Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

2026-08-09

AI Summary

This study addresses the vulnerability of mobile AI agents to indirect prompt injection attacks stemming from their uncritical reliance on Android Accessibility (A11y) metadata and on-screen text, which can lead to task hijacking, context drift, and unauthorized actions. The work presents the first systematic characterization and taxonomy of such attacks and advocates for integrating zero-trust input validation, dedicated security agents, and strict context isolation into agent architectures. Experiments conducted within the MobileRun and Mobile-Use frameworks leverage multimodal inputs—combining accessibility trees with screenshots—and employ large language models including Gemma-4:31B and Qwen-3.6:35B. Results reveal a high attack success rate of 0.822 on MobileRun, while Mobile-Use reduces it to 0.150 yet still exhibits insufficient semantic boundary enforcement, underscoring critical security gaps in current mobile agent frameworks.

Abstract

The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely primarily on Android accessibility (A11y) trees and secondarily on visual screenshots. In this paper, we demonstrate that this architectural dependence on unsanitized accessibility metadata, together with visual input, introduces a systemic vulnerability to indirect prompt injection. We show that adversarial prompts can cause autonomous agents to abandon their original objectives, violate context boundaries, and perform unauthorized device actions. Our empirical evaluation demonstrates goal hijacking, context drift, and unauthorized actions across visually hidden and fully exposed attack scenarios. In aggregate, MobileRun reaches an attack success rate of 0.822 with Gemma4:31B, while Mobile-Use with Qwen3.6:35B reduces this to 0.150 but does not eliminate context drift or unauthorized actions. These findings reveal that current mobile agent frameworks fail to enforce semantic context boundaries, treating passive environmental text as trusted instructions. Finally, we present a taxonomy of these attacks and discuss the need for zero-trust input validation, dedicated security agents, and strict context isolation within mobile agent architectures.

Problem

• indirect prompt injection
• mobile AI agents
• Android accessibility
• context drift
• unauthorized actions

Innovation

• indirect prompt injection
• mobile AI agents
• Android accessibility
• context isolation
• zero-trust validation