Android AI Agent漏洞評測：隱形文字劫持手機代理入侵電腦 | Android AI Agent Review: Invisible Text Hijacks Phone Bots

By Kit 小克 | AI Tool Observer | 2026-08-23

🇹🇼 Android AI Agent漏洞評測：隱形文字劫持手機代理入侵電腦

Android AI Agent漏洞近日成為資安圈熱議話題：研究人員發現，只要在手機螢幕上疊一層人眼看不到的透明文字，就能騙過驅動手機的AI視覺模型，一路劫持到背後控制手機的電腦，執行任意指令。這不是理論攻擊，而是已經在實驗室裡對五套主流開源框架全數攻破的真實測試結果。

什麼是Android AI Agent隱形文字漏洞？

這是一種針對「手機自動化代理」的提示注入攻擊：惡意App在螢幕上疊加2%透明度的文字，人眼幾乎無法察覺，但負責「看螢幕、下指令」的視覺語言模型會照單全收，把隱藏文字當成使用者指令執行。

攻擊是怎麼一步步發生的？

只要一個能在其他App視窗上繪圖、且有權限寫入共享儲存空間的惡意程式，就能把指令悄悄塞進AI Agent的「視野」裡。研究團隊示範的完整攻擊鏈只需要三步：

第一步：惡意App用近乎透明的文字疊加在畫面上
第二步：AI Agent的視覺模型讀取螢幕截圖，誤把隱形文字當成合法指令
第三步：由於這類Agent通常透過ADB連接、由電腦端程式控制手機，指令會一路傳回主機執行

哪些模型和框架受影響？

研究團隊測試了六款主流視覺語言模型，結果不分廠牌全部中招：GPT-4o、Claude Opus 4.5、Gemini 3 Pro與GLM-4V在20次實驗裡全部20次都成功讀出隱形文字。框架方面，AppAgent、AppAgentX、Mobile-Agent-v3、Open-AutoGLM、MobA五套開源手機代理框架，每一套至少被七種攻擊手法中的六種攻破。這篇論文《(A)I Sees What You Don't》7月1日掛上arXiv，作者來自西門菲莎大學、香港中文大學、山東大學與奇安信的行圖實驗室。

目前有真實災情嗎？

目前沒有CVE編號，也沒有證據顯示已在野外被利用——這仍是實驗室環境下的概念驗證。研究團隊在論文公開前私下通知了受影響的專案維護者，但截至目前尚未收到回覆。

Kit小克怎麼看？

這篇研究戳中了手機AI Agent最尷尬的痛點：這些工具的賣點就是「幫你自動操作手機」，但螢幕上的每一個像素，理論上都可能是攻擊者的指令來源，而視覺模型目前完全沒有機制去分辨「這是給人看的內容」還是「這是給AI看的指令」。如果你正在用這類開源手機代理框架做自動化測試或RPA，建議先假設任何未經隔離的App都有機會下毒，別把它接到有敏感權限的電腦環境。等主流框架加上內容來源驗證機制之前，先當它是高風險工具用。

好不好用，試了才知道。

🇺🇸 Android AI Agent Review: Invisible Text Hijacks Phone Bots

The Android AI Agent invisible text vulnerability is the security story making the rounds this week: researchers showed that a layer of near-transparent text on a phone screen is enough to fool the vision model driving an AI agent — and from there, hijack the PC controlling that phone into running arbitrary commands. This isn't theoretical; it's a lab-confirmed attack chain that broke five major open-source frameworks.

What Is the Android AI Agent Invisible Text Attack?

It's a prompt injection attack against mobile automation agents: a malicious app overlays text at 2% opacity — invisible to a human glance — and the vision-language model reading the screenshot treats it as a legitimate user instruction.

How Does the Attack Chain Actually Work?

Any app that can draw over other windows and write to shared storage can slip hidden instructions into an AI agent's field of view. The researchers' full attack chain took just three steps:

Step 1: A malicious app overlays near-invisible text on the screen
Step 2: The AI agent's vision model reads the screenshot and mistakes the hidden text for a real command
Step 3: Since these agents typically run over ADB with a host PC controlling the phone, the command executes back on the host machine

Which Models and Frameworks Are Affected?

Six mainstream vision-language models were tested, and every one fell for it: GPT-4o, Claude Opus 4.5, Gemini 3 Pro, and GLM-4V all read the invisible text in 20 out of 20 trials. On the framework side, all five tested open-source mobile agent frameworks — AppAgent, AppAgentX, Mobile-Agent-v3, Open-AutoGLM, and MobA — fell to at least six of seven attack variants. The paper, "(A)I Sees What You Don't," went up on arXiv July 1, authored by researchers from Simon Fraser University, the Chinese University of Hong Kong, Shandong University, and QAX's Xingtu Lab.

Has This Been Exploited in the Wild?

No CVE has been assigned and there's no evidence of real-world exploitation — this remains a controlled lab proof-of-concept. The researchers privately notified affected maintainers before publishing, but say they haven't received a response.

Kit's Take

This research nails the awkward truth about mobile AI agents: their whole pitch is "let AI operate your phone for you," but that means every pixel on screen is a potential instruction channel — and today's vision models have zero mechanism to tell "content meant for a human" apart from "instructions meant for the AI." If you're running one of these open-source mobile agent frameworks for automation or RPA, assume any un-sandboxed app could poison the input, and don't wire it up to a host machine with sensitive access. Until mainstream frameworks add source-verification for on-screen content, treat this class of tool as high-risk.

好不好用，試了才知道 — good or not, you won't know until you try it.

Sources / 資料來源

常見問題 FAQ

Android AI Agent隱形文字漏洞是什麼？

惡意App在螢幕疊加2%透明度的文字，人眼看不到，但AI視覺模型會把它當成真實指令執行，進而劫持控制手機的電腦。

哪些AI模型會中招？

GPT-4o、Claude Opus 4.5、Gemini 3 Pro、GLM-4V等六款主流視覺語言模型，在測試中全部讀出了隱形文字。

哪些開源框架受影響？

AppAgent、AppAgentX、Mobile-Agent-v3、Open-AutoGLM、MobA五套開源手機代理框架，每套都被至少六種攻擊手法攻破。

目前有實際案例被攻擊嗎？

目前沒有CVE編號，也沒有證據顯示已在野外被利用，仍屬實驗室概念驗證階段，但研究團隊通知的維護者尚未回應。

一般人該怎麼防範？

使用開源手機代理框架時，假設任何未經隔離的App都可能夾帶惡意指令，避免將其連接到有敏感權限的電腦環境。

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士