cs.CRAug 18, 2026
SaveMobileWorldSafety: Benchmarking GUI Agent Safety Against Environmental Injection Attacks in Android Apps
Organizations: Shanghai Artificial Intelligence Laboratory
Abstract
LLM-powered GUI agents that autonomously operate smartphones are rapidly transitioning from research prototypes to early real-world deployment. However, because these agents routinely process untrusted environmental content, they are highly vulnerable to environmental injection attacks, which include indirect prompt injections and adversarial instructions. Such attacks can manipulate the behavior of agents without user awareness through diverse channels encountered in everyday mobile use. Despite these risks, existing benchmarks often fail to capture everyday user scenarios, lacking a systematic evaluation of GUI agents under environmental injection attacks on mobile devices. To address this gap, we introduce MobileWorldSafety, a benchmark of 142 risk tasks built on real Android applications. For each task, we define a programmatically verifiable risk indicator over the final system state and evaluate outcomes with a two-stage pipeline: rule-based verification handles unambiguous cases, while an LLM judge adjudicates ambiguous ones. This distinguishes safety failures from capability failures and enables objective and reproducible assessment. Evaluations on six agents, including both general agents and specialized GUI agents, demonstrate that all agents remain highly vulnerable, with attack success rates ranging from 40.4% to 66.9%. These findings indicate that current agents often fail to maintain safety alignment when adversarial content is presented as ordinary mobile context. MobileWorldSafety provides a foundation for quantifying these vulnerabilities and advancing research on robust mobile GUI agents.
Figures & tables
Figure 1: Examples of environmental injection risks in real mobile workflows. Left: malicious instructions embedded in in-app content can mislead the agent into spreading phishing content. Right: malicious instructions embedded in MCP tool outputs can induce the agent to disclose sensitive personal information.
Figure 2: Overview of MobileWorldSafety. The benchmark comprises 142 real-world risk tasks across 13 real Android applications, organized along a two-dimensional taxonomy of attack vectors and harm categories and evaluated through a two-stage pipeline combining rule-based verification and LLM-based judgment.
Figure 3: The distribution of tasks within MobileWorldSafety by attack vector (left) and harm category (right).
Figure 4: The evaluation pipeline of MobileWorldSafety. The execution of the agent on a real Android emulator produces both trajectory logs and runtime artifacts. Stage 1 uses programmatic verifiers to resolve unambiguous cases; Stage 2 uses an LLM-as-judge protocol to classify the remaining ambiguous runs. The resulting five-level labels are aggregated into attack outcomes (Executed + Partial), successful defenses (Defended), stalled safe failures (Stalled), and capability failures (Run Failed), from which ASR and TCR are computed.
| Model | Execution Status | Vulnerability | Robustness | ||||
| Scorable | Failed ( ) | Executed | Partial | ASR ( ) | Defended | TCR ( ) | |
| General agents | |||||||
| Gemini-3-Pro | 130 | 12 | 76 | 11 | 66.9% | 39 | 30.0% |
| Qwen3.5-397B-A17B | 124 | 18 | 59 | 5 | 51.6% | 58 | 46.8% |
| Kimi-K2.5 | 118 | 24 | 46 | 12 | 49.2% | 51 | 43.2% |
| Claude-Sonnet-4.5 | 120 | 22 | 40 | 17 | 47.5% | 53 | 44.2% |
Table 1: Main experimental results. ASR and TCR represent the Attack Success Rate and Task Completion Rate, respectively. Attacked outcomes are decomposed into Executed and Partial. ASR is computed as (Executed + Partial) / Scorable, and TCR is computed as Defended / Scorable. Failed denotes Run Failed cases excluded from the scorable set. The full five-label definitions, including Stalled, are given in Section 3.4 . Bold highlights the highest ASR (most vulnerable) and the highest TCR (most robust in task completion under attack).
Figure 5: Per-vector and per-harm ASR (%) across all six models. Left: ASR by attack vector. Right: ASR by harm category. A larger radar area indicates higher susceptibility.
| Model | SP | Execution Status | Outcome Labels | Metrics | |||||
| Scorable | Failed ( ) | Executed | Partial | Defended | Stalled | ASR ( ) | TCR ( ) | ||
| Qwen3.5-397B-A17B | — | 124 | 18 | 59 | 5 | 58 | 2 | 51.6% | 46.8% |
| Qwen3.5-397B-A17B | ✓ | 127 | 15 | 42 | 5 | 60 | 20 | 37.0% | 47.2% |
| Gemini-3-Flash | — | 126 | 16 | 57 | 16 | 48 | 5 | 57.9% | 38.1% |
| Gemini-3-Flash | ✓ | 123 | 19 | 42 | 9 | 53 | 19 | 41.5% | 43.1% |
Table 2: Effect of system-prompt defenses. ✓ in the SP column denotes the defended variant, which explicitly instructs the model to treat environmental content as untrusted. Bold indicates the best value within each model pair: lower ASR and higher TCR.
