Mobile Next — agentic threat model

Not certain from the listing — The agent relies on external LLMs via the Model Context Protocol (MCP). The primary threat is prompt injection or adversarial inputs hijacking the model to execute malicious taps, keystrokes, or data exfiltration on the connected mobile device.

Not certain from the listing — The agent reads the device's accessibility tree and takes screenshots, which likely contain highly sensitive personal data, credentials, or PII. There is no mention of data sanitization, masking, or secure local storage for these UI inputs.

The agent framework exposes powerful tools (tap, type, inspect UI) over MCP. Insecure tool integration or lack of input validation could allow an attacker to bypass intended application flows, brute-force passcodes, or interact with unauthorized third-party apps.

The agent runs as an MCP server with direct access to local ADB/iOS simulators or physical devices. If the host running the MCP server is compromised, the attacker gains full control over the connected mobile devices, enabling lateral movement and host-to-device compromise.

Not certain from the listing — There are no apparent guardrails, logging mechanisms, or session-recording features to audit the exact sequence of taps, keystrokes, and screenshots captured during an automated agent run.

The tool operates with the permissions of the connected developer environment or physical device. There is no built-in authentication, authorization, or user-confirmation step (Human-in-the-Loop) before executing highly sensitive actions like typing or clicking.

As an MCP tool, this agent can be orchestrated by other upstream agents. If an upstream orchestrator is compromised, it can abuse Mobile Next to perform unauthorized transactions, download malicious apps, or exfiltrate local device data.