An AI Agent Acts on What It Sees. Researchers Made Five Android Agents See Text No Human Could — and Walked It From the Phone Onto the PC.

We keep saying the interesting attacks of this era don't break the wall — they borrow the trust of whoever's standing on the other side of it. Yesterday it was AI coding agents writing a config file a trusted tool ran. Last week it was malware hiding its command channel in a Microsoft 365 calendar. Today it's the cleanest version yet: researchers made an AI agent read instructions that were on the screen but invisible to the human holding the phone — and turned that into code execution on the PC behind it.

The whole trick, in one sentence

An AI agent that drives a phone works by looking at the screen and acting on what it sees. So you show it text a person can't. An Android app with two ordinary permissions — the ability to draw over other windows, and the ability to write to shared storage — can layer instructions onto the screen in a way no human eye will register, but the agent's screen-reading pipeline ingests them as if they were part of the app it's supposed to be operating. The agent obeys, because obeying what's on screen is its entire job.

That is the injection. What makes this research land is the second half: the chain doesn't stop on the phone. The same app writes the smuggled instructions into a shared file, the agent carries them across, and two steps later the text that started as invisible pixels on a phone is running commands on the host PC driving the agent. From an overlay on a phone screen to code execution on a laptop, through nothing but the agent's own trust in what it perceives.

Five frameworks, five failures

This isn't a one-app problem. The researchers tested five open-source mobile-agent frameworks — including AppAgent, AppAgentX, and Open-AutoGLM, the last of which carries more than 25,000 GitHub stars — and all five failed at least six of the lab attacks. That's the tell that this is architectural, not a bug in someone's code. Every one of these systems made the same foundational assumption: that what appears on the screen is trustworthy input. It isn't, and it can't be, for the same reason we flagged in yesterday's sandbox-escape piece — the boundary isn't the wall around the agent, it's every channel the agent trusts as ground truth. Here the trusted channel is the screen itself, which is a hard channel to distrust when reading the screen is the point.

Microsoft said the quiet part out loud in their own May write-up on Semantic Kernel, which produced its own CVEs: "your LLM is not a security boundary." This research is that sentence turned into a working exploit chain. An agent's perception is not a security boundary either. If an attacker can influence what the agent perceives — and an overlay permission is a very low bar to clear — the attacker can influence what the agent does.

Why invisibility is the dangerous part

Prompt injection is old news by now. What's new and genuinely nasty here is that the injection is invisible to the operator. Most of our defenses against agents doing something stupid rest on a human being in the loop — you watch what the agent is doing, and you stop it if it goes somewhere wrong. That safeguard assumes you and the agent are looking at the same screen. This attack breaks that assumption at the root: the agent is reading a screen you cannot fully see. The human-in-the-loop is looking at the app; the agent is looking at the app plus a layer of instructions painted just outside human perception. You can't catch what you can't see, and the entire point of the technique is to make sure you can't see it.

Pair that with the phone-to-host pivot and the blast radius is not "the agent did something weird on my phone." It's "an app I installed ran code on my computer, and the only visible evidence was an AI assistant behaving normally."

What to actually do

If you're running any of these open-source mobile-agent frameworks — and with Open-AutoGLM past 25,000 stars, plenty of people are — treat the agent's screen-reading pipeline as an untrusted input channel, because that is exactly what this research proves it is. Concretely:

Lock down overlay permissions hard. The SYSTEM_ALERT_WINDOW / draw-over-other-apps permission is the enabling primitive for the invisible-text layer; an app that has it near your agent is the threat, and most apps have no legitimate need for it. Audit what on the device can draw over other windows and revoke it aggressively.

Treat shared storage as a crossing point, not a convenience. The phone-to-host chain runs through a file both the malicious app and the agent can touch. Isolate what the agent reads from what arbitrary apps can write, and don't let the agent's host-side component blindly execute or trust anything that arrived from the phone.

And architecturally, the lesson generalizes past Android: do not let an AI agent's perception be your security boundary. Whatever an agent reads — a screen, a document, an image, a calendar event, a dataset — is an input an attacker will try to control. The mitigations that work are the boring ones: least privilege on the primitives that let attackers shape that input, and a hard, distrustful gate between "the agent decided to do this" and "this actually executes."

We hold this at 95 percent, as always — the framework testing and the exploit chain are the researchers' work, corroborated by the trade press, not our own capture. There's nothing here to add to a blocklist; the vulnerability is a design assumption shared across five projects, not an IP or a hash. What's ours is the pattern we keep pointing at, now confirmed one more time: the attacks that matter don't defeat the guard, they feed it something it was built to trust. This week alone that trusted thing has been a config file, a calendar, and now the screen itself — and the agent obeyed every time, exactly as designed.

---

Sources: research on open-source Android mobile-agent frameworks via The Hacker News; Microsoft's "your LLM is not a security boundary" statement from its May 2026 Semantic Kernel write-up (CVE-2026-25592, CVE-2026-26030). Frameworks named as tested include AppAgent, AppAgentX, and Open-AutoGLM (25k+ GitHub stars). No network indicators are associated with this research; nothing was ingested. Companion pieces this week: our coverage of the Cursor/Codex/Gemini sandbox escapes and the HollowGraph M365-calendar C2 — the same borrowed-trust shape.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com