Not an A11y: How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection

arXiv:2608.08939 · cs.AI · Submitted 2026-08-09 · Read on arXiv

Rahul Deivasigamani, Sayeda Faatin Alvi, Derqui Andrea, Kaushal Punjabi, Stjepan Picek

cs.AI

Submitted: 2026-08-09

Updated: 2026-08-11

Code: https://github.com/rahuldeiv/Not-An-A11y

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Indirect Prompt Injection — 21× in this paper · explained in 2 episodes
• Benchmark — 15× in this paper · explained in 2 episodes
• Trace — 11× in this paper · explained in 2 episodes
• AI Agents — 10× in this paper · explained in 2 episodes
• Provenance — 5× in this paper · explained in 5 episodes
• Agentic AI — 3× in this paper · explained in 2 episodes
• Attack Success Rate — 3× in this paper
• Augmentation — 3× in this paper · explained in 2 episodes
• Benchmarking — 3× in this paper · explained in 4 episodes
• Consistency — 3× in this paper · explained in 3 episodes
• Verification — 3× in this paper · explained in 2 episodes
• Android Debug Bridge — 2× in this paper
• Core — 2× in this paper · explained in 2 episodes
• Multi-Agent Architecture — 2× in this paper · explained in 2 episodes
• Planner — 2× in this paper · explained in 3 episodes
• Prompt Injection Attacks — 2× in this paper · explained in 2 episodes
• Unauthorized Action Rate — 2× in this paper
• Accuracy — 1× in this paper · explained in 1 episode
• Agentic Framework — 1× in this paper · explained in 7 episodes
• Attack Success Rate (ASR) — 1× in this paper · explained in 3 episodes
• Context Drift Rate — 1× in this paper
• Multi-Agent Framework — 1× in this paper · explained in 3 episodes
• Reasoning Traces — 1× in this paper · explained in 4 episodes
• Task Decomposition — 1× in this paper · explained in 2 episodes

Sources

• Defeating Prompt Injections by Design
• Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels
• Do Multi-Agents Dream of Electric Screens? Achieving Perfect Accuracy on AndroidWorld Through Task Decomposition
• MobileWorld: Benchmarking Autonomous Mobile Agents in Agent-User Interactive and MCP-Augmented Environments
• Curiosity Driven Knowledge Retrieval for Mobile Agents
• AppAgent v2: Advanced Agent for Flexible Mobile Interactions
• MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
• Ignore Previous Prompt: Attack Techniques For Language Models
• AndroidWorld: A Dynamic Benchmarking Environment for Autonomous Agents
• Gemma 4 Technical Report
• Mobile-Agent: Autonomous Multi-Modal Mobile Device Agent with Visual Perception
• AppAgent: Multimodal Agents as Smartphone Users
• MobileSafetyBench: Evaluating Safety of Autonomous Agents in Mobile Device Control
• (A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents
• Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Related papers

• MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
• Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
• Agents' Last Exam
• The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
• MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
• Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems