Mobile agent attacks exploit different user and agent views of apps
When Agents See Differently: Exposing UI Desynchronization Threats in Mobile Agents
Cryptography and Security
Summary
Mobile apps are controlled both by humans who see the screen and by automated 'agents' that read app content digitally. The authors found that these agents can see parts of the app that humans can't or see information differently. This mismatch can let attackers trick agents into doing harmful things while humans think everything is normal. They built tools to test and create these tricky app versions and showed these attacks work in many popular agent systems. Finally, people tested rarely noticed the visual tweaks used to trick agents.
What this means in practice
- •For mobile app developers: Detect and prevent UI mismatches that could allow attackers to manipulate mobile agents through repackaged app versions.
- •For mobile security teams: Evaluate mobile apps for potential UI desynchronization vulnerabilities that attackers may exploit to mislead automated agents.
Authors
Heng Li, Fulin Zhao, Zhe Geng, Zhiyuan Yao, Wei Yuan, Xiapu Luo
Abstract
Mobile agents are increasingly capable of autonomously interacting with mobile applications and performing consequential actions on behalf of users. Effective human oversight of such agents relies on a basic premise: users and agents observe consistent information from the same interface. We show that this premise can be systematically violated. Users perceive mobile interfaces through physical displays and the human visual system, making their observations subject to occlusion and luminance contrast limitations. In contrast, agents consume digital screenshots that may retain such content and accessibility representations that expose nonvisual widget metadata. The same UI state can therefore present materially different information to users and agents, a mismatch we term human-agent UI desynchronization. We investigate whether a repackaged clone of a legitimate APK can exploit this desynchronization to steer an agent toward attacker-designated actions, while remaining fully functional and behaviorally consistent with the original application for human users. We demonstrate that this threat is feasible: perturbations embedded before deployment can induce such deviations without access to runtime user instructions, agent detection or online adaptation. To systematically expose and evaluate this threat, we develop an automated framework that constructs user runtime instruction-agnostic UI desynchronization attacks and realizes them in deployable APKs. We conduct static and dynamic evaluations across five mobile-agent frameworks and three backbone models on 546 tasks involving various applications, achieving average misleading rates of 77.9% and 66.9%, respectively. A complementary questionnaire-based study with 186 participants finds that the visual perturbations used in our attacks are difficult for human users to notice.