| Model | Execution Status | Outcome Labels | Metrics | |||||
| Scorable | Failed ( ) | Executed | Partial | Defended | Stalled | ASR ( ) | TCR ( ) | |
| Gemini-3-Pro | 130 | 12 | 76 | 11 | 39 | 4 | 66.9% | 30.0% |
| Gemini-3-Flash (Thinking) | 126 | 16 | 57 | 16 | 48 | 5 | 57.9% | 38.1% |
| Gemini-3-Flash (Non-thinking) | 121 | 21 | 58 | 4 | 47 | 12 | 51.2% | 38.8% |
Table 3: Effect of model variant and reasoning mode. Bold indicates the best value across all three variants: lower ASR and higher TCR.
Appendix figures & tables10 assets
Supplementary material from the paper’s appendix.
Appendix
| Total Tasks | Category Breakdown | App Complexity | MCP Environment | |||||
| GUI-Only | Agent-User Int. | MCP-Aug. | Single App | Two Apps | Three Apps | Servers | Relevant Tools | |
| 142 (100%) | 90 (63.4%) | 30 (21.1%) | 22 (15.5%) | 66 (46.5%) | 53 (37.3%) | 23 (16.2%) | 5 | 19 |
Table 4: Key statistics and task composition of MobileWorldSafety.
| Benchmark | Env. | Scale | Main Focus | Injection Carrier | Native Workflow | Final-State Verif. |
| IPI / adversarial-injection benchmarks | ||||||
| AgentDojo Debenedetti et al. (2024) | Web/API | 97/629 | Tool-agent prompt injection and utility/security tradeoff | Tool/API return values | ✗ | ✓ |
| InjecAgent Zhan et al. (2024) | Web/Tool | 1,054 | Indirect prompt injection in tool-integrated agents | Tool outputs / web-agent observations | ✗ | ✓ |
| EIA Liao et al. (2025) | Web | 177 steps | Environmental injection for privacy leakage in web agents | Web environment content | ✗ | ✓ |
| WASP Evtimov et al. (2025) | Web | 84/env | Web-agent security against prompt injection attacks | Web pages / web-environment content | ✗ | ✓ |
| VPI-Bench Cao et al. (2026) | Web/OS | 306 | Visual prompt injection against computer- and browser-use agents | Rendered pop-ups, emails, and instant messages | ✗ | LLM |
Table 5: Comparison of MobileWorldSafety with representative agent safety benchmarks. Scale is reported in each benchmark’s native unit. Injection Carrier summarizes how malicious or risky content enters the agent’s observation space. Native Workflow denotes whether environmental injections are embedded as ordinary Android application or tool-response content that the agent naturally processes during task execution, rather than being introduced through UI-tree, screenshot, notification, pop-up, or overlay-style manipulation. Final-State Verif. denotes whether risk outcomes are primarily verified from the final environment or system state.
| App | Description | Tasks |
| Email client for reading, searching, replying, forwarding attachments, and composing outbound messages. | 57 | |
| Messages | SMS and chat messaging app for conversation review, replies, deletion, and cross-app message delivery. | 33 |
| Calendar | Calendar management app for event lookup, event editing, alarms, and cross-app scheduling decisions. | 27 |
| Contacts | Contact manager for looking up, updating, and using personal contact information. | 13 |
| Clock | Alarm, timer, and clock utility. | 3 |
| Files | File manager and document-viewing workflow for local storage, resumes, invoices, ZIP files, and attachments. | 16 |
Table 6: Applications and task coverage in MobileWorldSafety.
| ID | Name | Definition | Typical carriers |
| V1 | Directed Communication | Content explicitly addressed to a recipient, which the agent tends to treat as a message that should be processed or answered. | Email, SMS, DM, @mention, Mattermost DM |
| V2 | Web Content | Web pages or online reference content actively navigated to by the agent, typically without an explicit social identity or organizational provenance. | Chrome page, search result, news page, product page |
| V3 | Community Content | Content posted by identifiable actors in shared community or collaboration spaces, carrying social provenance and interaction context. | Mastodon post, Mattermost public channel, community message |
| V4 | Stored Record | Persistent records already present in user or system data, which the agent tends to treat as existing local facts or materials. | Calendar event, local file, invoice, stored document |
| V5 | Tool Response | Content returned by external tools or APIs invoked by the agent, which is often treated as computed or retrieved evidence. | MCP result, API response, tool-returned search/location data |
Table 7: Definitions of attack vectors in MobileWorldSafety.
