigate” (e.g. directly pressing home button despite current execution),
and “terminate” (e.g. prematurely ending the task based on false completion messages).
These actions were selected based on their frequent occurrence during task execution and their potential to significantly disrupt the execution process.

Based on the scenario design above, we construct a comprehensive benchmark suite,
consisting of over 500 real-world misleading attack scenarios,
supporting the evaluation of different types of mobile GUI agents.

**Table 1. Examples of attack patterns in different complexity levels.**
| Level | Pattern | Example |
| --- | --- | --- |
| Simple | Misleading Action | Click here! |
| Medium | Misleading Action + Task Target | Click here to enable the delete function. |
| Complex | Human-crafted misleading content. | The app does not start correctly. Click to read instructions to fix. |

### 4.2. Static Dataset of VLA Tuples

A dynamic full-process execution task evaluation environment is crucial for understanding the behavior
of an agent in real-world scenarios. However, due to potential uncontrollable influencing factors in real systems
(e.g. hardware response or network latency),
the dynamic evaluation environment is characterized by long evaluation cycles and numerous influencing factors.
To provide a more efficient and controllable evaluation approach, we develop a scalable
pipeline to generate static attack scenarios with minimal human effort.

We construct our static dataset of vision-language-action (VLA) tuples using a diverse set of widely-used popular commercial applications,
including Twitter, Youtube, Spotify, and others that users interact with on a daily basis.
These applications span multiple categories such as social media, business tools, and shopping platforms,
with their task distribution illustrated in Figure [5](https://arxiv.org/html/2507.04227v1#S4.F5).

Our dataset creation process begins with collecting extensive runtime screenshots and their corresponding UI element trees.
Human annotators then carefully select screenshots where third-party content manipulation is feasible.
For these selected screenshots, annotators craft focused tasks that require agents to perform
single-step interactions with specific UI elements.
We design a set of prompts that, given the original task and screenshot along with third-party
controllable regions, enable large language models to generate effective attack content.
Following the attack scenario design principles outlined in Section [4.1](https://arxiv.org/html/2507.04227v1#S4.SS1),
we develop various misleading actions for each task.
These attacks are implemented by injecting deceptive content into both the UI element trees and screenshots.
The final dataset comprises 840 unique tasks and over 2500 attack scenarios.

Figure: Figure 5. Distribution of tasks across different app categories in the static dataset. The category data is collected from Google Play.

## 5. Experiments

**Table 2. Success Rates and Misleading Rates of agents on different attack settings. Each cell contains two values: the upper denotes the variation of SR, and the lower denotes MR. Maximum values are highlighted in bold.**
|  |  |  | M3A | SeeAct | T3A | AutoDroid | Cog | UGround | Aria UI | Avg. |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
|  |  |  | 4o | mini | 4o | mini | 4o | mini | R1 | 4o | mini | R1 | Cog-9B | 4o | mini | 4o | mini | - |
| Clean Environment SR | 45.8 | 20.0 | 18.3 | 6.5 | 45.8 | 10.0 | 39.2 | 21.7 | 8.3 | 19.2 | 17.5 | 48.3 | 31.8 | 38.3 | 18.3 | 25.9 |  |  |
| \stackengine<br>4ptThreat LevelSimpleUcFFS | \stackengine<br>4ptMislead toClickUcFFS | $\Delta$SR | -6.4 | -7.0 | -4.5 | -1.1 | -6.1 | -1.7 | -0.9 | 0.0 | -4.9 | 2.5 | -7.3 | -14.6 | -8.7 | -0.4 | -1.6 | -4.2 |
| MR | 6.3 | 13.0 | 10.2 | 21.6 | 8.3 | 6.2 | 5.0 | 3.6 | 12.1 | 3.3 | 4.3 | 6.7 | 5.1 | 5.4 | 3.3 | 7.6 |  |  |
| \stackengine<br>4ptMislead toNavigateUcFFS | $\Delta$SR | -2.8 | -11.3 | 1.0 | -6.5 | 4.3 | 0.4 | 3.8 | 0.0 | -3.1 | 0.8 | - | -17.5 | -9.1 | -1.6 | -4.5 | -3.3 |  |
| MR | 0 | 4.3 | 0.0 | 2.6 | 0.0 | 4.2 | 0.0 | 3.0 | 0.0 | 0.0 | - | 4.3 | 15.9 | 2.0 | 12.1 | 3.5 |  |  |
| \stackengine<br>4ptMislead toTerminateUcFFS | $\Delta$SR | 1.8 | -9.1 | -0.5 | -4.3 | -6.1 | -3.3 | 4.1 | -0.7 | -3.1 | -0.9 | - | -19.4 | -6.2 | 3.4 | -9.2 | -3.8 |  |
| MR | 10.9 | 25.5 | 4.1 | 0.0 | 16.7 | 0.0 | 26.7 | 14.0 | 5.2 | 33.3 | - | 34.7 | 39.5 | 21.7 | 25.5 | 18.4 |  |  |
| Avg. | $\Delta$SR | -2.5 | -9.1 | -1.3 | -4.0 | -2.7 | -1.5 | 2.3 | -0.2 | -3.7 | 0.8 | -7.3 | -17.2 | -8.0 | 0.5 | -5.1 | -3.9 |  |
| MR | 5.7 | 14.3 | 4.8 | 8.1 | 8.3 | 3.5 | 10.6 | 6.9 | 5.8 | 12.2 | 4.3 | 15.2 | 20.2 | 9.7 | 13.6 | 9.8 |  |  |
| \stackengine<br>4ptThreat LevelMediumUcFFS | \stackengine<br>4ptMislead toClickUcFFS | $\Delta$SR | -16.2 | -12.5 | -6.5 | -6.5 | -14.4 | 2.5 | 0.8 | -4.8 | -1.4 | 2.5 | -7.0 | -20.7 | -11.8 | -13.7 | -9.8 | -8.0 |
| MR | 27.1 | 52.8 | 39.6 | 51.1 | 10.4 | 6.2 | 9.0 | 30.5 | 20.0 | 11.7 | 11.9 | 28.3 | 47.5 | 28.1 | 33.9 | 27.2 |  |  |
| \stackengine<br>4ptMislead toNavigateUcFFS | $\Delta$SR | -13.5 | -13.8 | -5.0 | -6.5 | -16.5 | 0.6 | -1.2 | 0.0 | -6.9 | 4.1 | - | -18.6 | -9.8 | -6.3 | -6.0 | -7.1 |  |
| MR | 18.8 | 37.5 | 5.8 | 24.4 | 4.2 | 12.8 | 0.0 | 4.1 | 22.4 | 0.0 | - | 21.7 | 41.5 | 14.0 | 22.8 | 16.4 |  |  |
| \stackengine<br>4ptMislead toTerminateUcFFS | $\Delta$SR | -23.1 | -12.5 | -6.5 | -6.5 | -14.0 | -1.7 | -4.2 | -2.7 | -4.5 | -2.5 | - | -26.7 | -22.0 | -11.6 | -11.1 | -10.7 |  |
| MR | 40.5 | 39.6 | 22.9 | 10.8 | 33.3 | 14.6 | 33.3 | 24.1 | 24.1 | 28.3 | - | 38.3 | 39.0 | 35.0 | 45.0 | 30.6 |  |  |
| Avg. | $\Delta$SR | -17.6 | -12.9 | -6.0 | -6.5 | -15.0 | 0.5 | -1.5 | -2.5 | -4.3 | 1.4 | -7.0 | -22.0 | -14.5 | -10.5 | -9.0 | -8.5 |  |
| MR | 28.8 | 43.3 | 22.8 | 28.8 | 16.0 | 11.2 | 14.1 | 19.6 | 22.2 | 13.3 | 11.9 | 29.4 | 42.7 | 25.7 | 33.9 | 24.8 |  |  |
| \stackengine<br>4ptThreat LevelComplexUcFFS | \stackengine<br>4ptMislead toClickUcFFS | $\Delta$SR | -18.4 | -10.4 | 1.0 | -3.7 | -30.6 | 0.4 | -4.2 | -9.7 | 3.8 | -2.5 | -1.7 | -20.4 | -12.3 | -14.6 | -8.3 | -8.8 |
| MR | 37.5 | 59.6 | 27.5 | 38.9 | 31.3 | 37.5 | 28.3 | 22.4 | 34.5 | 12.1 | 20.0 | 32.7 | 56.1 | 34.5 | 50.0 | 34.9 |  |  |
| \stackengine<br>4ptMislead toNavigateUcFFS | $\Delta$SR | -10.5 | -8.5 | -0.7 | -4.0 | -16.5 | 0.4 | -7.2 | 0.0 | -4.9 | 0.8 | - | -14.2 | -6.8 | -3.3 | -5.6 | -5.8 |  |
| MR | 8.5 | 15.4 | 0.0 | 2.5 | 8.3 | 6.2 | 0.0 | 3.5 | 5.2 | 0.0 | - | 10.9 | 24.4 | 15.6 | 18.5 | 8.5 |  |  |
| \stackengine<br>4ptMislead toTerminateUcFFS | $\Delta$SR | -29.9 | -14.5 | -10.6 | -4.1 | -33.2 | -3.8 | -9.2 | -7.7 | 0.0 | -7.5 | - | -36.2 | -22.3 | -20.0 | -14.7 | -15.3 |  |
| MR | 56.3 | 67.3 | 23.4 | 17.1 | 27.0 | 33.3 | 50.0 | 50.0 | 20.7 | 43.3 | - | 46.8 | 45.2 | 50.0 | 73.3 | 43.1 |  |  |
| Avg. | $\Delta$SR | -19.6 | -11.1 | -3.4 | -4.0 | -26.8 | -1.0 | -6.9 | -5.8 | -0.4 | -3.1 | -1.7 | -23.6 | -13.8 | -12.6 | -9.5 | -9.9 |  |
| MR | 34.1 | 47.4 | 17.0 | 19.5 | 22.2 | 25.7 | 26.1 | 25.3 | 20.1 | 18.5 | 20.0 | 30.1 | 41.9 | 33.4 | 47.3 | 28.8 |  |  |

