Elamur Research⌕
☰
home / papers / 2026 / OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows

OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows

Paper · 2026 · Qiushi Sun, Mukai Li, Zhoumianze Liu et al.

Summary

Mobile GUI agents built on Vision-Language Models can carry out tasks on phones, but they may also behave unsafely, for example by leaking private data, posting offensive content or tampering with the system. This can happen even when the user's request is harmless. Prior work has three gaps: few mobile test environments, rule-based checks that do not scale, and detection that only looks at single steps. The authors address these with two resources. MobileRisk-Live is an Android-emulator sandbox that logs screenshots, accessibility trees, agent actions and a hidden System State Trace, such as background file operations and permission changes. MobileRisk is a benchmark of frozen, finely annotated trajectories collected from that sandbox. They also propose OS-Sentinel, a hybrid detector. Its Formal Verifier catches explicit system-level violations, and its VLM-based Contextual Judge assesses semantic risks. OS-Sentinel beats existing detectors by roughly 10–30% across metrics, at both step and trajectory level. The work matters because it supplies reproducible infrastructure and a stronger safeguard for autonomous phone agents.

Key points

  • A trajectory is labelled unsafe if any single step violates constraints, either at the system level (e.g., malicious package installation, permission escalation) or at the contextual level (e.g., privacy leakage, harmful content).
  • Frozen trajectories in MobileRisk give detection results close to those from live runs in MobileRisk-Live with a GPT-4o-driven agent, which supports reproducible offline evaluation.
  • OS-Sentinel was tested with GPT-4o, GPT-4o-Mini and gpt_oss backbones. Combining both components outperforms either one alone, and accuracy on unsafe cases exceeds 80%.
  • Category-wise results cover destructive operations, privacy violations, prompt injection, UI manipulation, resource abuse, over-automation and other categories. Baselines are strong only in some categories, while OS-Sentinel performs more evenly across them.
  • The main limitation is that the Formal Verifier needs system state traces. These are available on Android without root, but this makes the method less directly applicable to closed platforms like iOS.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Fudan UniversityShanghai · China202 works · 22,509 citations🎓Shanghai Jiao Tong UniversityShanghai · China212 works · 19,544 citations🎓Nanyang Technological UniversitySingapore · Singapore184 works · 27,484 citations🎓University of Hong KongPok Fu Lam · China118 works · 13,496 citations🔬Shanghai Artificial Intelligence LaboratoryShanghai · China152 works · 13,164 citations🎓Nanjing UniversityNanjing · China99 works · 8,510 citations

 Fields, topics and concepts

📚 Shelves 5The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksArts and Humanities · 17,450 worksLanguage and Linguistics · 17,296 worksSoftware · 119 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 587 works

Cite

Cite as Qiushi Sun, Mukai Li, Zhoumianze Liu, Zhihui Xie, Fangzhi Xu, Zhangyue Yin, Kanzhi Cheng, Zehao Li, Zichen Ding, Qi Liu, Zhiyong Wu, Zhuosheng Zhang, Ben Kao and Lingpeng Kong. 2026. OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.431

@inproceedings{sun2026os,
  title = {{OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows}},
  author = {Qiushi Sun, Mukai Li, Zhoumianze Liu, Zhihui Xie, Fangzhi Xu, Zhangyue Yin, Kanzhi Cheng, Zehao Li, Zichen Ding, Qi Liu, Zhiyong Wu, Zhuosheng Zhang, Ben Kao and Lingpeng Kong},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.431},
  url = {https://doi.org/10.18653/v1/2026.acl-long.431}
}

