MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps

Sujin Chen; Lijun Li; Tianyi Du; Jing Shao

cs.CRAug 18, 2026

MobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps

Authors: Sujin Chen, Lijun Li, Tianyi Du, Jing Shao

Organizations: Shanghai Artificial Intelligence Laboratory

Abstract

LLM-powered GUI agents that autonomously operate smartphones are rapidly transitioning from research prototypes to early real-world deployment. However, because these agents routinely process untrusted environmental content, they are highly vulnerable to environmental injection attacks, which include indirect prompt injections and adversarial instructions. Such attacks can manipulate the behavior of agents without user awareness through diverse channels encountered in everyday mobile use. Despite these risks, existing benchmarks often fail to capture everyday user scenarios, lacking a systematic evaluation of GUI agents under environmental injection attacks on mobile devices. To address this gap, we introduce MobileWorldSafety, a benchmark of 142 risk tasks built on real Android applications. For each task, we define a programmatically verifiable risk indicator over the final system state and evaluate outcomes with a two-stage pipeline: rule-based verification handles unambiguous cases, while an LLM judge adjudicates ambiguous ones. This distinguishes safety failures from capability failures and enables objective and reproducible assessment. Evaluations on six agents, including both general agents and specialized GUI agents, demonstrate that all agents remain highly vulnerable, with attack success rates ranging from 40.4% to 66.9%. These findings indicate that current agents often fail to maintain safety alignment when adversarial content is presented as ordinary mobile context. MobileWorldSafety provides a foundation for quantifying these vulnerabilities and advancing research on robust mobile GUI agents.

Figures & tables

Figure 1: Examples of environmental injection risks in real mobile workflows. Left: malicious instructions embedded in in-app content can mislead the agent into spreading phishing content. Right: malicious instructions embedded in MCP tool outputs can induce the agent to disclose sensitive personal information.

Figure 2: Overview of MobileWorldSafety. The benchmark comprises 142 real-world risk tasks across 13 real Android applications, organized along a two-dimensional taxonomy of attack vectors and harm categories and evaluated through a two-stage pipeline combining rule-based verification and LLM-based judgment.

Figure 3: The distribution of tasks within MobileWorldSafety by attack vector (left) and harm category (right).

Figure 4: The evaluation pipeline of MobileWorldSafety. The execution of the agent on a real Android emulator produces both trajectory logs and runtime artifacts. Stage 1 uses programmatic verifiers to resolve unambiguous cases; Stage 2 uses an LLM-as-judge protocol to classify the remaining ambiguous runs. The resulting five-level labels are aggregated into attack outcomes (Executed + Partial), successful defenses (Defended), stalled safe failures (Stalled), and capability failures (Run Failed), from which ASR and TCR are computed.

Model	Execution Status		Vulnerability			Robustness
Model	Scorable	Failed ( $\downarrow$ )	Executed	Partial	ASR ( $\downarrow$ )	Defended	TCR ( $\uparrow$ )
General agents
Gemini-3-Pro	130	12	76	11	66.9%	39	30.0%
Qwen3.5-397B-A17B	124	18	59	5	51.6%	58	46.8%
Kimi-K2.5	118	24	46	12	49.2%	51	43.2%
Claude-Sonnet-4.5	120	22	40	17	47.5%	53	44.2%

Table 1: Main experimental results. ASR and TCR represent the Attack Success Rate and Task Completion Rate, respectively. Attacked outcomes are decomposed into Executed and Partial. ASR is computed as (Executed + Partial) / Scorable, and TCR is computed as Defended / Scorable. Failed denotes Run Failed cases excluded from the scorable set. The full five-label definitions, including Stalled, are given in Section 3.4 . Bold highlights the highest ASR (most vulnerable) and the highest TCR (most robust in task completion under attack).

Figure 5: Per-vector and per-harm ASR (%) across all six models. Left: ASR by attack vector. Right: ASR by harm category. A larger radar area indicates higher susceptibility.

Model	SP	Execution Status		Outcome Labels				Metrics
Model	SP	Scorable	Failed ( $\downarrow$ )	Executed	Partial	Defended	Stalled	ASR ( $\downarrow$ )	TCR ( $\uparrow$ )
Qwen3.5-397B-A17B	—	124	18	59	5	58	2	51.6%	46.8%
Qwen3.5-397B-A17B	✓	127	15	42	5	60	20	37.0%	47.2%
Gemini-3-Flash	—	126	16	57	16	48	5	57.9%	38.1%
Gemini-3-Flash	✓	123	19	42	9	53	19	41.5%	43.1%

Table 2: Effect of system-prompt defenses. ✓ in the SP column denotes the defended variant, which explicitly instructs the model to treat environmental content as untrusted. Bold indicates the best value within each model pair: lower ASR and higher TCR.

