arXiv · 2609.02154
WiP: Characterizing and Defending Against Mobile-Agent-Driven MFA Automation
Abstract
Mobile agents automate smartphone tasks by interpreting interfaces, interacting with apps, and coordinating cross-app workflows. This capability challenges the human-mediated separation assumed by passcode-based MFA, creating factor collapse: valid authentication factors are combined within one autonomous environment. Our modular pipeline com- pletes all 10 authorized MFA workflows, compared with 3/10 and 6/10 for two single-agent baselines. We also de- velop a motion-based Android risk signal that distinguishes human- from agent-driven logins with 98.4% table-top and 92.6% hand-held accuracy across 116 pilot sessions. These results demonstrate factor collapse and motivate physical- interaction sensing as complementary evidence of user pres- ence.
Explore related subjects
Keep this discovery
Yimeng Liu, Hua Huang. 2026-09-02. WiP: Characterizing and Defending Against Mobile-Agent-Driven MFA Automation. https://arxiv.org/abs/2609.02154
Cite the original work for its findings. Save a collection to share your selection of sources.
Discover connections
Connections use source metadata and explicit phrase matches, not verified experimental comparisons.