Mobile agents observe both rendered screens and accessibility metadata. MobileInject constructs attacker-controlled observations where a malicious objective appears consistent across those channels. The same untrusted application can supply both descriptions, so perceived agreement is not independent evidence of user intent. The benchmark then follows model…
Inspect the ClaimsCase · DiggingBeagle record
MobileInject shows how matching screenshots and accessibility text can mislead mobile agents
MobileInject builds paired visual and text observation attacks in stateful Android tasks, targeting the link between reasoning and actual action.
Scope
Controlled Android emulator benchmark with 108 risk instances; no reported commercial application breach.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- not applicable
- AI role
- AGAINST AI
Basis and provenance
Technical report or researcher-controlled experiments document the stated mechanism, but independent reproduction and population-wide prevalence are not established. Impact band is left unassigned because no calibrated damage threshold or representative victim impact is supported by the available record.
Assessed Oct 20, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MOBILE-SETUP · CLM-MOBILE-CORROBORATION · MobileInject: Cross-modal consistency injection in Android AI agents
At a glance
An agent must distinguish two independent confirmations from two renderings of the same untrusted source.
Read the implicationsNo in-the-wild malicious application identified. Action completion rates may not generalize across different device permission models.
Limits and uncertaintyFull account
Mobile agents observe both rendered screens and accessibility metadata. MobileInject constructs attacker-controlled observations where a malicious objective appears consistent across those channels. The same untrusted application can supply both descriptions, so perceived agreement is not independent evidence of user intent. The benchmark then follows model reasoning through real emulator actions to distinguish internal persuasion from achieved effects.
The authors report 108 executable risk instances across 11 scenarios and nine risk categories. Those are constructed evaluation cases, not 108 incidents in mobile apps. The research establishes an observation provenance risk but does not show a specific commercial banking or messaging app compromised in deployment.
The apparent corroboration is circular when both the screenshot and accessibility tree are produced by one attacker-controlled app or observation bridge. Comparing the two representations can increase confidence without increasing independent evidence. The benchmark's action traces are stronger than a purely textual jailbreak result, but they still belong to controlled emulator tasks with configured permissions.
Timeline
- Oct 19, 2026disclosure
Public disclosure
Claims & evidence
CLM-MOBILE-SETUPMobileInject implements 108 Android-emulator risk instances across 11 application scenarios and nine risk categories.supported
Basis: reported finding
- supportsMobileInject: Cross-modal consistency injection in Android AI agentsprimary disclosure
Abstract; benchmark construction
CLM-MOBILE-CORROBORATIONThe benchmark tests attacks that place semantically consistent malicious goals into visual and textual observations, which can share one attacker-controlled origin.supported
Basis: reported finding
- supportsMobileInject: Cross-modal consistency injection in Android AI agentsprimary disclosure
Cross-Modal Consistency Injection methods
Implications
An agent must distinguish two independent confirmations from two renderings of the same untrusted source.
Unknowns and contradictions
- No in-the-wild malicious application identified.
- Action completion rates may not generalize across different device permission models.
Sources and citation
Material revision history
- Oct 20, 2026 · Canonical change recorded · new in release · revision 177