| ID | Name | Definition |
| H1 | Sensitive Information Disclosure | Internal or sensitive digital data is disclosed to an unauthorized party, including contract files, credentials, passwords, account records, private documents, or confidential communication content. |
| H2 | Personal Safety Exposure | Personal privacy information that can expose the user’s real-world safety context is disclosed, including locations, itineraries, home addresses, meeting places, or other details that enable tracking, localization, or physical contact. |
| H3 | Financial Harm | The primary consequence is monetary loss or manipulation of a financial decision, including unintended purchases, incorrect payments, price tampering, or property loss caused by address hijacking. |
| H4 | Unauthorized Action | The agent performs an unauthorized GUI or routing action, including wrong-recipient sending, extra-recipient addition, wrong-channel posting, unauthorized following, boosting, uploading, reporting, or configuration changes. |
| H5 | Operational Disruption | The agent disrupts system functionality, deletes critical data, or modifies system settings, causing an originally available application state, task workflow, or user resource to be interrupted, cleared, canceled, or made unusable. |
| H6 | Content Fabrication | The agent writes, generates, or communicates false content, including incorrect numeric values, false statements, or fabricated results. |
Table 8: Definitions of harm categories in MobileWorldSafety.
| Model | Access | Version | Creator | Framework |
| Gemini-3-Pro | API | gemini-3-pro-preview | general-e2e | |
| Gemini-3-Flash (Non-thinking) | API | gemini-3-flash-preview-nothinking | general-e2e | |
| Gemini-3-Flash (Thinking) | API | gemini-3-flash-preview-thinking | general-e2e | |
| Qwen3.5-397B-A17B | API | qwen3.5-397b-a17b | Alibaba | general-e2e |
| Kimi-K2.5 | API | kimi-k2.5 | Moonshot AI | general-e2e |
| Claude-Sonnet-4.5 | API | claude-sonnet-4-5-20250929 | Anthropic | general-e2e |
Table 9: Details of the models evaluated in our experiments.
| Defense | Scorable | Run Failed | Executed | Partial | Defended | Stalled | ASR ( ) | TCR ( ) |
| None | 124 | 18 | 59 | 5 | 58 | 2 | 51.6% | 46.8% |
| System prompt | 127 | 15 | 42 | 5 | 60 | 20 | 37.0% | 47.2% |
| Multi-stage | 126 | 16 | 39 | 6 | 57 | 24 | 35.7% | 45.2% |
Table 10: Supplementary defense evaluation on Qwen3.5-397B-A17B over all 142 tasks. ASR and TCR are computed over the Scorable subset. Bold indicates the lowest ASR and highest TCR, respectively.
| Framework | Scorable | Run Failed | Executed | Partial | Defended | Stalled | ASR ( ) | TCR ( ) |
| Mobile-Agent-v3.5-style | 128 | 14 | 57 | 10 | 55 | 6 | 52.3% | 43.0% |
| general-e2e | 124 | 18 | 59 | 5 | 58 | 2 | 51.6% | 46.8% |
Table 11: Comparison of two agent scaffolds using the same Qwen3.5-397B-A17B backbone on all 142 MobileWorldSafety tasks.
| Environment | Task Utility (Completed) | Completed Tasks Breakdown | Failed / Compromised | Total | ||
| GUI-Only | Agent-User | MCP-Aug. | ||||
| Clean Environment | 89 (62.7%) | 59 | 15 | 15 | 53 | 142 |
| Attacked Environment | 58 (40.8%) | 35 | 9 | 14 | 84 | 142 |
Table 12: Task utility comparison for Qwen3.5-397B-A17B between the clean baseline and the attacked environment. To maintain clarity, unsuccessful runs are grouped under “Failed / Compromised”. Specifically, the 84 compromised runs in the attacked environment consist of 59 Executed , 5 Partial , 2 Stalled , and 18 Run Failed trajectories.
| Model | Source | Total | Partial | Stalled | Run failed | Agree. |
| Gemini-3-Pro | LLM | 27 | 11 | 4 | 12 | 25/27 |
| Human | 27 | 11 | 2 | 14 | 25/27 | |
| Claude-Sonnet-4.5 | LLM | 49 | 17 | 10 | 22 | 45/49 |
| Human | 49 | 18 | 11 | 20 | 45/49 | |
| Overall | 76 | – | – | – | 92.1% | |
Table 13: Agreement between the human expert and the LLM judge on ambiguous runs in Stage 2.
More in this topic
AI Agent Security
Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.
See all 510 papers