Phone agents fall to cross-modal injection: same payload in screenshot and UI text hits 85.4% attack success, single-channel repeats lag
For multimodal-LLM phone agents, MobileInject places one malicious objective in both the screenshot and the interface text and runs 108 executable risk instances on a resettable Android emulator. Prior evaluations mostly watched a single text channel or judged only whether an attack succeeded; with exposure counts matched, one appearance per channel reached 85.4% attack success and 0% benign completion, while repeating within one channel reached only 72.9% or 27.8%. In 30 of 108 paired instances, neither single channel succeeded but the aligned pair did.