Mobile GUI Agents Have No Permission Literacy: Same Popup Granted 26/32 Times for Calendar, 0/32 When the Requester Is a Music App
arXiv 2608.04755·high signal
Researchers injected Android-style permission popups into real GUI tasks and evaluated four frontier multimodal LLMs with synchronized annotated screenshots and UI-tree hierarchies, exposing requester, permission, justification, and available actions to the agent. Holding the Calendar task fixed and changing only the requesting app from Calendar to PiMusic dropped grants from 26 of 32 to 0 of 32 — a strong but task-conditioned App-Trust Bias. Holding the popup fixed while varying task context also substantially changed authorization, which the authors call a Task-Prior Override; both mean agents are deciding on surface plausibility rather than actual task necessity, so delegated agents will over-grant whenever the requester looks like it belongs.