零权限操纵：我们能否信任由大型多模态模型驱动的GUI代理？
Mind the Gap: Action Rebinding Attacks against Android GUI Agents
AI总结：
研究揭示了由大型多模态模型驱动的GUI代理在Android中存在视觉原子性假设的漏洞，通过零权限攻击实现对代理执行的重新绑定，并利用意图对齐策略绕过验证门，展示了代理-操作系统集成中的安全缺陷。
摘要：
大型多模态模型驱动的GUI代理正在移动平台上作为高权限操作者出现，负责感知屏幕内容并注入输入。然而，其设计基于隐含的视觉原子性假设：即UI状态在观察和行动之间保持不变。我们证明在Android中这一假设从根本上不成立，从而创建了一个关键的攻击面。我们提出了Action Rebinding攻击，一种允许一个看似无害的应用程序利用零危险权限重新绑定代理执行的攻击方式。通过利用代理推理管道中固有的观察到行动的间隙，攻击者触发前台转换，将代理的计划行动重新定向至目标应用程序。我们利用代理的任务恢复逻辑和Android的UI状态保存来编排可编程的多步骤攻击链。此外，我们引入了意图对齐策略（IAS），该策略操纵代理的推理过程以合理化UI状态，使其能够绕过验证门（例如确认对话框）否则会被拒绝。我们对六个广泛使用的Android GUI代理在15个任务上的Action Rebinding攻击进行了评估。我们的结果表明，对于原子动作重新绑定，成功率为100%，并且能够可靠地编排多步骤攻击链。借助IAS，绕过验证门的成功率提高（从0%到最高100%）。值得注意的是，攻击应用程序不需要敏感权限且不包含任何特权API调用，实现了跨恶意软件扫描器（例如VirusTotal）的0%检测率。我们的发现揭示了当前代理-操作系统集成中的基本架构缺陷，并为未来代理系统的安全设计提供了关键见解。如需访问实验日志和演示视频，请联系yi_qian@smail.nju.edu.cn。
英文摘要：
Large multimodal model powered GUI agents are emerging as high-privilege operators on mobile platforms, entrusted to perceive screen content and inject inputs across application boundaries. While these agents aim to automate complex tasks, we demonstrate that their design introduces a fundamental conflict with Android's strict application sandboxing. We present a novel cross-application Action Rebinding attack, which allows a malicious application with zero dangerous permissions to hijack the agent's execution and perform privileged operations on behalf of the attacker. Our attack exploits the inevitable observation-action gap inherent in the agent's reasoning pipeline. A malicious app can render a benign ``contextual carrier'' to elicit a planned action, and then swap the foreground to a sensitive target application during the reasoning latency. The agent, unaware of the transition, unwittingly executes the action in the privileged context. We further advance this attack by weaponizing the agent's own task-recovery logic to create programmable, multi-step exploit loops , and introducing an Intent Alignment Strategy (IAS) that manipulates the agent's reasoning to rationalize the hijacked state. We evaluate our attack on six widely-used Android GUI agents. Our results demonstrate a 100% success rate for atomic action hijacking and the ability to orchestrate high-impact exploits, including unauthorized file deletion, SMS transmission, and app uninstallation, without the attacker holding any corresponding permissions. Furthermore, since the malicious application separates intent from capability and contains no privileged API calls, it achieves a 0% detection rate across commercial malware scanners (e.g., VirusTotal), highlighting a critical blind spot in current mobile security analysis. To access experimental logs and demonstration videos, please contact yi_qian@smail.nju.edu.cn.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
