AI agents that tap and swipe through your phone on your behalf can be tricked into doing things you never asked for, and a new benchmark shows just how often.
Researchers built MobileWorldSafety, a set of 142 tasks run on real Android apps, to test how GUI agents handle environmental injection attacks. These are cases where malicious instructions get smuggled into the ordinary content an agent reads while working, like a pop-up, a message, or a webpage, rather than typed in by a user. The benchmark checks the final state of the phone against a programmatic risk indicator, backed by an LLM judge for borderline calls, so it can separate a genuine safety failure from a simple capability failure. Across six agents, both general-purpose and GUI-specialized, attack success rates ranged from 40.4 percent to 66.9 percent.
That is not a fringe failure rate. It means an agent asked to book a ride or clear notifications can be redirected by content sitting in plain sight on the screen, with no user awareness required. As phone-controlling agents move from demos to actual app store releases, this benchmark is a reminder that giving an AI hands on your device multiplies the attack surface well beyond the classic chatbot prompt injection problem.
The web version of this problem has been studied for a while; mobile agents have just inherited it with fewer guardrails and higher stakes, since a misfired tap can send a payment or a message instead of just a bad answer.