Search papers, labs, and topics across Lattice.
This paper introduces MobileWorldSafety, a benchmark designed to evaluate the safety of LLM-powered GUI agents against environmental injection attacks in Android applications. By systematically assessing 142 risk tasks through a two-stage evaluation pipeline鈥攃ombining rule-based verification and LLM adjudication鈥攖he study reveals that all tested agents exhibit significant vulnerabilities, with attack success rates between 40.4% and 66.9%. These results highlight a critical gap in safety alignment for agents operating in real-world mobile environments, necessitating further research to enhance their robustness against adversarial content.
All tested GUI agents are alarmingly vulnerable to environmental injection attacks, with success rates reaching over 66%, revealing a pressing need for improved safety measures.
LLM-powered GUI agents that autonomously operate smartphones are rapidly transitioning from research prototypes to early real-world deployment. However, because these agents routinely process untrusted environmental content, they are highly vulnerable to environmental injection attacks, which include indirect prompt injections and adversarial instructions. Such attacks can manipulate the behavior of agents without user awareness through diverse channels encountered in everyday mobile use. Despite these risks, existing benchmarks often fail to capture everyday user scenarios, lacking a systematic evaluation of GUI agents under environmental injection attacks on mobile devices. To address this gap, we introduce MobileWorldSafety, a benchmark of 142 risk tasks built on real Android applications. For each task, we define a programmatically verifiable risk indicator over the final system state and evaluate outcomes with a two-stage pipeline: rule-based verification handles unambiguous cases, while an LLM judge adjudicates ambiguous ones. This distinguishes safety failures from capability failures and enables objective and reproducible assessment. Evaluations on six agents, including both general agents and specialized GUI agents, demonstrate that all agents remain highly vulnerable, with attack success rates ranging from 40.4% to 66.9%. These findings indicate that current agents often fail to maintain safety alignment when adversarial content is presented as ordinary mobile context. MobileWorldSafety provides a foundation for quantifying these vulnerabilities and advancing research on robust mobile GUI agents.
