{"id":"https://openalex.org/W7167028603","doi":"https://doi.org/10.48550/arxiv.2607.00333","title":"(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents","display_name":"(A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents","publication_year":2026,"publication_date":"2026-07-01","ids":{"openalex":"https://openalex.org/W7167028603","doi":"https://doi.org/10.48550/arxiv.2607.00333"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.00333","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.00333","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.00333","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139906360","display_name":"Zidong Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Zidong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137901331","display_name":"Zhentao Xie","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xie, Zhentao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5080378687","display_name":"Wenrui Diao","orcid":"https://orcid.org/0000-0003-0916-8806"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Diao, Wenrui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5139855237","display_name":"Jianliang Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Jianliang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5115000009536743,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.5115000009536743,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.20059999823570251,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12203","display_name":"Mobile Agent-Based Network Management","score":0.08990000188350677,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.7006999850273132},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5741000175476074},{"id":"https://openalex.org/keywords/mobile-device","display_name":"Mobile device","score":0.5719000101089478},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.5489000082015991},{"id":"https://openalex.org/keywords/privilege","display_name":"Privilege (computing)","score":0.5285999774932861},{"id":"https://openalex.org/keywords/mobile-apps","display_name":"Mobile apps","score":0.42730000615119934},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.3741999864578247},{"id":"https://openalex.org/keywords/side-channel-attack","display_name":"Side channel attack","score":0.3531999886035919},{"id":"https://openalex.org/keywords/mobile-computing","display_name":"Mobile computing","score":0.32749998569488525}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.7006999850273132},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6524999737739563},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6355999708175659},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5741000175476074},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.5719000101089478},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.5489000082015991},{"id":"https://openalex.org/C2780138299","wikidata":"https://www.wikidata.org/wiki/Q3404265","display_name":"Privilege (computing)","level":2,"score":0.5285999774932861},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.4408000111579895},{"id":"https://openalex.org/C2988145974","wikidata":"https://www.wikidata.org/wiki/Q620615","display_name":"Mobile apps","level":2,"score":0.42730000615119934},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3741999864578247},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.3531999886035919},{"id":"https://openalex.org/C144543869","wikidata":"https://www.wikidata.org/wiki/Q2738570","display_name":"Mobile computing","level":2,"score":0.32749998569488525},{"id":"https://openalex.org/C127162648","wikidata":"https://www.wikidata.org/wiki/Q16858953","display_name":"Channel (broadcasting)","level":2,"score":0.32429999113082886},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.32199999690055847},{"id":"https://openalex.org/C26760741","wikidata":"https://www.wikidata.org/wiki/Q160402","display_name":"Perception","level":2,"score":0.3192000091075897},{"id":"https://openalex.org/C84875433","wikidata":"https://www.wikidata.org/wiki/Q3277848","display_name":"Mobile agent","level":2,"score":0.3116999864578247},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.30300000309944153},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.29980000853538513},{"id":"https://openalex.org/C89505385","wikidata":"https://www.wikidata.org/wiki/Q47146","display_name":"User interface","level":2,"score":0.2872999906539917},{"id":"https://openalex.org/C121822524","wikidata":"https://www.wikidata.org/wiki/Q5157582","display_name":"Computer security model","level":2,"score":0.28450000286102295},{"id":"https://openalex.org/C48677424","wikidata":"https://www.wikidata.org/wiki/Q6888088","display_name":"Mode (computer interface)","level":2,"score":0.2770000100135803},{"id":"https://openalex.org/C2780428219","wikidata":"https://www.wikidata.org/wiki/Q16952335","display_name":"Cover (algebra)","level":2,"score":0.27250000834465027},{"id":"https://openalex.org/C2776576444","wikidata":"https://www.wikidata.org/wiki/Q303569","display_name":"Attack surface","level":2,"score":0.2637999951839447},{"id":"https://openalex.org/C151496658","wikidata":"https://www.wikidata.org/wiki/Q310661","display_name":"Subliminal stimuli","level":2,"score":0.26089999079704285}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.00333","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.00333","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.00333","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.00333","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.8128103613853455,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Third-party":[0],"mobile":[1,65,76,102,161],"agents":[2,19],"powered":[3],"by":[4],"Vision-Language":[5],"Models":[6],"(VLMs)":[7],"have":[8],"emerged":[9],"as":[10,21],"a":[11,166,192],"promising":[12],"paradigm":[13],"for":[14,64,205],"automating":[15],"smartphone":[16],"interactions.":[17],"These":[18,189],"act":[20],"high-privilege":[22],"decision-makers,":[23],"perceiving":[24],"device":[25],"states":[26],"through":[27],"screenshots":[28],"and":[29,79,93,115,118,134,143,151,173,200],"executing":[30],"actions":[31,172],"via":[32],"VLM":[33],"reasoning,":[34],"transforming":[35],"how":[36],"an":[37],"agent":[38,77,162,171,198],"app":[39,168],"interacts":[40],"with":[41,84],"the":[42,48,85,88,104,111,119,128,202],"environment":[43],"(i.e.,":[44],"other":[45],"apps":[46,78,81],"or":[47,57,126],"OS).":[49],"Correspondingly,":[50],"this":[51,68],"transformation":[52],"introduces":[53],"new":[54],"attack":[55,97],"surfaces":[56,98],"transforms":[58],"benign/harmless":[59],"interfaces":[60],"into":[61],"exploitable":[62],"ones":[63],"devices.":[66],"In":[67],"paper,":[69],"we":[70],"summarize":[71],"key":[72],"differences":[73],"between":[74,113],"third-party":[75],"general":[80,101],"when":[82],"interacting":[83],"environment,":[86],"analyze":[87],"security":[89,207],"posture":[90],"of":[91,158],"agents,":[92],"identify":[94],"two":[95],"unique":[96],"compared":[99],"to":[100,148,187],"apps:":[103],"Screen":[105],"Perception":[106],"Attack":[107,122],"Surface,":[108,123],"which":[109,124],"exploits":[110],"gap":[112],"human":[114],"machine":[116],"vision,":[117],"Misused":[120],"Channel":[121],"intercepts":[125],"manipulates":[127],"agent's":[129],"execution":[130,177],"pipeline.":[131],"We":[132],"design":[133,199],"implement":[135],"seven":[136],"concrete":[137],"attacks,":[138],"from":[139],"subliminal":[140],"text":[141],"injection":[142],"invisible":[144],"pixel":[145],"zone":[146],"exploitation":[147],"screenshot":[149],"tampering":[150],"host":[152],"PC":[153],"command":[154,176],"injection.":[155],"Our":[156],"evaluation":[157],"five":[159],"popular":[160],"frameworks":[163],"demonstrates":[164],"that":[165],"malicious":[167],"can":[169],"hijack":[170],"achieve":[174],"arbitrary":[175],"even":[178],"without":[179],"any":[180],"privilege":[181],"permissions,":[182],"while":[183],"remaining":[184],"visually":[185],"indistinguishable":[186],"users.":[188],"findings":[190],"reveal":[191],"fundamental":[193],"trust":[194],"mismatch":[195],"in":[196],"autonomous":[197],"highlight":[201],"urgent":[203],"need":[204],"perception-aware":[206],"models":[208],"on":[209],"multi-tenant":[210],"platforms.":[211]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-03T00:00:00"}