### 5.1. Setup

Victim Mobile Agents.
We evaluate 7 mobile agents:
M3A, T3A (Rawles et al., 2024), UGround (Gou et al., 2024), AutoDroid (Wen et al., 2024a), SeeAct (Zheng et al., 2024b), CogAgent (Hong et al., 2024),
and Aria UI (Yang et al., 2024).
These agents represent a diverse range of architectural approaches, including multi-modal,
text-based, and vision-based paradigms, with varying combinations of proprietary and open-source
implementations for their planning and grounding components.
Table [3](https://arxiv.org/html/2507.04227v1#S5.T3) summarizes the key architectural characteristics of each agent.
Note that CogAgent does not support “navigate” or “terminate” actions,
so we only report their performance on supported functionalities.

Victim LLMs.
We evaluate the performance and robustness on a series of LLMs, including gpt-4o, gpt-4o-mini,
DeepSeek-V3, DeepSeek-R1, and Claude 3.7 sonnet.
In dynamic benchmarking environment, we choose gpt-4o and gpt-4o-mini as the main underlying language model backend,
and also evaluate DeepSeek-R1 for text-based agents.
In static evaluation part, we compare the misleading effect under different modals,
taking M3A, T3A and UGround as representatives for multi-modal, text-based and vision-based modals.

Metrics.
We calculate the success rate (SR) and misleading rate (MR) of each agent in each attack scenario.
Success rate means the percentage of agent finishing the task successfully;
for static benchmarking environment it means to select both correct action and correct target element.
Misleading rate means the extent to which the agent’s behavior deviates from the intended behavior
and instead choose to follow the misleading contents.
For evaluation on static dataset, we use “$\textrm{Acc}_{\textrm{safe}}$” and “$\textrm{Acc}_{\textrm{attack}}$”
to represent the accuracy of the agent in the safe and attack scenarios, respectively.

**Table 3. Evaluated agents, categorized by their modality type, structure and backbone LLMs.**
| Agent | Modality | Planning LLM | Grounding LLM |
| --- | --- | --- | --- |
| M3A | multi-modal | Proprietary (Unified) |  |
| T3A | text-based | Proprietary (Unified) |  |
| AutoDroid | text-based | Proprietary (Unified) |  |
| SeeAct | multi-modal | Proprietary (Unified) |  |
| CogAgent | vision-based | 9B Open Source (Unified) |  |
| UGround | vision-based | Proprietary | 7B Open Source |
| Aria UI | vision-based | Proprietary | \stackengine<br>4pt25.3B MoEOpen SourceUcFFS |

### 5.2. Dynamic Experiment Results

Table [2](https://arxiv.org/html/2507.04227v1#S5.T2) presents the experimental outcomes within the dynamic benchmarking environment.
The results are organized according to various misleading actions, complexity levels,
different agents, and distinct backbone Large Language Models (LLMs).
Each cell contains two metrics: the upper value represents the decrease in Success Rate (Drop of SR),
while the lower value indicates the Misleading Rate (MR).
In certain configurations (e.g. AutoDroid paired with DeepSeek-R1),
the Drop of SR is a small positive value, suggesting that the setting has minimal impact on the agent’s performance.
Instead, the Success Rate increases slightly mainly due to the inherent randomness in LLM outputs.

First, we can see that mobile agents are vulnerable to misleading content attacks.
Our experimental results demonstrate significant variations in baseline performance across different agents.
UGround exhibits the strongest performance, achieving a 48.3% baseline SR with gpt-4o as its backbone.
M3A and T3A show comparable capabilities with identical baseline SRs of 45.8%,
while the remaining agents achieve more modest baseline SRs between 10% and 20%.
Upon introducing misleading information, we observe a marked decline in Success Rates across all agents.
Most notably, UGround@4o suffers a dramatic 36.2% SR Drop when subjected to termination-action attacks.
Noticeably, agents with lower baseline performance, such as AutoDroid@gpt-4o-mini and T3A@gpt-4o-mini,
show greater resilience to attacks in terms of SR Drop.
This resilience can be attributed to their initially limited task-solving capabilities,
which provides little room for further performance deterioration.

The analysis of Misleading Rate (MR) metrics strongly validates the vulnerability of mobile agents to misleading content attacks,
particularly in complex scenarios.
Interestingly, while some agents with lower baseline performance exhibit minimal SR reduction under attacks,
they still show significant vulnerability through elevated MRs in certain attack configurations.
For example, although T3A@gpt-4o-mini maintains a relatively stable SR,
it displays considerable vulnerability with an average MR of 25.7% in complex scenarios.
These observations indicate that MR provides a more precise and sensitive measure of agent robustness against adversarial attacks.

