Mobile GUI agents grant the same popup 26/32 times for Calendar and 0/32 for a music app.

arXiv 2608.04755 injected Android permission popups into real GUI tasks across four frontier multimodal LLMs with synchronized screenshots and UI trees. Holding the task fixed and changing only the requesting app flipped grants from 26/32 to 0/32, an App-Trust Bias. Holding the popup fixed and varying task context also moved authorization substantially, a Task-Prior Override. Agents are deciding on surface plausibility, not actual task necessity, which means delegated agents over-grant whenever the requester looks like it belongs.