Researchers found prompt-based safeguards barely slowed malicious instructions planted in everyday mobile content, a warning for enterprises piloting agents that act on employee devices.
AI assistants that operate smartphones can be tricked by fake instructions hidden in everyday messages, emails and calendar invites, a new study has found. On average, the assistants spotted the planted instruction in only about one in five tests. In about half the tests, they carried out what the attacker wanted.
The findings come from MobileInject, a benchmark built by researchers at Nanjing University, Ant Group and Peking University and published Oct. 16 as a preprint on arXiv. The paper has not been peer reviewed.
The researchers tested nine multimodal models: OpenAI’s GPT-4.1 and GPT-5.4-Nano, Google’s Gemini-2.5-Flash and Gemini-3-Flash, three Alibaba Qwen models and two Z.ai GLM models. Each ran inside two research agent frameworks, M3A and MobAgent, on an Android emulator across 108 attack scenarios.
The agents were given routine tasks such as replying to a message, adding a contact or creating a calendar entry. The researchers treated everything an agent sees during a task as potentially untrusted, including messages, emails, notifications and web pages. Attackers could only plant content the agent would encounter along the way. They could not alter the system prompt, the model or the user’s instructions.
Attackers succeed half the time
Attackers reached their goal in 51.13% of runs under MobAgent and 50.31% under M3A, the paper said. Agents completed the user’s actual task under attack only 17.59% and 11.11% of the time, respectively.
Results varied widely by model. Gemini-3-Flash was the most resistant, with a 24.07% attack success rate and 54.63% task completion under MobAgent. GLM-4.5V fared worst, with 83.33% attack success and 0.93% task completion.
The attacks covered nine categories of harm, including privacy exposure, financial misconduct, data tampering and phishing. Privacy leakage attempts succeeded 70.37% of the time on average across models, according to the paper’s category breakdown.
The researchers also tracked the reasoning the agents recorded at each step. On average, that reasoning was hijacked in 75.31% of runs under MobAgent and 80.86% under M3A. Once compromised, agents rarely recovered in later steps. The authors said this exposes “shallow and fragile safety alignment in mobile environments.”
Two channels beat one
The paper’s central attack technique exploits the fact that mobile agents typically read each screen twice: once as a screenshot and once as a structured interface tree. The researchers call the technique Cross-Modal Consistency Injection.
In controlled tests on Gemini-2.5-Flash, placing a malicious instruction once in each channel achieved 85.4% attack success. Repeating it twice in the text channel reached 72.9%, and twice in the visual channel reached 27.8%. In 30 of the 108 scenarios, neither channel succeeded alone but the combined attack did.
The authors said the screenshot anchors the instruction to the current interface, while the text version makes it directly actionable. They tested two further techniques. One mimics authority and user-consent cues. The other disguises the malicious request as the next logical step of the user’s task, and it raised attack success by 5.6 to 16.7 percentage points across six baseline attacks, the paper said.
Prompt defenses fall short
The researchers tested five prompt-level defenses, including input delimiters, safety reminders and structured safety reasoning. The best performer, known as SCoT, cut attack success from 83.33% to 70.37% on the GLM-4.5V baseline. The paper said that reduction was not statistically significant.
“Prompt-level guidance alone is insufficient to reliably preserve the trusted task under cross-modal injection pressure,” the authors wrote. They called for source-aware filtering of what agents observe, consistency checks across the visual and text channels, and verification of actions against device state.
The study has limits. It tested research frameworks in an emulator rather than commercial assistants. Most models evaluated are smaller or earlier tiers rather than the vendors’ flagship systems. The paper does not say whether the affected vendors were notified.