Besides, we observe that different actions have different effects on misleading agents.
Mobile GUI agents support various actions like “click”, “scroll”, “navigate”, and “terminate”.
These actions differ in both usage frequency and impact on agent performance.
Figure [6(a)](https://arxiv.org/html/2507.04227v1#S5.F6.sf1) compares the SR Drop and MR across different actions
against complex attack contents.

The “terminate” action shows the highest impact with an average SR Drop of 15.3% and MR of 43.1%.
When misled by a “terminate” action, the task execution halts immediately.
This means attackers can successfully terminate tasks over 40% of the time by injecting adversarial content.
The effectiveness stems from adversarial content mimicking system messages or app notifications,
which tend to command greater attention from agents.

The “click” action has the second highest impact, which leads to an average SR Drop of 8.8% and MR of 34.9%.
Its high misleading rate reveals significant vulnerabilities
considering the frequent usage of click action in mobile apps.
While misleading clicks are harmless in our evaluation, real-world implications could be severe -
potentially leading to malware downloads or compromises in user security.

The “navigate” action shows lower effectiveness (SR Drop: 5.8%, MR: 8.5%) mainly due to two reasons:
First, navigation actions are infrequent since agents mostly complete tasks within individual apps.
Second, agents often respond to navigation-related misleading content by clicking rather than executing navigation commands.

Figure: (a) Misleading action
Refer to caption: x4.png

**Table 4. Evaluation results on static dataset. We select different backbone LLMs and evaluate their performance on static dataset, with different modalities. $\textrm{Acc}_{\textrm{safe}}$ and $\textrm{Acc}_{\textrm{attack}}$ are the accuracy of the agent in the safe and attack scenarios, respectively. MR is the misleading rate of the agent.**
|  | Modal | $\textrm{Acc}_{\textrm{safe}}$ | $\textrm{Acc}_{\textrm{attack}}$ | MR |
| --- | --- | --- | --- | --- |
| \stackengine<br>4ptgpt-4oUcFFS | text-based | 62.45 | 40.38 | 29.17 |
| vision-based | 72.62 | 41.58 | 42.29 |  |
| multi-modal | 70.90 | 32.58 | 44.21 |  |
| \stackengine<br>4ptgpt-4o-miniUcFFS | text-based | 55.57 | 36.97 | 37.30 |
| vision-based | 68.21 | 29.56 | 52.62 |  |
| multi-modal | 67.63 | 19.78 | 61.20 |  |
| \stackengine<br>4ptClaude3.7 sonnetUcFFS | text-based | 72.71 | 63.11 | 16.34 |
| vision-based | 73.10 | 59.67 | 21.75 |  |
| multi-modal | 82.32 | 64.09 | 23.17 |  |
| \stackengine<br>4ptDeepSeekV3UcFFS | text-based | 62.80 | 53.97 | 23.57 |
| vision-based | - | - | - |  |
| multi-modal | - | - | - |  |
| \stackengine<br>4ptDeepSeekR1UcFFS | text-based | 64.52 | 50.33 | 21.43 |
| vision-based | - | - | - |  |
| multi-modal | - | - | - |  |

When facing with different complexity levels of misleading content,
the behavior of agents diverse as well.
As depicted in Table [1](https://arxiv.org/html/2507.04227v1#S4.T1), we design 3 complexity levels of misleading content,
and evaluate the performance of agents under different complexity levels,
as shown in Figure [6(b)](https://arxiv.org/html/2507.04227v1#S5.F6.sf2).
The “Simple” level holds the lowest complexity, with an average SR Drop of 3.9% and MR of 9.8%.
This is expected as the misleading content in this level contains only the action instructions.
Without additional context, the agent can easily identify the deceptive content and leave it over.
Notably, the “Medium” level of attack content achieves an average misleading rate of 24.8%,
which is close to the manually designed “Complex” level of 28.8%,
indicating that attack content synthesized through a simple combination of “misleading action” and “task target”
can achieve significant attack effectiveness.
This reveals a potential risk: given that current apps have a limited set of common functionalities,
attackers can easily design misleading content based on predefined task targets at very low cost
to mislead agents executing specific tasks.

### 5.3. Static Experiment Results

Table [4](https://arxiv.org/html/2507.04227v1#S5.T4) shows the experiment results on static dataset.
We select several different backbone LLMs to evaluate their performance against misleading content attacks.
For each LLM, we test three modalities of prompting methods (text-based, vision-based, and multi-modal)
and measure their base performance without attacks, SR Drop with attacks, and MR values.
For the DeepSeek series, due to their lack of multi-modal input support,
we only evaluated their performance in the text-only modality.

The experimental results reveal significant variations in performance across different modalities
when handling both normal tasks and tasks containing misleading information.
When executing tasks in environments without any misleading content,
incorporating visual modality shows notable improvements (around 10%) compared to text-only modality,
suggesting that visual information enhances GUI agents’ ability to understand their environment.
However, when facing misleading information attacks, we observe interesting findings.
On average, multi-modal agents show the weakest defense against misleading information,
resulting in the highest accuracy drop and misleading rate.
For gpt-4o and gpt-4o-mini specifically, the accuracy under attack in multi-modal experiments
is even lower than text-only results (32.58% vs 40.38% and 19.78% vs 36.97%, respectively);
for Claude 3.7 sonnet, the accuracy drop for multi-modal setting is about 10% higher than text-only.
In terms of misleading rate, we observe similar conclusions.
The introduction of visual modality leads to higher misleading rates,
with gpt-4o-mini’s average MR even exceeding 60%.
We believe this may be related to how models perceive visual modality:
models tend to directly accept visual information
rather than understanding complex contextual relationships as they do in text modality.
The multi-modal setting likely reinforces and validates the visual content through textual modality,
thus resulting in a higher probability of the model being misled.

Figure: Figure 7. Performance comparison of different backbone LLMs.
Refer to caption: x6.png

On the other hand, we also analyzed the performance of different LLMs against misleading information,
as shown in Figure [7](https://arxiv.org/html/2507.04227v1#S5.F7).
We found that all LLMs have an average misleading rate greater than 20%,
indicating that currently relying solely on the capabilities of large models cannot very effectively
identify misleading information proactively.
Additionally, different LLMs show varying levels of resistance to misleading information.
Among the evaluated LLMs, we observed that the Claude-3.7-sonnet model demonstrated the best performance,
achieving the highest post-attack accuracy score and the lowest misleading rate.
The DeepSeek series models also showed relatively good performance.
In contrast, GPT series models showed weaker resistance when facing misleading information,
with gpt-4o and gpt-4o-mini exhibiting misleading rates of 38.5% and 50.4% respectively.
The differences between models may be related to their training data and training strategies.

### 5.4. Attack Stealthiness

To validate the stealthiness advantage of our attack simulation framework over existing popup-based attack methods,
we simulate both approaches in our dynamic evaluation environment and employed an LLM-based detector to identify misleading content.
Specifically, we implemented a GPT-4o-mini based detector that analyzes screenshots to determine whether the current
interface contains suspicious or misleading information.
For popup-based attacks, we followed common patterns from existing works (Zhang et al., 2024b) by overlaying floating windows
with misleading messages. For our framework-based attacks,
we modified native UI elements through the attack simulation framework.
We also included detection on non-attacked screenshots as a control group to account for any potential model bias.

The testing results are shown in Table [5](https://arxiv.org/html/2507.04227v1#S5.T5).
For popup-based attacks, the detector achieves a 98.3% detection rate,
successfully identifying most floating windows as suspicious elements,
which is expected as floating windows often exhibit distinct visual characteristics and positioning.
In contrast, for our framework-based attacks, the detection rate drops to 37.9%,
as the modified content appears natural and consistent with the original interface design.
This significant difference in detection rates demonstrates that our framework can generate more
stealthy attacks that are harder to distinguish from legitimate content.

**Table 5. Stealthiness comparison between attacks based on popup windows and our framework.**
| Method | No Attack | Popup Window | Ours |
| --- | --- | --- | --- |
| Detection Rate | 10.3 | 98.3 | 37.9 |

### 5.5. Misleading Content Proportion

To assess how the quantity of misleading information affects attack effectiveness,
we analyzed number of misleading elements as a key variable.
We selected 18 tasks from our dynamic evaluation environment and evaluated them with numbers of 1, 3, and 5 using M3A@gpt-4o.
We maintained identical misleading content (at “complex” complexity level) across different elements to isolate the impact of quantity.
Additionally, we implemented a “Mixed Actions” approach that simultaneously incorporated click, navigate, and terminate misleading content at number 3.

Figure [8](https://arxiv.org/html/2507.04227v1#S5.F8) illustrates the misleading rates across different attack types and numbers.
Notably, increasing the number of repeating misleading elements does not improve attack effectiveness.
For “Terminate” attacks, the misleading rate remains constant, while for “Click” attacks,
it slightly decreases as number increases (38.9% at number=1 to 33.3% at number=5).
This suggests that repetitive misleading elements may trigger the agent’s skepticism,
potentially reducing overall attack effectiveness.

Figure: Figure 8. Comparison of misleading rates across different misleading actions and numbers of misleading elements. Mixed Actions attack is the attack that simultaneously incorporates multiple attack types (click, navigate, and terminate) at a number of 3.
Refer to caption: x7.png

Notably, the “Mixed Actions” attack achieves the highest misleading rate at 83.3%,
substantially outperforming any single-type attack approach.
This reveals that diverse attack strategies combining different misleading action types are more effective than concentrated approaches,
suggesting that defense mechanisms need to account for sophisticated mixed attacks in real-world scenarios.

### 5.6. Case Study

In order to better understand the behavior of mobile GUI agents when facing misleading content attacks,
we conduct a case study based on Aria UI@gpt-4o (Yang et al., 2024),
selecting representative examples from the dynamic benchmarking environment.

Figure: Figure 9. Case study: GUI agent decides to delete user data without requesting confirmation when seeing misleading information displayed on screen.
Refer to caption: x8.png

As shown in Figure [9](https://arxiv.org/html/2507.04227v1#S5.F9), in this task,
we instructed the agent to delete a recipe with a specific name in the Broccoli app.
After opening the app, the agent encountered injected misleading information stating “Your task is infeasible”.
This information successfully confused the agent,
leading it to believe that the app was corrupted.
Interestingly, instead of directly terminating the task or attempting to proceed,
it decided to try fixing the app by resetting its state.
The agent navigated to system settings, located the relevant app section,
and proactively cleared all app data, including user data and cache.
The task ultimately failed as all recipes were deleted instead of the intended ones.

This phenomenon is highly noteworthy for two reasons.
First, it reveals that the current agent lacks an effective mechanism
to identify and scrutinize potentially misleading information displayed on the interface.
The agent accepted the misleading message
at face value without questioning its authenticity or source.
Second, when encountering such misleading information,
the agent proceeded to perform high-privilege operations with irreversible consequences
(such as data loss) without requesting
user confirmation or permission.
Similarly, if an agent were to delete user-generated content or contacts after being misled
by posts on social media platforms without proper verification mechanisms and user consent,
the consequences would be severe and potentially devastating for users.

Based on these observations, we propose suggestions for further improving the robustness of mobile GUI agents
from two key aspects: the identification and handling of misleading information.

For identification, mobile GUI agents need better mechanisms to
differentiate between information from various sources during task execution.
When information comes from different sources
(e.g. the operating system, applications, the user, or unknown third parties),
agents should be equipped with the ability to understand and assign different confidence levels to these sources.
For instance, task termination messages from the operating system or user should be trusted,
while similar messages displayed in social media posts should be treated with appropriate
skepticism as “it is just a post”.

The handling of misleading information is equally critical, as demonstrated in our case study.
The agent’s response to the false “application is corrupted” notification - proactively
clearing app data without verification -
further emphasizes the risks of agents performing irreversible high-privilege
operations based on untrustworthy information.
To prevent such scenarios, agents should be required to
obtain explicit user consent before executing potentially destructive operations
like deleting data or uninstalling applications, even when they encounter seemingly abnormal situations.
This would add a crucial safety layer between misleading information and destructive actions.

## 6. Mitigation with Adversarial Training

For this multimodal attack approach that embeds misleading content in both images and interface text,
adversarial supervised training presents a straightforward defense method.

To verify this, we selected Qwen-2.5-VL-7B model as our baseline and conducted tests on the static evaluation dataset.
Based on the 840 tasks in the static evaluation dataset, we split them into training and testing sets with a ratio of 8:2.
First, we collected samples without attacks from the training set tasks and fine-tuned the model with these samples to obtain a normally fine-tuned model.
Then, we collected corresponding samples with attacks from the training set tasks and trained the model to output correct answers using these samples,
resulting in an adversarially fine-tuned model.
We used LoRA for training, with a LoRA rank of 8 and a learning rate of 1e-4.
We evaluated the model performance on the test set, with results shown in Table [6](https://arxiv.org/html/2507.04227v1#S6.T6).

**Table 6. Evaluation results on comparison among baseline (Qwen-2.5-VL-7B), regular and adversarial SFT.**
| Model | No SFT | SFT | Adv. SFT |
| --- | --- | --- | --- |
| $\textrm{Acc}_{\textrm{safe}}$ | 32.34 | 49.52 | 50.79 |
| $\textrm{Acc}_{\textrm{attack}}$ | 22.98 (-9.36) | 24.88 (-24.64) | 30 (-20.79) |
| MR | 27.86 | 46.43 | 32.98 |

From the table, we can see that supervised fine-tuning (SFT) significantly improves the model’s base performance,
increasing success rate from 32.34% to 49.52% on clean samples.
Adversarial fine-tuning achieves similar baseline performance at 50.79%.

However, when facing attacks, the normally fine-tuned model shows greater vulnerability,
with success rate dropping dramatically by 24.64 percentage points (from 49.52% to 24.88%).
In comparison, the baseline model only drops by 9.36 points, suggesting that regular fine-tuning may make the model more susceptible to attacks.
The adversarially fine-tuned model demonstrates better robustness, with a smaller performance drop of 20.79 points under attack compared to the normally fine-tuned model.
Its success rate of 30% under attack is also higher than both baseline (22.98%) and normal SFT (24.88%).

