Why it matters
Academic researchers evaluated five open-source mobile-agent frameworks against seven attacks that exploit the gap between what a vision model and a user can see. Subliminal overlays, pixels hidden beneath phone bezels, screenshot races, and forged activities redirected agent actions; in four frameworks, unsanitized model-generated ADB input also enabled command execution on the host PC.
My takeaway: Treat screenshots, overlays, accessibility events, and model-produced device input as untrusted data. Use deterministic command construction without shell interpolation, isolate screenshot storage, constrain host privileges, preserve visual provenance, and require approval for the exact action that will execute—not the agent’s description of it.