FlagThis

Abstract

LLM-based mobile agents can autonomously execute user tasks by navigating mobile applications and orchestrating cross-app workflows. In real-world mobile environments, such agents inevitably interact with untrusted third-party content, including in-app advertising, embedded web pages, and crossapplication messages or notifications. That is, agents are in effect confused deputies that may be exploited even under a restricted adversary model, where the attacker does not control any code or app on the device, but can only deliver content to certain non-app-controlled interaction channels. Despite the ubiquity of such channels and resources, the security risks introduced by such exposure remain largely underexplored. In this work, we present the first systematic study of indirect attacks through non-app-controlled resources against mobile LLM agents, where attacker-controlled content covertly steers an agent away from a benign user goal toward adversarial outcomes. To enable rigorous evaluation of mobile LLM agents, we build a scalable automated framework, MobiRed, that synthesizes diverse adversarial scenarios by composing scenario templates with multiple prompt-injection patterns and attack distribution channels. We deploy our framework on Android and evaluate eight state-of-the-art mobile LLM agents spanning multiple architectures and underlying language models. We run 3,160 adversarial trials paired with benign executions, enabling systematic measurement of attack success and agent robustness under realistic mobile conditions. Our results reveal widespread vulnerabilities across agents. Simple attacks, such as fraudulent in-app advertisements with malicious instructions, succeed in over 80% of trials. More complex workflows, including malware deployment that requires navigating operating-system warnings and multi-step interactions, also succeed against advanced agents, with an average attack success rate of 18.75%. The results show that mobile LLM agents, as the confused deputy, are vulnerable to malicious non-app-controlled resources, highlighting the urgent need for defenses that account for the unique attack surfaces of mobile ecosystems.