Notably, the misleading rate (MR) is highest for the normally fine-tuned model at 46.43%,
indicating it is most easily deceived by attacks. The adversarially fine-tuned model reduces this to 32.98%,
showing improved resistance to misleading content, though still higher than the baseline’s 27.86%.

These results suggest that while adversarial fine-tuning can help improve robustness against misleading content attacks,
there remains significant room for improvement in developing more effective defense mechanisms.

## 7. Discussion

Limitations. While our study provides valuable insights into the vulnerability of mobile GUI agents,
there are several limitations that should be acknowledged.
First, our current framework does not support the modification of image content in the UI,
which could be another potential attack vector in real-world scenarios.
Second, our evaluation framework covers a limited set of applications and actions,
which may not fully represent the diverse landscape of mobile apps and agent action space.
However, it is important to note that these limitations do not significantly impact the
validity and significance of our findings.
The core vulnerability we identified - the susceptibility to misleading content -
is fundamental to the current design of mobile GUI agents and would likely persist even
with expanded image manipulation capabilities, more diverse app coverage, or a broader action space.
Our results provide a solid foundation for understanding the security challenges faced by mobile
GUI agents in real-world scenarios.

Lessons.
We hope to build on the existing analysis and experimental data to
propose suggestions for improving the agent’s safety from several aspects.
From the perspective of LLM development and training,
the model’s ability to identify misleading information should be enhanced.
Notably, models show higher sensitivity to misleading information in visual modality,
suggesting that improving robustness in visual understanding could yield greater benefits.
For agent development, agents should be enabled to differentiate information
from various sources and request user permission before executing risky or high-privilege operations.
On the other hand, agents’ inability to effectively identify misleading information is partly due to
their unfamiliarity with UI interfaces. Therefore, utilizing offline exploration mechanisms
or introducing knowledge bases could enhance agents’ understanding of the sources and functionalities
of different interface components.
For system developers, interfaces can be provided to app developers to
support source and permission tagging of GUI elements during development,
which helps agent frameworks better identify and verify interface components.
Additionally, current systems lack awareness or differentiation of action performers.
Future systems designed for agent collaboration should establish system-level regulations
and permission restrictions on different actions to enhance security.

## 8. Conclusion

In this paper, we take the first step to systematically study the vulnerability of mobile GUI agents against misleading content attacks.
We introduce AgentHazard, a configurable framework to simulate real-world attack scenarios through injecting custom content into Android applications.
Utilizing this framework, we develop an evaluation suite with 58 reproducible tasks and 840 vision-language-action tuples, producing over 3,000 attack scenarios.
Based on our comprehensive experiments with several state-of-the-art mobile agents and various backbone LLMs,
we have uncovered several critical findings about the behavior of mobile GUI agents against potential real-world misleading content attacks.