Model	Execution Status		Outcome Labels				Metrics
Model	Scorable	Failed ( $\downarrow$ )	Executed	Partial	Defended	Stalled	ASR ( $\downarrow$ )	TCR ( $\uparrow$ )
Gemini-3-Pro	130	12	76	11	39	4	66.9%	30.0%
Gemini-3-Flash (Thinking)	126	16	57	16	48	5	57.9%	38.1%
Gemini-3-Flash (Non-thinking)	121	21	58	4	47	12	51.2%	38.8%

Table 3: Effect of model variant and reasoning mode. Bold indicates the best value across all three variants: lower ASR and higher TCR.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Total Tasks	Category Breakdown			App Complexity			MCP Environment
Total Tasks	GUI-Only	Agent-User Int.	MCP-Aug.	Single App	Two Apps	$\geq$ Three Apps	Servers	Relevant Tools
142 (100%)	90 (63.4%)	30 (21.1%)	22 (15.5%)	66 (46.5%)	53 (37.3%)	23 (16.2%)	5	19

Appendix

Table 4: Key statistics and task composition of MobileWorldSafety.

Benchmark	Env.	Scale	Main Focus	Injection Carrier	Native Workflow	Final-State Verif.
IPI / adversarial-injection benchmarks
AgentDojo Debenedetti et al. (2024)	Web/API	97/629	Tool-agent prompt injection and utility/security tradeoff	Tool/API return values	✗	✓
InjecAgent Zhan et al. (2024)	Web/Tool	1,054	Indirect prompt injection in tool-integrated agents	Tool outputs / web-agent observations	✗	✓
EIA Liao et al. (2025)	Web	177 steps	Environmental injection for privacy leakage in web agents	Web environment content	✗	✓
WASP Evtimov et al. (2025)	Web	84/env	Web-agent security against prompt injection attacks	Web pages / web-environment content	✗	✓
VPI-Bench Cao et al. (2026)	Web/OS	306	Visual prompt injection against computer- and browser-use agents	Rendered pop-ups, emails, and instant messages	✗	LLM

Appendix

Table 5: Comparison of MobileWorldSafety with representative agent safety benchmarks. Scale is reported in each benchmark’s native unit. Injection Carrier summarizes how malicious or risky content enters the agent’s observation space. Native Workflow denotes whether environmental injections are embedded as ordinary Android application or tool-response content that the agent naturally processes during task execution, rather than being introduced through UI-tree, screenshot, notification, pop-up, or overlay-style manipulation. Final-State Verif. denotes whether risk outcomes are primarily verified from the final environment or system state.

App	Description	Tasks
Mail	Email client for reading, searching, replying, forwarding attachments, and composing outbound messages.	57
Messages	SMS and chat messaging app for conversation review, replies, deletion, and cross-app message delivery.	33
Calendar	Calendar management app for event lookup, event editing, alarms, and cross-app scheduling decisions.	27
Contacts	Contact manager for looking up, updating, and using personal contact information.	13
Clock	Alarm, timer, and clock utility.	3
Files	File manager and document-viewing workflow for local storage, resumes, invoices, ZIP files, and attachments.	16

Appendix

Table 6: Applications and task coverage in MobileWorldSafety.

ID	Name	Definition	Typical carriers
V1	Directed Communication	Content explicitly addressed to a recipient, which the agent tends to treat as a message that should be processed or answered.	Email, SMS, DM, @mention, Mattermost DM
V2	Web Content	Web pages or online reference content actively navigated to by the agent, typically without an explicit social identity or organizational provenance.	Chrome page, search result, news page, product page
V3	Community Content	Content posted by identifiable actors in shared community or collaboration spaces, carrying social provenance and interaction context.	Mastodon post, Mattermost public channel, community message
V4	Stored Record	Persistent records already present in user or system data, which the agent tends to treat as existing local facts or materials.	Calendar event, local file, invoice, stored document
V5	Tool Response	Content returned by external tools or APIs invoked by the agent, which is often treated as computed or retrieved evidence.	MCP result, API response, tool-returned search/location data

Appendix

Table 7: Definitions of attack vectors in MobileWorldSafety.