References

63 references, 19 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Qihang Ai, Pi Bu, Yue Cao, Yingyao Wang, Jihao Gu, Jingxuan Xing, Zekun Zhu, Wei Jiang, Zhicheng Zheng, Jun Song, Yuning Jiang, and Bo Zheng. 2025. Inquiremobile: Teaching vlm-based mobile agent to request human assistance via reinforcement fine-tuning. Preprint, arXiv:2508.19679. find
  2. Anthropic. 2025. Claude 3.7 sonnet system card. find
  3. Anthropic. 2025. Introducing claude sonnet 4.5. Accessed: 2026-01-04. find
  4. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, Jiabo Ye, Xi Zhang, Tianbao Xie, Zesen Cheng, Hang Zhang, Zhibo Yang, Ha… — Qwen2.5-VL Technical Report
  5. Chaoran Chen, Zhiping Zhang, Bingcan Guo, Shang Ma, Ibrahim Khalilov, Simret A Gebreegziabher, Yanfang Ye, Ziang Xiao, Yaxing Yao, Tianshi Li, and Toby Jia-Jun Li. 2025a. The obvious invisible threat: Llm-powered gui agents’ vulnerability to fine-print injections. Preprint, arXiv:2504.11281. — [arXiv:2504.11281](https://arxiv.org/abs/2504.11281) find
  6. Kangjie Chen, Li Muyang, Guanlin Li, Shudong Zhang, Shangwei Guo, and Tianwei Zhang. 2025b. TRUST-VLM: Thorough red-teaming for uncovering safety threats in vision-language models. In Forty-second International Conference on Machine Learning. find
  7. Xuetian Chen, Yinghao Chen, Xinfeng Yuan, Zhuo Peng, Lu Chen, Yuekeng Li, Zhoujia Zhang, Yingqian Huang, Leyan Huang, Jiaqing Liang, et al. 2025c. Os-map: How far can computer-using agents go in breadth and depth? arXiv preprint arXiv:2507.19132. — [arXiv:2507.19132](https://arxiv.org/abs/2507.19132) find
  8. Zichen Chen, Jiaao Chen, Jianda Chen, and Misha Sra. 2025d. Position: Standard benchmarks fail – llm agents present overlooked risks for financial applications. Preprint, arXiv:2502.15865. — [arXiv:2502.15865](https://arxiv.org/abs/2502.15865) find
  9. Kanzhi Cheng, Yantao Li, Fangzhi Xu, Jianbing Zhang, Hao Zhou, and Yang Liu. 2024a. Vision-language models can self-improve reasoning via reflection. arXiv preprint arXiv:2411.00855.
  10. Kanzhi Cheng, Qiushi Sun, Yougang Chu, Fangzhi Xu, Li YanTao, Jianbing Zhang, and Zhiyong Wu. 2024b. SeeClick: Harnessing GUI grounding for advanced visual GUI agents. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 9313– 9332…
  11. Pengzhou Cheng, Haowen Hu, Zheng Wu, Zongru Wu, Tianjie Ju, Zhuosheng Zhang, and Gongshen Liu. 2025. Hidden ghost hand: Unveiling backdoor vulnerabilities in mllm-powered mobile gui agents. Preprint, arXiv:2505.14418. find
  12. Xiang Deng, Yu Gu, Boyuan Zheng, Shijie Chen, Samuel Stevens, Boshi Wang, Huan Sun, and Yu Su. 2023. Mind2web: Towards a generalist agent for the web. In Thirty-seventh Conference on Neural Information Processing Systems Datasets and Benchmarks Track.
  13. Boyu Gou, Ruohan Wang, Boyuan Zheng, Yanan Xie, Cheng Chang, Yiheng Shu, Huan Sun, and Yu Su. 2024. Navigating the digital world as humans do: Universal visual grounding for gui agents. arXiv preprint arXiv:2410.05243.
  14. Chengyou Jia, Minnan Luo, Zhuohang Dang, Qiushi Sun, Fangzhi Xu, Junlin Hu, Tianbao Xie, and Zhiyong Wu. 2024. Agentstore: Scalable integration of heterogeneous agents as specialized generalist computer assistant. arXiv preprint arXiv:2410.18603. find
  15. Tianjie Ju, Yi Hua, Hao Fei, Zhenyu Shao, Yubin Zheng, Haodong Zhao, Mong-Li Lee, Wynne Hsu, Zhuosheng Zhang, and Gongshen Liu. 2025. Watch out your album! on the inadvertent privacy memorization in multi-modal large language models. In Forty-second International Conference on Machine Learning. find
  16. Thomas Kuntz, Agatha Duzan, Hao Zhao, Francesco Croce, J Zico Kolter, Nicolas Flammarion, and Maksym Andriushchenko. 2025. OS-harm: A benchmark for measuring safety of computer use agents. In ICML 2025 Workshop on Computer Use Agents. find