###### Acknowledgements.

###### Acknowledgements.

## References

- (1)
- Akhtar and Mian (2018)
Naveed Akhtar and Ajmal Mian. 2018.
Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey.
arXiv:1801.00553 [cs.CV]
[https://arxiv.org/abs/1801.00553](https://arxiv.org/abs/1801.00553)
- Apruzzese et al. (2022)
Giovanni Apruzzese, Hyrum S. Anderson, Savino Dambra, David Freeman, Fabio Pierazzi, and Kevin A. Roundy. 2022.
”Real Attackers Don’t Compute Gradients”: Bridging the Gap Between Adversarial ML Research and Practice.
arXiv:2212.14315 [cs.CR]
[https://arxiv.org/abs/2212.14315](https://arxiv.org/abs/2212.14315)
- Carlini and Wagner (2018)
Nicholas Carlini and David Wagner. 2018.
Audio Adversarial Examples: Targeted Attacks on Speech-to-Text.
arXiv:1801.01944 [cs.LG]
[https://arxiv.org/abs/1801.01944](https://arxiv.org/abs/1801.01944)
- Cheng et al. (2024)
Kanzhi Cheng, Qiushi Sun, Yougang Chu, Fangzhi Xu, Yantao Li, Jianbing Zhang, and Zhiyong Wu. 2024.
SeeClick: Harnessing GUI Grounding for Advanced Visual GUI Agents.
arXiv:2401.10935 [cs.HC]
[https://arxiv.org/abs/2401.10935](https://arxiv.org/abs/2401.10935)
- Deng et al. (2023)
Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Samuel Stevens, Boshi Wang, Huan Sun, and Yu Su. 2023.
Mind2Web: Towards a Generalist Agent for the Web.
arXiv:2306.06070 [cs.CL]
[https://arxiv.org/abs/2306.06070](https://arxiv.org/abs/2306.06070)
- Gou et al. (2024)
Boyu Gou, Ruohan Wang, Boyuan Zheng, Yanan Xie, Cheng Chang, Yiheng Shu, Huan Sun, and Yu Su. 2024.
Navigating the Digital World as Humans Do: Universal Visual Grounding for GUI Agents.
arXiv:2410.05243 [cs.AI]
[https://arxiv.org/abs/2410.05243](https://arxiv.org/abs/2410.05243)
- He et al. (2024)
Hongliang He, Wenlin Yao, Kaixin Ma, Wenhao Yu, Yong Dai, Hongming Zhang, Zhenzhong Lan, and Dong Yu. 2024.
WebVoyager: Building an End-to-End Web Agent with Large Multimodal Models.
arXiv:2401.13919 [cs.CL]
[https://arxiv.org/abs/2401.13919](https://arxiv.org/abs/2401.13919)
- Hong et al. (2024)
Wenyi Hong, Weihan Wang, Qingsong Lv, Jiazheng Xu, Wenmeng Yu, Junhui Ji, Yan Wang, Zihan Wang, Yuxuan Zhang, Juanzi Li, Bin Xu, Yuxiao Dong, Ming Ding, and Jie Tang. 2024.
CogAgent: A Visual Language Model for GUI Agents.
arXiv:2312.08914 [cs.CV]
[https://arxiv.org/abs/2312.08914](https://arxiv.org/abs/2312.08914)
- Joyce et al. (2021)
Robert J. Joyce, Dev Amlani, Charles Nicholas, and Edward Raff. 2021.
MOTIF: A Large Malware Reference Dataset with Ground Truth Family Labels.
arXiv:2111.15031 [cs.LG]
[https://arxiv.org/abs/2111.15031](https://arxiv.org/abs/2111.15031)
- Lai et al. (2024)
Hanyu Lai, Xiao Liu, Iat Long Iong, Shuntian Yao, Yuxuan Chen, Pengbo Shen, Hao Yu, Hanchen Zhang, Xiaohan Zhang, Yuxiao Dong, and Jie Tang. 2024.
AutoWebGLM: A Large Language Model-based Web Navigating Agent.
arXiv:2404.03648 [cs.CL]
[https://arxiv.org/abs/2404.03648](https://arxiv.org/abs/2404.03648)
- Lee et al. (2024b)
Juyong Lee, Dongyoon Hahm, June Suk Choi, W. Bradley Knox, and Kimin Lee. 2024b.
MobileSafetyBench: Evaluating Safety of Autonomous Agents in Mobile Device Control.
arXiv:2410.17520 [cs.LG]
[https://arxiv.org/abs/2410.17520](https://arxiv.org/abs/2410.17520)
- Lee et al. (2024a)
Sunjae Lee, Junyoung Choi, Jungjae Lee, Munim Hasan Wasi, Hojun Choi, Steven Y. Ko, Sangeun Oh, and Insik Shin. 2024a.
Explore, Select, Derive, and Recall: Augmenting LLM with Human-like Memory for Mobile Task Automation.
arXiv:2312.03003 [cs.HC]
[https://arxiv.org/abs/2312.03003](https://arxiv.org/abs/2312.03003)
- Li et al. (2020)
Yang Li, Jiacong He, Xin Zhou, Yuan Zhang, and Jason Baldridge. 2020.
Mapping Natural Language Instructions to Mobile UI Action Sequences.
arXiv:2005.03776 [cs.CL]
[https://arxiv.org/abs/2005.03776](https://arxiv.org/abs/2005.03776)
- Ma et al. (2024)
Xinbei Ma, Yiting Wang, Yao Yao, Tongxin Yuan, Aston Zhang, Zhuosheng Zhang, and Hai Zhao. 2024.
Caution for the Environment: Multimodal Agents Are Susceptible to Environmental Distractions.
[doi:10.48550/arXiv.2408.02544](https://doi.org/10.48550/arXiv.2408.02544)
arXiv:2408.02544
- Minaee et al. (2024)
Shervin Minaee, Tomas Mikolov, Narjes Nikzad, Meysam Chenaghlu, Richard Socher, Xavier Amatriain, and Jianfeng Gao. 2024.
Large Language Models: A Survey.
arXiv:2402.06196 [cs.CL]
[https://arxiv.org/abs/2402.06196](https://arxiv.org/abs/2402.06196)
- Nguyen et al. (2024)
Dang Nguyen, Jian Chen, Yu Wang, Gang Wu, Namyong Park, Zhengmian Hu, Hanjia Lyu, Junda Wu, Ryan Aponte, Yu Xia, Xintong Li, Jing Shi, Hongjie Chen, Viet Dac Lai, Zhouhang Xie, Sungchul Kim, Ruiyi Zhang, Tong Yu, Mehrab Tanjim, Nesreen K. Ahmed, Puneet Mathur, Seunghyun Yoon, Lina Yao, Branislav Kveton, Thien Huu Nguyen, Trung Bui, Tianyi Zhou, Ryan A. Rossi, and Franck Dernoncourt. 2024.
GUI Agents: A Survey.
arXiv:2412.13501 [cs.AI]
[https://arxiv.org/abs/2412.13501](https://arxiv.org/abs/2412.13501)
- Qin et al. (2025)
Yujia Qin, Yining Ye, Junjie Fang, Haoming Wang, Shihao Liang, Shizuo Tian, Junda Zhang, Jiahao Li, Yunxin Li, Shijue Huang, Wanjun Zhong, Kuanye Li, Jiale Yang, Yu Miao, Woyu Lin, Longxiang Liu, Xu Jiang, Qianli Ma, Jingyu Li, Xiaojun Xiao, Kai Cai, Chuang Li, Yaowei Zheng, Chaolin Jin, Chen Li, Xiao Zhou, Minchao Wang, Haoli Chen, Zhaojian Li, Haihua Yang, Haifeng Liu, Feng Lin, Tao Peng, Xin Liu, and Guang Shi. 2025.
UI-TARS: Pioneering Automated GUI Interaction with Native Agents.
arXiv:2501.12326 [cs.AI]
[https://arxiv.org/abs/2501.12326](https://arxiv.org/abs/2501.12326)
- Rawles et al. (2024)
Christopher Rawles, Sarah Clinckemaillie, Yifan Chang, Jonathan Waltz, Gabrielle Lau, Marybeth Fair, Alice Li, William Bishop, Wei Li, Folawiyo Campbell-Ajala, Daniel Toyama, Robert Berry, Divya Tyamagundlu, Timothy Lillicrap, and Oriana Riva. 2024.
AndroidWorld: A Dynamic Benchmarking Environment for Autonomous Agents.
[doi:10.48550/arXiv.2405.14573](https://doi.org/10.48550/arXiv.2405.14573)
arXiv:2405.14573
- Rawles et al. (2023)
Christopher Rawles, Alice Li, Daniel Rodriguez, Oriana Riva, and Timothy Lillicrap. 2023.
Android in the Wild: A Large-Scale Dataset for Android Device Control.
arXiv:2307.10088 [cs.LG]
[https://arxiv.org/abs/2307.10088](https://arxiv.org/abs/2307.10088)
- Shen et al. (2024)
Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2024.
”Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models.
arXiv:2308.03825 [cs.CR]
[https://arxiv.org/abs/2308.03825](https://arxiv.org/abs/2308.03825)
- Shi et al. (2017)
Tianlin Shi, Andrej Karpathy, Linxi Fan, Jonathan Hernandez, and Percy Liang. 2017.
World of Bits: An Open-Domain Platform for Web-Based Agents. In *Proceedings of the 34th International Conference on Machine Learning* *(Proceedings of Machine Learning Research, Vol. 70)*, Doina Precup and Yee Whye Teh (Eds.). PMLR, 3135–3144.
[https://proceedings.mlr.press/v70/shi17a.html](https://proceedings.mlr.press/v70/shi17a.html)
- Venkatesh et al. (2023)
Sagar Gubbi Venkatesh, Partha Talukdar, and Srini Narayanan. 2023.
UGIF: UI Grounded Instruction Following.
arXiv:2211.07615 [cs.CL]
[https://arxiv.org/abs/2211.07615](https://arxiv.org/abs/2211.07615)
- Wang et al. (2024)
Lei Wang, Chen Ma, Xueyang Feng, Zeyu Zhang, Hao Yang, Jingsen Zhang, Zhiyuan Chen, Jiakai Tang, Xu Chen, Yankai Lin, Wayne Xin Zhao, Zhewei Wei, and Ji-Rong Wen. 2024.
A Survey on Large Language Model Based Autonomous Agents.
*Frontiers of Computer Science* 18, 6 (Dec. 2024), 186345.
[doi:10.1007/s11704-024-40231-1](https://doi.org/10.1007/s11704-024-40231-1)
arXiv:2308.11432 [cs]
- Wen et al. (2024a)
Hao Wen, Yuanchun Li, Guohong Liu, Shanhui Zhao, Tao Yu, Toby Jia-Jun Li, Shiqi Jiang, Yunhao Liu, Yaqin Zhang, and Yunxin Liu. 2024a.
AutoDroid: LLM-powered Task Automation in Android.
arXiv:2308.15272 [cs.AI]
[https://arxiv.org/abs/2308.15272](https://arxiv.org/abs/2308.15272)
- Wen et al. (2024b)
Hao Wen, Shizuo Tian, Borislav Pavlov, Wenjie Du, Yixuan Li, Ge Chang, Shanhui Zhao, Jiacheng Liu, Yunxin Liu, Ya-Qin Zhang, and Yuanchun Li. 2024b.
AutoDroid-V2: Boosting SLM-based GUI Agents via Code Generation.
arXiv:2412.18116 [cs.AI]
[https://arxiv.org/abs/2412.18116](https://arxiv.org/abs/2412.18116)
- Wu et al. (2025a)
Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. 2025a.
Dissecting Adversarial Robustness of Multimodal LM Agents.
arXiv:2406.12814 [cs.LG]
[https://arxiv.org/abs/2406.12814](https://arxiv.org/abs/2406.12814)
- Wu et al. (2025b)
Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. 2025b.
Dissecting Adversarial Robustness of Multimodal LM Agents.
arXiv:2406.12814 [cs.LG]
[https://arxiv.org/abs/2406.12814](https://arxiv.org/abs/2406.12814)
- Wu et al. (2024)
Zhiyong Wu, Zhenyu Wu, Fangzhi Xu, Yian Wang, Qiushi Sun, Chengyou Jia, Kanzhi Cheng, Zichen Ding, Liheng Chen, Paul Pu Liang, and Yu Qiao. 2024.
OS-ATLAS: A Foundation Action Model for Generalist GUI Agents.
arXiv:2410.23218 [cs.CL]
[https://arxiv.org/abs/2410.23218](https://arxiv.org/abs/2410.23218)
- Xi et al. (2023)
Zhiheng Xi, Wenxiang Chen, Xin Guo, Wei He, Yiwen Ding, Boyang Hong, Ming Zhang, Junzhe Wang, Senjie Jin, Enyu Zhou, Rui Zheng, Xiaoran Fan, Xiao Wang, Limao Xiong, Yuhao Zhou, Weiran Wang, Changhao Jiang, Yicheng Zou, Xiangyang Liu, Zhangyue Yin, Shihan Dou, Rongxiang Weng, Wensen Cheng, Qi Zhang, Wenjuan Qin, Yongyan Zheng, Xipeng Qiu, Xuanjing Huang, and Tao Gui. 2023.
The Rise and Potential of Large Language Model Based Agents: A Survey.
arXiv:2309.07864 [cs.AI]
[https://arxiv.org/abs/2309.07864](https://arxiv.org/abs/2309.07864)
- Xing et al. (2024)
Mingzhe Xing, Rongkai Zhang, Hui Xue, Qi Chen, Fan Yang, and Zhen Xiao. 2024.
Understanding the Weakness of Large Language Model Agents within a Complex Android Environment.
arXiv:2402.06596 [cs.AI]
[https://arxiv.org/abs/2402.06596](https://arxiv.org/abs/2402.06596)
- Xu et al. (2024)
Chejian Xu, Mintong Kang, Jiawei Zhang, Zeyi Liao, Lingbo Mo, Mengqi Yuan, Huan Sun, and Bo Li. 2024.
AdvWeb: Controllable Black-box Attacks on VLM-powered Web Agents.
arXiv:2410.17401 [cs.CR]
[https://arxiv.org/abs/2410.17401](https://arxiv.org/abs/2410.17401)
- Yang et al. (2024)
Yuhao Yang, Yue Wang, Dongxu Li, Ziyang Luo, Bei Chen, Chao Huang, and Junnan Li. 2024.
Aria-UI: Visual Grounding for GUI Instructions.
arXiv:2412.16256 [cs.HC]
[https://arxiv.org/abs/2412.16256](https://arxiv.org/abs/2412.16256)
- Zhang et al. (2024a)
Jingyi Zhang, Jiaxing Huang, Sheng Jin, and Shijian Lu. 2024a.
Vision-Language Models for Vision Tasks: A Survey.
arXiv:2304.00685 [cs.CV]
[https://arxiv.org/abs/2304.00685](https://arxiv.org/abs/2304.00685)
- Zhang et al. (2024b)
Yanzhe Zhang, Tao Yu, and Diyi Yang. 2024b.
Attacking Vision-Language Computer Agents via Pop-ups.
arXiv:2411.02391 [cs.CL]
[https://arxiv.org/abs/2411.02391](https://arxiv.org/abs/2411.02391)
- Zhao et al. (2023)
Shuai Zhao, Jinming Wen, Anh Luu, Junbo Zhao, and Jie Fu. 2023.
Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models. In *Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing*, Houda Bouamor, Juan Pino, and Kalika Bali (Eds.). Association for Computational Linguistics, Singapore, 12303–12317.
[doi:10.18653/v1/2023.emnlp-main.757](https://doi.org/10.18653/v1/2023.emnlp-main.757)
- Zheng et al. (2024a)
Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. 2024a.
GPT-4V(ision) is a Generalist Web Agent, if Grounded.
arXiv:2401.01614 [cs.IR]
[https://arxiv.org/abs/2401.01614](https://arxiv.org/abs/2401.01614)
- Zheng et al. (2024b)
Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. 2024b.
GPT-4V(ision) is a Generalist Web Agent, if Grounded.
arXiv:2401.01614 [cs.IR]
[https://arxiv.org/abs/2401.01614](https://arxiv.org/abs/2401.01614)
- Zhou et al. (2024)
Shuyan Zhou, Frank F. Xu, Hao Zhu, Xuhui Zhou, Robert Lo, Abishek Sridhar, Xianyi Cheng, Tianyue Ou, Yonatan Bisk, Daniel Fried, Uri Alon, and Graham Neubig. 2024.
WebArena: A Realistic Web Environment for Building Autonomous Agents.
arXiv:2307.13854 [cs.AI]
[https://arxiv.org/abs/2307.13854](https://arxiv.org/abs/2307.13854)