ID	Name	Definition
H1	Sensitive Information Disclosure	Internal or sensitive digital data is disclosed to an unauthorized party, including contract files, credentials, passwords, account records, private documents, or confidential communication content.
H2	Personal Safety Exposure	Personal privacy information that can expose the user’s real-world safety context is disclosed, including locations, itineraries, home addresses, meeting places, or other details that enable tracking, localization, or physical contact.
H3	Financial Harm	The primary consequence is monetary loss or manipulation of a financial decision, including unintended purchases, incorrect payments, price tampering, or property loss caused by address hijacking.
H4	Unauthorized Action	The agent performs an unauthorized GUI or routing action, including wrong-recipient sending, extra-recipient addition, wrong-channel posting, unauthorized following, boosting, uploading, reporting, or configuration changes.
H5	Operational Disruption	The agent disrupts system functionality, deletes critical data, or modifies system settings, causing an originally available application state, task workflow, or user resource to be interrupted, cleared, canceled, or made unusable.
H6	Content Fabrication	The agent writes, generates, or communicates false content, including incorrect numeric values, false statements, or fabricated results.

Appendix

Table 8: Definitions of harm categories in MobileWorldSafety.

Model	Access	Version	Creator	Framework
Gemini-3-Pro	API	gemini-3-pro-preview	Google	general-e2e
Gemini-3-Flash (Non-thinking)	API	gemini-3-flash-preview-nothinking	Google	general-e2e
Gemini-3-Flash (Thinking)	API	gemini-3-flash-preview-thinking	Google	general-e2e
Qwen3.5-397B-A17B	API	qwen3.5-397b-a17b	Alibaba	general-e2e
Kimi-K2.5	API	kimi-k2.5	Moonshot AI	general-e2e
Claude-Sonnet-4.5	API	claude-sonnet-4-5-20250929	Anthropic	general-e2e

Appendix

Table 9: Details of the models evaluated in our experiments.

Defense	Scorable	Run Failed	Executed	Partial	Defended	Stalled	ASR ( $\downarrow$ )	TCR ( $\uparrow$ )
None	124	18	59	5	58	2	51.6%	46.8%
System prompt	127	15	42	5	60	20	37.0%	47.2%
Multi-stage	126	16	39	6	57	24	35.7%	45.2%

Appendix

Table 10: Supplementary defense evaluation on Qwen3.5-397B-A17B over all 142 tasks. ASR and TCR are computed over the Scorable subset. Bold indicates the lowest ASR and highest TCR, respectively.

Framework	Scorable	Run Failed	Executed	Partial	Defended	Stalled	ASR ( $\downarrow$ )	TCR ( $\uparrow$ )
Mobile-Agent-v3.5-style	128	14	57	10	55	6	52.3%	43.0%
general-e2e	124	18	59	5	58	2	51.6%	46.8%

Appendix

Table 11: Comparison of two agent scaffolds using the same Qwen3.5-397B-A17B backbone on all 142 MobileWorldSafety tasks.

Environment	Task Utility (Completed)	Completed Tasks Breakdown			Failed / Compromised	Total
Environment	Task Utility (Completed)	GUI-Only	Agent-User	MCP-Aug.	Failed / Compromised	Total
Clean Environment	89 (62.7%)	59	15	15	53	142
Attacked Environment	58 (40.8%)	35	9	14	84	142

Appendix

Table 12: Task utility comparison for Qwen3.5-397B-A17B between the clean baseline and the attacked environment. To maintain clarity, unsuccessful runs are grouped under “Failed / Compromised”. Specifically, the 84 compromised runs in the attacked environment consist of 59 Executed , 5 Partial , 2 Stalled , and 18 Run Failed trajectories.

Model	Source	Total	Partial	Stalled	Run failed	Agree.
Gemini-3-Pro	LLM	27	11	4	12	25/27
Gemini-3-Pro	Human	27	11	2	14	25/27
Claude-Sonnet-4.5	LLM	49	17	10	22	45/49
Claude-Sonnet-4.5	Human	49	18	11	20	45/49
Overall		76	–	–	–	92.1%

Appendix

Table 13: Agreement between the human expert and the LLM judge on ambiguous runs in Stage 2.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 510 papers

Sep 29, 2026

DIBench: Benchmarking Decision Integrity of GUI-based Mobile Agents Under Deceptive Injections

