Awesome-GUI-Agent-Security
by Yuxuan2003
GUI / Computer-Use / Browser Agent 安全论文清单 —— 按攻防轴组织，每篇附中文简介
58stars
3forks
Python
Added 9/5/2026
View on GitHubDownload ZIPScan for vulnerabilities
Unlocks once the catalog security scan passes (runs nightly).
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
The deep catalog scan for this skill is still queued. Run an instant dependency check now instead.
AI Agentsagent-securityai-agentai-securityawesomeawesome-listcomputer-use-agentgui-agentllm-agentllm-securitypaper-listprompt-injectiontrustworthy-ai
Installation
# Add to your Claude Code skills
git clone https://github.com/Yuxuan2003/Awesome-GUI-Agent-SecurityGetting Started
Guides for using ai agents skills like Awesome-GUI-Agent-Security.
- Caveman: Cut Claude Token Use by 65%How agent-side prompt compression works, when to use it, and when not to.
- What is an AI Skills Marketplace?Definitions, how marketplaces work, and how to choose between them in 2026.
- Getting Started with AI SkillsFirst-time install walkthrough for Claude Code, Codex CLI, and ChatGPT.
Awesome-GUI-Agent-Security
English ｜ 简体中文
A curated list of papers on GUI / Computer-Use / Browser Agent security — organized by attack surface and defense layer, not by runtime environment.
This page is the index — one line per paper. Each section links to a page with a 3–5 sentence summary per paper.
Scope: papers whose primary subject is a GUI / computer-use / browser / mobile agent, with a security contribution. Not included: general LLM/agent security that only uses GUI agents as a testbed · agents for security work (pentest, CTF) · pure capability work.
Most GUI agent lists split papers by runtime environment (Web / Mobile / Desktop), which scatters a single attack class across sections: multi-step indirect injection lands under Desktop, efficiency backdoors under Mobile, pop-up attacks under both Web and Desktop. Answering "what visual-layer attacks exist?" means reading every section.
Here the primary axis is attack vector and defense intervention point. Runtime environment is a cross-cutting tag, used as a primary dimension only inside the benchmarks chapter.
Contents
- 0 Surveys & Threat Models · 4
- 1 Attack Surfaces
- 2 Defense Layers
- 3 Benchmarks & Datasets
- 4 Commercial AI Browsers & Product Security · 2
Browse by environment: Web ｜ Mobile ｜ Desktop ｜ Cross-env
0 Surveys & Threat Models
Surveys, SoKs, and mappings onto threat taxonomies such as OWASP ASI and MITRE ATLAS · Summaries →
- WebMASLab — From Monoliths to Swarms: A Study of Attack Surface Evolution in the Transition to Multi-Agent Web Systems · 2026-07 · 🌐
- Mobile Agent Security Study — Measuring the Security of Mobile LLM Agents under Adversarial Prompts from Untrusted Third-Party Channels · 2025-10 · 📱
- CUA Vuln SoK — A Systematization of Security Vulnerabilities in Computer Use Agents · 2025-07 · 🖥️🌐
- Trustworthy GUI Survey — Towards Trustworthy GUI Agents: A Survey · 2025-03 · 🧩
1 Attack Surfaces
Organized by attack vector and entry point, not by runtime environment
1.1 Indirect Prompt Injection
Injection carried by external content: web pages, documents, email · Summaries →
- SIR — Self-improving Red-teaming for Compute Use Agents · 2026-08 · 🖥️🌐
- StepJack — Benchmarking Computer-Use Agent Safety Against Multi-Step Indirect Prompt Injection · 2026-08 · 🖥️🧩
- Invisible Ink — Invisible Ink Threats: Adversarial Goals Behind Legitimate Tasks in Computer-Use Agents · 2026-08 · 🖥️
- ADI — Agent Data Injection Attacks are Realistic Threats to AI Agents · 2026-07 · 🌐🖥️
- WebTrap — Stealthy Mid-Task Hijacking of Browser Agents During Navigation · 2026-05 · 🌐
- ReadSecBench — You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents · 2026-03 · 🖥️
1.2 Visual-Layer Attacks
Adversarial patches, pop-up lures, typographic attacks, screenshot poisoning · Summaries →
- MIRAGE — Stealthy Visual Prompt Injection for Vulnerability Detection in Web Agents · 2026-06 · 🌐
- PRAC — Preference Redirection via Attention Concentration: An Attack on Computer Use Agents · 2026-04 · 🖥️🌐
- Semantic UI Injection — Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injection · 2026-04 · 🧩
- Visual Confused Deputy — Exploiting and Defending Perception Failures in Computer-Using Agents · 2026-03 · 🖥️