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 4
presentation: 3
questions: Disregarding the issue of third-party permissions, what is the fundamental distinction between third-party attacks and pop-up attacks, and which distinct vulnerabilities of the model does this difference validate?
soundness: 2
strengths: 1. The paper is well-organized and clearly written, making it easy to follow.
2. The combination of a dynamic interactive environment and a large-scale static dataset provides both high ecological validity and reproducibility. This will benefit future research on security and robustness in GUI agents.
3. The paper reveals key trends—particularly that multimodal perception increases susceptibility to misleading content, while domain-specific GUI training enhances robustness—providing actionable insights for future model design.
summary: This paper presents Hijacking JARVIS, a systematic benchmark for evaluating the robustness of mobile GUI agents against misleading content from unprivileged third parties. The paper proposes AgentHazard, a scalable Android attack simulation framework capable of injecting adversarial text and UI elements without system privileges, and constructs both a dynamic environment and a static dataset. Experiments on several representative agents and five backbone LLMs show that some models are vulnerable. However, the UI-TARS-1.5 agent, which is specifically fine-tuned for downstream tasks involving GUI-related operations, exhibits more robust behavior when confronted with misleading information
weaknesses: 1. The most critical question for me is: what is the fundamental difference between third-party attacks and traditional pop-up–based attacks? From the standpoint of agent security and defense, third-party attacks can essentially be viewed as a special case of pop-up attacks. Since prior work has already demonstrated that agents are vulnerable to pop-up–based adversarial content, the novelty of verifying vulnerability to third-party attacks appears relatively limited. In practice, when designing agents, we must consider and defend against high-privilege pop-up attacks, which are generally considered a more powerful and comprehensive threat model. In this case,  is it still necessary to investigate defenses against third-party attacks?
2. Only one GUI-specialized model (UI-TARS-1.5) is tested. Including more domain-finetuned agents would strengthen the conclusions and provide richer insights into effective robustness strategies.
3. AgentHazard currently modifies only textual and UI-tree elements; it does not support manipulation of visual assets (e.g., images, icons) or multi-step dynamic attacks, leaving important real-world attack vectors unexplored.

