MobileWorldSafety is a benchmark that evaluates the safety of large language model–powered GUI agents on Android by exposing them to 142 real-world risk tasks involving environmental injection attacks. The benchmark uses a two‑stage verification pipeline—rule‑based checks for clear cases and an LLM judge for ambiguous ones—to distinguish safety failures from capability failures. Experiments on six agents show high vulnerability, with attack success rates between 40.4% and 66.9%, highlighting that current agents often fail to remain safe when faced with adversarial content presented as normal mobile context.
By Sujin Chen, Lijun Li, Tianyi Du, Jing Shao
arXiv:2608. 08939v1 Announce Type: new Abstract: The rise of autonomous AI agents represents a major paradigm shift in how users interact with mobile devices.
By Rahul Deivasigamani, Sayeda Faatin Alvi, Derqui Andrea, Kaushal Punjabi, Stjepan Picek
arXiv:2606. 26707v1 Announce Type: cross Abstract: Adversarial APKs are Android applications modified in the problem space to evade machine-learning malware detectors.
By Christian Scano, Diego Soi, Angelo Sotgiu, Luca Demetrio, Davide Maiorca, Giorgio Giacinto, Fabio Roli, Battista Biggio
arXiv:2609.23980v1 Announce Type: cross
Abstract: AI agents now report vulnerabilities faster than maintainers can review them. Reports often depend on security properties specific to the application...
By Andy K. Zhang, Ava Huang, Joey Ji, Wai Han, Thomas Qin, Nardos Demilew, Michael Tian-Yue Liu, Brian Song, Riya Dulepet, Brian Wang, Kyleen Liao, Cuiyuanxiu Chen, Nishka Kacheria, Andrew Wu, Pratham Rangwala, Xinjie Wang, Laura Gomezjurado Gonzalez, Anita Ding, Benjamin Yi, Daniel E. Ho, Dan Boneh, Dawn Song, Ion Stoica, Percy Liang
arXiv:2609.00015v1 Announce Type: new
Abstract: AI agents powered by large language models are evolving from isolated assistants into heterogeneous systems in which multiple agents, planners, control...
By Dongsheng Chen, Xiangyu Zhao, Xin Yao, Xuetao Wei
arXiv:2606. 30755v1 Announce Type: cross Abstract: Claw-like AI agents (e.
By Peizhi Niu, Wenjie Qu, Shangding Gu, Tianneng Shi, Yuankai Li, Ahmad Tawaha, Hend Alzahrani, Vincent Siu, Boyi Li, Chenguang Wang, Jiaheng Zhang, Basel Alomair, Ming Jin, Muhao Chen, Chi Wang, Costas Spanos, Dawn Song
arXiv:2609.14987v1 Announce Type: cross
Abstract: Large language model (LLM) agents interact with external environments through tool invocation, but tool outputs can also expose them to indirect prom...
By Bingzheng Wang, Xiaoyan Gu, Wentao Wang, Xingyou Yang, Hongcheng Li, Rong Yin
The paper introduces AnTrap, a benchmark that injects dynamic perturbations into Android GUI agent execution to evaluate robustness against runtime anomalies. It presents a taxonomy of anomalies across four layers—State, Thinking, Action, and Round—with ten subcategories, and a pipeline that maintains task solvability while adding realistic adversarial conditions. Experiments on 16 leading GUI models show universal vulnerability, and reinforcement learning can mitigate some traps but not deep contextual ones like state deadlock.
By Guo Gan, Yilun Zhao, Cong Chen, Jinbiao Wei, Tingyu Song, Zheyuan Yang, Lin Fu, Hong Zhou
arXiv:2608.30207v1 Announce Type: cross
Abstract: Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal...
By Chen Xiong, Zhiyuan He, Pin-Yu Chen, Stjepan Picek, Tsung-Yi Ho
AgentKernel proposes a trust‑native operating system for AI agents, arguing that current governance layers are insufficient because they share the same process trust boundary as the agents. The OS introduces a mandatory enforcement boundary organized into four pillars—Identity, Perception, Cognition, and Execution—each adapting classical OS security principles to address semantic‑level failures such as prompt injection, memory poisoning, and tool misuse. By wrapping the agent lifecycle in this structured, non‑bypassable framework, AgentKernel aims to provide a unified security layer that can enforce identity, input mediation, memory governance, and execution control across the entire agent lifecycle.
By Zhenhua Zou, Sheng Guo, Qiuyang Zhan, Lepeng Zhao, Shuo Li, Zhuotao Liu
The paper introduces Attnlocate, a runtime framework that localizes behavior‑guiding instructions within the attention matrix of large language model agents. By treating this localization as an object detection task, Attnlocate uses a multi‑head, multi‑layer attention aggregation scheme and a 1‑D U‑Net to identify spans that influence tool‑calling decisions. The system then adjudicates potential malicious invocations based on the authority of the source, achieving high detection metrics across diverse LLM families and demonstrating transferability to unseen models.
By Yichao Gao, Yumo Zhang, Yunhao Yao, Haohua Du, Puhan Luo, Ruiqi Li, Zhiqiang Wang
ActGov is a runtime enforcement framework that validates each action proposed by a large language model (LLM) agent before it interacts with external tools, ensuring that actions stay within task‑scoped authorization boundaries and comply with dynamically constructed policies. It builds policies from tool specifications, benign tasks, and failure traces, verifying updates via SMT‑based counterexample checking. In evaluations on AgentDojo and AgentDyn benchmarks, ActGov consistently reduces indirect prompt‑injection attack success while maintaining task utility, outperforming existing defenses.
By Kaiyuan Zhang, Yuke Peng, Ke Jiang, Yinqian Zhang