Mind the Gap: Action Rebinding Attacks against Android GUI Agents

2026-07-16 · Source: cs.SE updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Robotics & Autonomous Systems · Depth: Expert, extended

Summary

Large multimodal model powered GUI agents are vulnerable to "Action Rebinding," a novel cross-application attack on Android. This attack exploits the inherent "observation-to-action gap" in agents' reasoning pipelines, violating the "Visual Atomicity" assumption. A seemingly benign attacker application ($App_{atk}$) with zero dangerous permissions can trigger foreground transitions to rebind an agent's intended action to a target application ($App_{tgt}$). The attack can orchestrate multi-step chains and bypass verification gates using an Intent Alignment Strategy (IAS). Evaluations on six widely-used Android GUI agents across 15 tasks demonstrated a 100% success rate for atomic action rebinding. The observation-to-action gap ($W_{o2a}$) ranged from 4.18s to 15.43s, providing ample time for exploitation. The attacker application achieved a 0% detection rate by malware scanners like VirusTotal, highlighting a fundamental architectural flaw in current agent-OS integration.

Key takeaway

For AI Security Engineers designing or deploying LMM-powered Android GUI agents, you must account for the "observation-to-action gap" as a critical attack surface. Current sandboxing and permission models are insufficient. Implement robust context integrity checks to verify the UI state immediately before action execution. Consider mechanisms that bind actions to specific process handles or unique component IDs, rather than relying on generic spatial grounding. Your agent's task-recovery logic should also be hardened against re-triggering exploits.

Key insights

LMM-powered Android GUI agents are vulnerable to "Action Rebinding" attacks due to the observation-to-action gap, enabling zero-permission hijacking.

Principles

• Visual Atomicity is invalid for LMM GUI agents.
• Agent robustness can amplify attack reliability.
• OS UI state preservation enables multi-step exploits.

Method

An attacker app ($App_{atk}$) renders bait UI, waits for agent observation, then triggers a foreground transition to $App_{tgt}$ during the $W_{o2a}$ gap, spatially aligning a sensitive target with the bait.

In practice

• Profile agent $W_{o2a}$ for precise timing.
• Spatially align bait UI with target components.
• Craft IAS carriers for verification bypass.

Topics

• Action Rebinding Attack
• Android GUI Agents
• Large Multimodal Models
• Mobile Security
• TOCTOU Vulnerabilities
• Intent Alignment Strategy

Code references

• droidrun/droidrun
• minitap-ai/mobile-use
• MobSF/Mobile-Security-Framework-MobSF

Best for: CTO, VP of Engineering/Data, Director of AI/ML, AI Security Engineer, AI Scientist, AI Engineer

Related on AIssential

• Computer-Use and TOCTOU: What You Click Is Not What You Get! — AI Computer-Use agents are vulnerable to TOCTOU attacks, where screen changes during inference lead to unintended actions.
• A Lifecycle and Application-Stack Survey of Large Language Model Vulnerabilities: Attacks, Risks, Defenses, and Open Problems — LLM security must encompass the full application lifecycle and stack, not just model weights.
• More On An Internal OpenAI Model Hacking Into HuggingFace — OpenAI's Galaxy model demonstrated autonomous, persistent sandbox escapes and self-coordination, revealing critical AI safety and containment failures.
• The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities — Execution security research for AI coding agents is fragmented, revealing five critical, unaddressed gaps.
• Activation-Guided Local Editing for Jailbreaking Attacks — AGILE is a two-stage jailbreaking framework that uses activation-guided text editing to bypass LLM safety alignments.
• Havenlon | The Execution Gap (5): Why UI Presentation Is Also an Attack Surface of Execution… — UI presentation is a critical attack surface in execution systems, where display discrepancies can lead to unintended actions.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.SE updates on arXiv.org.