Mobile agents on phones face new cross-modal security injection risks
MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection
Cryptography and SecurityArtificial Intelligence
Summary
Mobile agents that help with tasks on smartphones can understand and act on information from different sources like images and text. This ability also gives bad actors a way to trick these agents by hiding harmful instructions in apps or content that the agent sees. The authors created MobileInject, a test system that checks how well these mobile agents stand up to such tricky attacks across multiple types of content. Their tests show many mobile agents are vulnerable, especially when the attackers confuse the agents' reasoning early on.
What this means in practice
- •For mobile app developers: Evaluate and improve the security of mobile agents against attacks that exploit multiple content types simultaneously.
- •For mobile security teams: Use MobileInject framework to detect and analyze vulnerabilities in reasoning and actions of mobile assistants before deployment.
Authors
Songping Wang, Peiyang Li, Yi Huang, Fengting Li, Xuhao Ran, Yueming Lyu, Chao Feng, Caifeng Shan
Abstract
Multimodal large language model (MLLM)-based mobile agents are rapidly evolving from conversational assistants into autonomous systems that perceive, reason over, and act on smartphone environments. This capability also exposes a new security risk: adversaries can embed malicious objectives in cross-application mobile content and steer agent behavior through indirect multimodal injection. Although prompt injection has been studied in desktop and web settings, its cross-modal properties in mobile ecosystems remain poorly understood, and existing security analyses are still limited. To close this gap, we introduce MobileInject, the first benchmark for evaluating mobile agents against multimodal injection attacks and reasoning-to-action security risks. MobileInject provides a high-fidelity interactive mobile evaluation framework covering 11 scenarios, 9 security-risk categories, and 108 executable risk instances. It further introduces Cross-Modal Consistency Injection to exploit corroboration across modalities, two enhanced attack methods, Multi-Role Collaborative Deception and Reasoning-Camouflage Injection, to intensify trust manipulation and reasoning hijacking, and a Reasoning Security Diagnosis Framework for fine-grained failure analysis. Systematic experiments show that mobile agents are broadly vulnerable to multimodal injection, and that many failures stem from reasoning hijacking at early stages. These findings establish MobileInject as a systematic cross-modal benchmark for studying and improving the security of mobile agents. Code release details are provided in the Appendix Open Science section.