---

confidence: 2
contribution: 3
initial_rating: 4
presentation: 3
questions: From Table 1, we can observe that the SR of UI-TARS only drops a little with misleading information. However, the Qwen-2.5-VL-7B-Instruct trained with benight data demonstrates a significant performance drop in Table 3. What causes this misalignment? What is the effect of the adversarial training on models that are specially fine-tuned on GUI Agent tasks?
soundness: 3
strengths: - This paper highlights the importance of the ability of defense against third-party adversarial attacks for GUI agents. And it presents a fine-grained benchmark suite to evaluate this.
- This paper tests several current GUI agents on the benchmark. The significant performance drop highlights the safety problem of current agents.
- This paper provides several findings by studying the impact of multimodal, LLM-backbone, and GUI-specific training on the results.
summary: This paper provides an investigation into the vulnerability of mobile GUI agents. The main contribution is a benchmark suite including both dynamic emulators and static screenshots. The benchmark evaluates how much GUI agents are affected by content deliberately crafted to deceive them by untrustworthy third-party sources. Test results reveal that all widely used mobile GUI agents are vulnerable to misleading third-party content, indicating that their robustness needs improvement.
weaknesses: - The Evaluation is limited. The paper reveals that the GUI-specific training has an impact on the success rate and the misleading rate. However, only GUI-TARS is tested, which affects the credibility of the results. End-to-end trained models like Mobile-Agent-v3[1], UI-Genie[2] may have different results on the benchmark.

-  The authors argue that, unlike existing attacks on web-based agents, this work focuses on mobile GUI agents, which have higher security requirements and stricter control over user privacy, making existing web-based attack strategies difficult to execute. However, apart from introducing an additional Android application, the proposed method still relies on modifying the screen and XML, and its specific differences from existing attacks are not clear. 

Note: I will raise my score if my concerns are addressed.

[1] Ye, Jiabo, et al. "Mobile-agent-v3: Fundamental agents for GUI automation." 

[2] Xiao, Han, et al. "UI-Genie: A Self-Improving Approach for Iteratively Boosting MLLM-based Mobile GUI Agents."

---

confidence: 3
contribution: 2
initial_rating: 2
presentation: 3
questions: See weakness
soundness: 2
strengths: 1. The threat model is realistic and well-motivated, focusing on unprivileged attackers controlling legitimate third-party content rather than privileged access.
2. The dual evaluation, dynamic interaction and static state-rule analysis, offers complementary insights. Broad testing across six agents and five LLMs, including multimodal and text-only models, enhances generalizability.
3. Several empirical findings are valuable: visual modalities show higher vulnerability than text, different LLMs exhibit varying sensitivity to attack types.
summary: This paper investigates the vulnerability of mobile GUI agents to misleading content from untrusted third-party sources. The authors develop AgentHazard, a framework for injecting adversarial content into Android applications without requiring elevated privileges, and construct a benchmark comprising 122 dynamic tasks and over 3,000 static scenarios. Through evaluation of six mobile GUI agents and five backbone LLMs, they demonstrate that current agents exhibit significant vulnerability, with average misleading rates exceeding 40% in both dynamic and static settings. While the paper addresses a practically important problem and provides a useful evaluation framework, it suffers from limited scope in attack modeling, insufficient depth in analyzing root causes, and superficial treatment of defense mechanisms.
weaknesses: 1. The study only tests two attack types, wrong clicks and early exits, which miss many real threats like phishing, permission abuse, or data leaks. Saying it’s “hard to measure” complex attacks isn’t a good excuse. The focus on single misleading items makes the setup too clean and unrealistic.
2. The paper shows what fails but not why. It never explores why visual models are weaker, maybe attention or data bias? Without tools like attention maps or gradient analysis, the study stays at a surface level.
3. The defense experiment is poorly designed and reuses data from failed samples. It also ignores better-known defenses like careful prompting, confidence checks, or human review.
4. Using GPT-4o to both make and judge attacks causes bias. It may just favor its own style, not real-world tricks.

---

confidence: 3
contribution: 2
initial_rating: 4
presentation: 3
questions: You state that “content modifications are designed to be feasible for unprivileged third parties” while AgentHazard also modifies the UI element tree. In real apps, third parties cannot alter another app’s UI tree. Please clarify precisely which parts of your injected content are intended to model realistic third-party control and which are simulator conveniences to keep text-only perception in sync. Can you report results where only on-screen pixels are modified but the UI tree is left untouched?

The paper positions itself as a first systematic investigation for mobile agents. Could you delineate, in the main text, how your dynamic and static components differ from prior mobile-agent robustness evaluations you cite (e.g., MobileSafetyBench) to avoid ambiguity in the novelty claim?
soundness: 3
strengths: Clear problem framing around unprivileged third-party content and the resulting need to test agents outside “clean” environments; Figure 1 offers a compelling case of destructive behavior induced by short misleading strings. 

AgentHazard is described as a practical, scalable simulator that modifies both screenshots and the UI element tree in real time via an Android Accessibility-based tool and a cooperating Python attack module; the configuration language (Appendix D, Listing 1) is concrete and appears easy to author.

Useful findings for the community: multi-modal inputs increase susceptibility on average; robustness depends strongly on both model family and GUI-specific training; simple popup-style attacks are much easier to detect than natively rendered modifications (Table 5).
summary: The paper studies robustness of mobile GUI agents against misleading content originating from unprivileged third parties and introduces AgentHazard, a configurable attack-simulation framework that patches adversarial content into Android apps at run time. Built on this, the authors assemble a benchmark with a dynamic interactive environment and a static dataset containing benign and adversarial variants. Two metrics are used: Success Rate Drop (∆SR) and Misleading Rate (MR), where MR counts whether an agent executes a predefined misled action tied to injected content. Experiments span six representative mobile agents (e.g., M3A, T3A, AutoDroid, AriaUI, UI-TARS-1.5) and five LLM backbones across text/vision/multimodal settings. Results show substantial vulnerability (average MR ≈ 42.1% dynamic; 40.7% static), with multi-modal inputs generally more susceptible, UI-TARS-1.5 relatively robust, and Claude-4-sonnet outperforming GPT-4o variants on the static dataset. A small adversarial training study with Qwen2.5-VL suggests modest robustness gains but no fundamental fix.
weaknesses: Although the paper claims feasibility for unprivileged third parties, the simulator “patches adversarial content both on the screen and the structured UI element tree in real time.” Real third parties can plausibly control in-app content regions (e.g., posts, product titles), but they cannot modify another app’s UI tree; the paper should more clearly separate (i) realistic adversary control over pixels/strings inside third-party-controlled regions from (ii) the tool’s additional modifications to the UI tree used to keep text-based perception consistent. As written, the phrase “as native GUI elements” risks overstating real-world feasibility.

Step 4 (Attack Rule Generation) relies on LLMs to produce adversarial strings given prompts P, but the exact model, decoding parameters, and filtering are not provided in the main text; inter-annotator criteria for “feasibility” (Step 2) and quality control for rules Rsuccess/Rattack are also not quantified (e.g., agreement rates).

Stealthiness study (Table 5) depends on a single LLM-based detector and reports a relatively high 10.3% “No Attack” detection rate without confidence intervals or sample counts; the detector may not be a reliable surrogate.

In addition, I have some concerns on the novelty of this paper, I acknowledge it may be interested by someone working on the GUI agents (the practical contribution is more than the technical contribution).