1.3 Environmental Injection
UI element injection, accessibility tree, spoofed notifications, overlays · Summaries →
- AnTrap — Are Android GUI Agents Robust Against Runtime Anomalies? AnTrap: Evaluating Agents in Dynamic Adversarial Environments · 2026-08 · 📱
- Not an A11y — How Android Accessibility Exposes Mobile AI Agents to Indirect Prompt Injection · 2026-08 · 📱
- MIRAGE (Mobile) — MIRAGE: Context-Aware Prompt Injection against Mobile GUI Agents via User-Generated Content · 2026-05 · 📱
- eTAMP — Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents · 2026-04 · 🌐
- AdInject — Real-World Black-Box Attacks on Web Agents via Advertising Delivery · 2025-05 · 🌐
1.4 Privilege Escalation & Permission Abuse
OS-level escalation, cross-app privilege abuse, permission-dialog manipulation, TOCTOU · Summaries →
- Allow to Achieve — "Allow" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agents · 2026-08 · 📱
- AI Sees — (A)I Sees What You Don't: Exploiting New Attack Surfaces in Third-Party Mobile Agents · 2026-07 · 📱
- PUSV — Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agents · 2026-04 · 🖥️
- Atomicity for Agents — Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents · 2026-02 · 🌐
- Action Rebinding — Mind the Gap: Action Rebinding Attacks against Android GUI Agents · 2026-01 · 📱
1.5 Data Exfiltration & Privacy
Credential theft, PII leakage, contextual-integrity violations, oversharing · Summaries →
- LoginTrap — Uncovering Task-Agnostic Phishing-Style Indirect Prompt Injection Attacks against LLM-based Web Agents · 2026-08 · 🌐
- Capable but Careless — Do Computer-Use Agents Follow Contextual Integrity? · 2026-06 · 🖥️
- Scammer4U — "I Strongly Suspect This Website Is a Scam": Benchmarking PII Leakage and Detection without Defense in Autonomous Web Agents · 2026-05 · 🌐
- MyPhoneBench — Do Phone-Use Agents Respect Your Privacy? · 2026-04 · 📱
- WebPII — Benchmarking Visual PII Detection for Computer-Use Agents · 2026-03 · 🌐🖥️
- SPILLage — Agentic Oversharing on the Web · 2026-02 · 🌐
1.6 Backdoors & Poisoning
Grounding backdoors, efficiency backdoors, memory poisoning · Summaries →
- SynChain — Inducing Computer-Use Agent Systems to Construct Their Own Attack Chains · 2026-08 · 🖥️
- MemVenom — Triggered Poisoning of Multimodal Memories in Web Agents · 2026-06 · 🌐
- AgentRAE — Remote Action Execution through Notification-based Visual Backdoors against Screenshots-based Mobile GUI Agents · 2026-03 · 📱
- SlowBA — An Efficiency Backdoor Attack towards VLM-based GUI Agents ·
Frequently Asked Questions
What is Awesome-GUI-Agent-Security?
Awesome-GUI-Agent-Security is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by Yuxuan2003. GUI / Computer-Use / Browser Agent 安全论文清单 —— 按攻防轴组织，每篇附中文简介. It has 58 GitHub stars.
Is Awesome-GUI-Agent-Security safe to use?
Awesome-GUI-Agent-Security's catalog security scan is still queued. You can run an instant dependency and prompt-injection check now with the "Scan for vulnerabilities" button above.
How do I install Awesome-GUI-Agent-Security?
Clone the repository with "git clone https://github.com/Yuxuan2003/Awesome-GUI-Agent-Security" and add it to your Claude Code skills directory (see the Installation section above).
What programming language is Awesome-GUI-Agent-Security written in?
Awesome-GUI-Agent-Security is primarily written in Python. It is open-source under Yuxuan2003 on GitHub, so you can review or fork the full source.
Are there alternatives to Awesome-GUI-Agent-Security?
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh Awesome-GUI-Agent-Security against similar tools.
Comments (0)
to leave a comment.
No comments yet. Be the first to share your thoughts!
Related Skills
Skills for Real Engineers. Straight from my .agents directory.
250,518
21,171
Shell
AI Agents
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
247,521
37,303
JavaScript
AI Agentsai-agentsanthropic
An agentic skills framework & software development methodology that works.
234,966
20,863
Shell
AI Agentsaibrainstorming
The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
185,940
28,768
JavaScript
AI Agentsai-agentsanthropic
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
143,753
22,988
Python
AI Agents