Android accessibility trees hand mobile agents a 0.822 prompt-injection success rate
arXiv 2608.08939·medium signal
Mobile AI agents that read the Android accessibility tree inherit a systematic indirect prompt injection channel: MobileRun hits a 0.822 attack success rate, and the hardened Mobile-Use framework only reduces this to 0.150 without eliminating context drift. The accessibility tree is untrusted input that every mobile agent framework currently treats as structural ground truth. Recommended mitigations are zero-trust validation of accessibility input and a dedicated security agent in the loop.