MobileInject: How Multimodal Injection Hijacks Mobile AI Agents

AI assistants on phones are evolving from "chat tools" into "agents that can tap the screen and get things done on their own." When these MLLM-based mobile agents take over the notification bar, read content across apps, and execute actions, a new attack surface opens up: attackers no longer need to converse directly with the model—they merely need to hide a malicious instruction in a text message, a webpage, or an image, and the agent may carry out the operation on their behalf.

A recent research paper introduces MobileInject, the first benchmark for evaluating multimodal injection attacks and "reasoning-to-action" security risks in mobile agents. It seeks to answer one question: when a malicious goal is blended into the phone environment across modalities, at which step does the agent's reasoning chain get led astray?

Why Mobile Agents Have Become a New Target

Traditional prompt injection attacks mostly occur on desktop and web scenarios—for example, hiding text in a webpage to induce the model to output what the attacker wants. The mobile ecosystem differs in that information flows fluidly across apps: a message may come from a social app while the trigger point is in the calendar or a payment app, and the agent must make consistency judgments across multiple modalities (text, screenshots, UI elements).

The research points out that it is precisely this cross-modal "mutual corroboration" that attackers exploit. The core idea behind MobileInject's Cross-Modal Consistency Injection is to have the malicious instruction corroborate itself across multiple modalities, thereby lowering the agent's vigilance. For instance, a textual instruction paired with a plausible-looking UI screenshot leads the model to believe this is a genuine intent in the environment rather than an external injection.

This also explains why single-modality defense approaches tend to fail on phones: agents are designed to trust the consistency of multi-source information, and attackers precisely forge that consistency.

Prompt Injection is a class of attacks against LLM and multimodal model applications: attackers disguise malicious instructions as "content" the model will read, inducing it to deviate from its original task and instead execute the attacker's intent. Unlike traditional software vulnerabilities, it exploits the model's difficulty in strictly distinguishing "data" from "instructions." In web scenarios, common forms include hidden text, white font, or instructions in comments; in mobile agent scenarios, injection carriers extend to SMS, notifications, screenshots, and UI elements. Defense approaches typically include input isolation, separation of instructions and data, output filtering, and anomaly detection along the reasoning chain. Understanding this concept helps grasp the similarities and differences between the attacks discussed in MobileInject and traditional web injection.

An Evaluation Framework Built on 108 Executable Risk Instances

MobileInject provides a high-fidelity, interactive mobile evaluation environment with quite specific coverage: 11 scenario categories, 9 security risk categories, and 108 executable risk instances. Unlike evaluations that only do static Q&A, these instances require the agent to actually execute operations in a simulated phone environment, making it possible to observe fine-grained failure modes such as "correct reasoning but wrong action" or "hijacked early in reasoning."

Regarding attack methods, the paper enhances the basic injection with two additional techniques:

• Multi-Role Collaborative Deception: multiple sources and multiple roles consistently convey the same malicious goal, reinforcing trust manipulation.
• Reasoning-Camouflage Injection: packaging the malicious goal as a plausible intermediate step in the reasoning process to carry out reasoning hijacking.

The accompanying Reasoning Security Diagnosis Framework is used for fine-grained attribution of failure cases, determining whether the problem lies in perception, reasoning, or action.

MLLM (Multimodal Large Language Model) agents refer to systems that use multimodal large models as their decision-making core, capable of perceiving text and image interfaces and invoking tools or performing actions such as taps and swipes. Their typical architecture consists of three stages—perception, reasoning/planning, and action execution—often linked in a "reasoning-to-action" chain. Compared with text-only agents, MLLM agents must fuse multiple inputs such as screenshots, UI structure trees, and text content, and handle cross-app state. This also means a broader attack surface: contamination of any single modality may affect overall judgment. Evaluating such agents typically requires interactive environments rather than static Q&A to observe failure modes in real operation sequences—which is exactly why MobileInject adopts a high-fidelity simulated environment.

Experimental Results: Early Reasoning Hijacking Is the Main Source of Failure

The systematic experiments yield less-than-optimistic conclusions: mobile agents are generally vulnerable to multimodal injection attacks, and many failures do not occur at the final click step but stem from hijacking early in reasoning. In other words, the agent has already accepted the attacker's goal at the "thinking" stage, and subsequent actions merely faithfully execute the contaminated plan.

This finding has direct implications for defense design. If permission checks or secondary confirmations are only performed at the downstream action layer, they may fail to stop an agent whose intent has already been rewritten; conversely, detecting consistency anomalies in multimodal information early in reasoning may be a more effective entry point. The paper positions MobileInject as a systematic cross-modal benchmark for researching and improving mobile agent security, with code release information available in the Open Science section of the appendix.

Reasoning Hijacking refers to attacks in which the attacker does not directly command the agent to perform an action but instead tampers with intermediate goals or premises in its reasoning process, making the model "believe" it is executing a reasonable plan. Compared with directly injecting explicit instructions, reasoning hijacking is more stealthy: the malicious goal is packaged as a plausible step in the reasoning chain, and the model's subsequent actions are logically self-consistent yet serve the attacker's intent. The detection challenge of such attacks is that the final action itself may be entirely compliant, with anomalies manifesting only in the early stages of the reasoning trace. Therefore, when evaluating agent security, beyond task success rates, one must also examine whether the reasoning path has been contaminated by external content and whether the agent can maintain independent judgment when multi-source information conflicts.

Practical Implications for Developers and Users

For teams building mobile agents, this research offers two reminders. First, the stronger the ability to read content across apps, the larger the injection surface—content from external apps should be treated with a lower level of trust by default. Second, evaluation should not focus solely on task success rates but also on whether the agent's reasoning trace is contaminated in malicious environments.

For ordinary users, the implication is simpler: when an AI assistant can operate your phone for you, what it sees is no longer just "information"—it may also be "instructions" written to it by someone else. The security boundary of mobile agents ultimately depends on whether they can tell the two apart.

One-line Summary

MobileInject is the first benchmark for evaluating multimodal injection attacks and reasoning-to-action security in mobile agents.

Paragraph Summary

The article introduces MobileInject, a benchmark for evaluating multimodal injection attacks and "reasoning-to-action" security risks in mobile agents. It notes that in the mobile ecosystem information flows across apps and agents rely on multimodal consistency judgments, which attackers exploit through cross-modal consistency injection to forge that consistency. The benchmark covers 11 scenario categories, 9 risk categories, and 108 executable risk instances, and introduces two enhanced attacks: multi-role collaborative deception and reasoning-camouflage injection. Experiments show that mobile agents are generally vulnerable, with many failures stemming from goals being hijacked early in reasoning rather than at the final action stage, suggesting that downstream permission checks alone may be insufficient and that multimodal consistency anomalies should be detected early in reasoning.