Large vision-language models (LVLMs) are increasingly deployed as autonomous mobile agents that execute tasks through GUI interaction. However, their security under realistic deployment constraints remains insufficiently understood. Existing attacks typically rely on persistent visual manipulations, privileged system access, or iterative jailbreak interactions, limiting their practicality. In this work, we identify a previously overlooked discrepancy between human and agent interactions: automated mobile agents generate near-zero touch-contact signals that systematically differ from human touches. Based on this observation, we introduce agent-only perceptual injection, a new attack paradigm that exposes malicious prompts only during agent interactions while keeping them unexposed during normal user operation. To realize this attack, we propose a low-privilege framework that combines in-app prompt embedding, interaction-triggered activation, and HG-IDA*, an efficient one-shot jailbreak optimization method tailored to mobile UI constraints. Experiments on multiple Android applications and LVLM backends, such as GPT-4o, show that our attacks reliably hijack both agent planning and execution. Our method achieves up to 95.0% planning attack success rate and 82.5% execution attack success rate on commercial LVLM backends. These findings reveal a new interaction-level attack surface and highlight the need for provenance-aware defenses in mobile agent systems.

Recent studies show that large language models (LLMs) are vulnerable to jailbreak attacks, which can bypass their defense mechanisms. However, existing jailbreak research often exhibits limitations in universality, validity, and efficiency. Therefore, we rethink jailbreaking LLMs and define three key properties to guide the design of effective jailbreak methods. We introduce AutoBreach, a novel black-box approach that uses wordplay-guided mapping rule sampling to create universal adversarial prompts. By leveraging LLMs’ summarization and reasoning abilities, AutoBreach minimizes manual effort. To boost jailbreak success rates, we further suggest sentence compression and chain-of-thought-based mapping rules to correct errors and wordplay misinterpretations in target LLMs. Also, we propose a two-stage mapping rule optimization that initially optimizes mapping rules before querying target LLMs to enhance efficiency. Experimental results indicate AutoBreach efficiently identifies security vulnerabilities across various LLMs (Claude-3, GPT-4, etc.), achieving an average success rate of over 80% with fewer than 10 queries. Notably, the adversarial prompts generated by AutoBreach for GPT-4 can directly bypass the defenses of the advanced commercial LLM GPT o1-preview, demonstrating strong transferability and universality.