Mobile agents may act on interface content that users cannot see or easily notice, making their actions harder to oversee. We characterize this gap as human-agent UI desynchronization and investigate how attackers can exploit it through perturbations embedded in applications before deployment. Beyond accessibility metadata, we identify two mechanisms that expose misleading cues to screenshot-based agents: content rendered in display-occluded regions under compatible device configurations, and low-contrast text that remains encoded in screenshots but is difficult for users to notice. We develop an automated framework that searches application-specific perturbation strategies, optimizes their content using representative tasks, and realizes the perturbations in deployable applications. The perturbation content remains fixed at runtime and requires neither access to future user instructions nor detection of agent use. Using a benchmark of 546 tasks across 13 applications, we evaluate five mobile-agent frameworks and three backbone models. The attacks achieve average misleading rates of 77.4% in static observation-space evaluation and 67.2% in dynamic application-level evaluation, where success denotes selection of an attacker-designated decoy control. We invited 195 participants to assess the perceptibility of our visual perturbations and found that none spontaneously noticed the low-contrast text. These findings expose a security gap between human-visible interfaces and agent-observable representations, showing that inconspicuous application content can redirect delegated actions even without runtime adaptation.

翻译：暂无翻译