Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

Researchers have identified critical vulnerabilities in five open-source Android AI agent frameworks—AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA—that enable attackers to execute arbitrary code on host PCs through invisible screen text, screenshot tampering, and broadcast interception. The attack chain leverages insufficient input sanitization, TOCTOU race conditions during screenshot capture, and unauthenticated broadcast receivers to escalate from a malicious app to full command execution. Although no CVEs have been assigned and no real-world exploitation has been observed, the attack preconditions are easily met via publicly available documentation, and no project maintainers have responded to responsible disclosure attempts.

AI-extracted · verify before operational use