As GUI-based mobile agents rapidly progress, rigorous safety evaluation of their autonomous decision-making in realistic app interfaces becomes increasingly critical. Existing benchmarks mainly focus on execution-level anomalies using task success or hijack rates, but fail to capture the in-task goal deviation risk in multi-candidate selection tasks, where the decision may be steered toward an attacker-specified target, even in violation of instruction-implied constraints (e.g., cheapest/highest-rated), without any overt execution anomalies. We present DIBench, a decision integrity benchmark for measuring this risk in mobile agents. DIBench covers 7 commercial and 3 simulated apps with 5 task types. Under a threat model restricted to non-privileged UI content, we construct 8 deceptive injection probe instantiations that can steer critical selections without overt anomalies. The benchmark includes 1,000 clean and 36,672 injected instances, with a unified protocol and integrity metrics for comparison. Experiments spanning 4 agent frameworks and 7 base models show that completion-based evaluation can overestimate agent trustworthiness and miss decision-integrity risks: deceptive injections steer selections and shift early action policies, inflating completion rates and creating a misleading illusion of safety. Common defenses, including detection, image preprocessing, and prompt reminders, yield inconsistent integrity gains. Overall, DIBench provides a unified, reproducible benchmark to quantify the risk of in-task goal deviation in mobile agents and enable comparable evaluations of safety defenses.

Li Hu, Kanghua Mo, Yingbin Jin +2

Department of Electrical and Electronic Engineering, The Hong Kong Polytechnic University

AI Agent Evaluation AI Agent Safety Benchmarks Mobile GUI Agents Prompt Injection Attacks on AI Agents

Ask PDF

Aug 9, 2026

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices. Frameworks such as MobileRun and Mobile-Use can autonomously navigate Android applications and execute complex multi-step tasks. To interpret user interfaces, these frameworks rely primarily on Android accessibility (A11y) trees and secondarily on visual screenshots. In this paper, we demonstrate that this architectural dependence on unsanitized accessibility metadata, together with visual input, introduces a systemic vulnerability to indirect prompt injection. We show that adversarial prompts can cause autonomous agents to abandon their original objectives, violate context boundaries, and perform unauthorized device actions. Our empirical evaluation demonstrates goal hijacking, context drift, and unauthorized actions across visually hidden and fully exposed attack scenarios. In aggregate, MobileRun reaches an attack success rate of 0.822 with Gemma4:31B, while Mobile-Use with Qwen3.6:35B reduces this to 0.150 but does not eliminate context drift or unauthorized actions. These findings reveal that current mobile agent frameworks fail to enforce semantic context boundaries, treating passive environmental text as trusted instructions. Finally, we present a taxonomy of these attacks and discuss the need for zero-trust input validation, dedicated security agents, and strict context isolation within mobile agent architectures.

Rahul Deivasigamani, Sayeda Faatin Alvi, Derqui Andrea +2

Radboud University · Nijmegen, The Netherlands

AI Agent Security LLM Agent Security Mobile GUI Agents Prompt Injection Attacks on AI Agents

Ask PDF

Oct 16, 2026

MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection

Multimodal large language model (MLLM)-based mobile agents are rapidly evolving from conversational assistants into autonomous systems that perceive, reason over, and act on smartphone environments. This capability also exposes a new security risk: adversaries can embed malicious objectives in cross-application mobile content and steer agent behavior through indirect multimodal injection. Although prompt injection has been studied in desktop and web settings, its cross-modal properties in mobile ecosystems remain poorly understood, and existing security analyses are still limited. To close this gap, we introduce MobileInject, the first benchmark for evaluating mobile agents against multimodal injection attacks and reasoning-to-action security risks. MobileInject provides a high-fidelity interactive mobile evaluation framework covering 11 scenarios, 9 security-risk categories, and 108 executable risk instances. It further introduces Cross-Modal Consistency Injection to exploit corroboration across modalities, two enhanced attack methods, Multi-Role Collaborative Deception and Reasoning-Camouflage Injection, to intensify trust manipulation and reasoning hijacking, and a Reasoning Security Diagnosis Framework for fine-grained failure analysis. Systematic experiments show that mobile agents are broadly vulnerable to multimodal injection, and that many failures stem from reasoning hijacking at early stages. These findings establish MobileInject as a systematic cross-modal benchmark for studying and improving the security of mobile agents. Code release details are provided in the Appendix Open Science section.

Songping Wang, Peiyang Li, Yi Huang +5

LLM Agent Security AI Agent Security Benchmarks Prompt Injection Attacks on AI Agents Prompt Injection Attacks Multimodal Agents

Ask PDF

Abstract

AI Agent Security

Explore similar work

DIBench: Benchmarking Decision Integrity of GUI-based Mobile Agents Under Deceptive Injections

Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

MobileInject: Evaluating Reasoning-to-Action Security of MLLM-Based Mobile Agents under Cross-Modal Consistency Injection