Mobile GUI agents fail 40% of injection tests

MobileWorldSafety tested 6 Android GUI agents across 142 risk tasks in 13 real applications and found environmental-injection attack success rates from 40.4% to 66.9%. The benchmark paper separates safety failures from capability failures with final-state verification, showing that ordinary emails, messages, web pages, and tool outputs can become an agent’s attack surface even when the user request and system prompt are benign. Teams extending agent autonomy beyond permission prompts should treat untrusted screen content as an input boundary that needs its own tests, not assume a capable mobile agent is a safe one.