Invisible Text on an Android Screen Can Hijack AI Phone Assistants, and Then the PC Behind Them

Key points

• Researchers demonstrated seven attacks against five open-source Android AI agent frameworks, including AppAgent and AppAgentX.
• A malicious Android app can plant text invisible to humans that the AI agent reads and obeys.
• One attack chain jumps from the phone to the PC controlling the agent and runs commands there.
• These frameworks are open-source research projects, not consumer products, but they reflect how commercial screen-reading AI assistants are being built.

This is a problem that only exists because we handed our phones to robots.

A new piece of research, first reported by The Hacker News, looks at what happens when you let an AI agent, meaning software that reads your screen and taps buttons on your behalf, drive an Android phone. You tell it "book me a table" and it pokes around the apps like a human would. Handy. Also dangerous.

Researchers tested five open-source frameworks that do exactly this: AppAgent, AppAgentX, and three others in the same family. Seven separate attacks. The nastiest starts with an ordinary-looking Android app and ends with commands running on the PC orchestrating the agent.

How does a hidden message on a phone screen end up running code on a PC?

It happens in stages, each mundane on its own.

On Android, an app can request two common permissions. One lets it draw on top of other apps, those floating bubbles from chat apps. The other lets it write files to shared storage, the phone's equivalent of a shared folder. Neither sounds alarming; plenty of legitimate apps ask for both.

A malicious app uses those two abilities to paint text onto the screen that a human can't see. White text on a white background, or characters drawn one pixel tall. Invisible to you. Perfectly readable to the AI agent, which processes the raw screen rather than what a person would notice.

That hidden text is an instruction. The agent follows it.

The researchers showed the agent can be tricked into capturing screenshots, leaking data, or reaching back to the PC running the framework and executing commands there. The core failure is simple: the AI can't tell a user's request apart from a booby-trapped pixel. Everything it reads is treated as gospel.

Should ordinary phone users worry today?

Not immediately. The five frameworks tested are research projects, not Play Store apps. Your banking app isn't about to get hijacked by a rogue keyboard tomorrow.

But this is where things are going. Google, Apple and a long list of startups are racing to ship agentic assistants that see your screen and act for you. The commercial versions will inherit the same weakness the researchers just exposed: an agent that reads pixels can't easily distinguish a real button from a fake one, or a legitimate instruction from a hostile instruction hidden in the layout. We've covered the parallel problem of agents being manipulated through content they read in 102 prompt-injection stories since 28 May 2026, including how a single poisoned email can rewrite what an AI assistant remembers about you. The mobile surface is newer, and it's nastier because the attack payload can be completely invisible.

The post-mortem, whenever the first real-world version of this lands, will note that screen-reading agents shipped before anyone worked out how they should handle untrusted input from the screen itself. Which is, when you say it out loud, the entire screen.

For now, the practical advice is boring and correct. Be picky about which Android apps you install. Look hard at anything asking to draw over other windows or write to shared storage, particularly free utilities or keyboards. Those two permissions are the door in this research.

Operational takeaway: if your product plan includes an AI that acts on what it sees, treat the screen as hostile input and design from there.