  17. Jungjae Lee, Dongjae Lee, Chihun Choi, Youngmin Im, Jaeyoung Wi, Kihong Heo, Sangeun Oh, Sunjae Lee, and Insik Shin. 2025. Verisafe agent: Safeguarding mobile gui agent via logic-based action verification. Preprint, arXiv:2503.18492. — [arXiv:2503.18492](https://arxiv.org/abs/2503.18492) find
  18. Juyong Lee, Dongyoon Hahm, June Suk Choi, W. Bradley Knox, and Kimin Lee. 2024. Mobilesafetybench: Evaluating safety of autonomous agents in mobile device control. Preprint, arXiv:2410.17520. — [arXiv:2410.17520](https://arxiv.org/abs/2410.17520) find
  19. Ido Levy, Ben Wiesel, Sami Marreed, Alon Oved, Avi Yaeli, and Segev Shlomov. 2025. St-webagentbench: A benchmark for evaluating safety and trustworthiness in web agents. Preprint, arXiv:2410.06703. — [arXiv:2410.06703](https://arxiv.org/abs/2410.06703) find
  20. Mukai Li, Lei Li, Yuwei Yin, Masood Ahmed, Zhenguang Liu, and Qi Liu. 2024a. Red teaming visual language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 3326– 3342, Bangkok, Thailand. Association for Computational Linguistics. find
  21. Wei Li, William E Bishop, Alice Li, Christopher Rawles, Folawiyo Campbell-Ajala, Divya Tyamagundlu, and Oriana Riva. 2024b. On the effects of data scale on UI control agents. In The Thirty-eight Conference on Neural Information Processing Systems Datasets and Benchmarks Track.
  22. Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. 2025. EIA: Environmental injection attack on generalist web agents for privacy leakage. In The Thirteenth International Conference on Learning Representations. find
  23. Guohong Liu, Jialei Ye, Jiacheng Liu, Yuanchun Li, Wei Liu, Pengzhi Gao, Jian Luan, and Yunxin Liu. 2025a. Hijacking jarvis: Benchmarking mobile gui agents against unprivileged third parties. Preprint, arXiv:2507.04227. — [arXiv:2507.04227](https://arxiv.org/abs/2507.04227) find
  24. Xiao Liu, Bo Qin, Dongzhu Liang, Guang Dong, Hanyu Lai, Hanchen Zhang, Hanlin Zhao, Iat Long Iong, Jiadai Sun, Jiaqi Wang, Junjie Gao, Junjun Shan, Kangning Liu, Shudan Zhang, Shuntian Yao, Siyi Cheng, Wentao Yao, Wenyi Zhao, Xinghan Liu, Xinyi Liu, Xinying Chen, Xinyue Yang, Yang Yang, Yifan Xu, Yu… — [arXiv:2411.00820](https://arxiv.org/abs/2411.00820) find
  25. Yupei Liu, Yuqi Jia, Jinyuan Jia, Dawn Song, and Neil Zhenqiang Gong. 2025b. DataSentinel: A Game-Theoretic Detection of Prompt Injection Attacks . In 2025 IEEE Symposium on Security and Privacy (SP), pages 2190–2208, Los Alamitos, CA, USA. IEEE Computer Society. find
  26. Zhaoyang Liu, Jingjing Xie, Zichen Ding, Zehao Li, Bowen Yang, Zhenyu Wu, Xuehui Wang, Qiushi Sun, Shi Liu, Weiyun Wang, Shenglong Ye, Qingyun Li, Xuan Dong, Yue Yu, Chenyu Lu, YunXiang Mo, Yao Yan, Zeyue Tian, Xiao Zhang, Yuan Huang, Yiqian Liu, Weijie Su, Gen Luo, Xiangyu Yue, Biqing Qi, Kai Chen,… — [arXiv:2509.15221](https://arxiv.org/abs/2509.15221) find
  27. Yijie Lu, Tianjie Ju, Manman Zhao, Xinbei Ma, Yuan Guo, and Zhuosheng Zhang. 2025. Eva: Red-teaming gui agents via evolving indirect prompt injection. Preprint, arXiv:2505.14289. — [arXiv:2505.14289](https://arxiv.org/abs/2505.14289) find
  28. Dezhao Luo, Bohan Tang, Kang Li, Georgios Papoudakis, Jifei Song, Shaogang Gong, Jianye Hao, Jun Wang, and Kun Shao. 2025. Vimo: A generative visual gui world model for app agents. Preprint, arXiv:2504.13936. — [arXiv:2504.13936](https://arxiv.org/abs/2504.13936) find
  29. Xinbei Ma, Yiting Wang, Yao Yao, Tongxin Yuan, Aston Zhang, Zhuosheng Zhang, and Hai Zhao. 2025. Caution for the environment: Multimodal llm agents are susceptible to environmental distractions. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon… find
  30. Silen Naihin, David Atkinson, Marc Green, Mer-wane Hamadi, Craig Swift, Douglas Schonholtz, Adam Tauman Kalai, and David Bau. 2023. Testing language model agents safely in the wild. Preprint, arXiv:2311.10538. — [arXiv:2311.10538](https://arxiv.org/abs/2311.10538) find
  31. OpenAI. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276.
  32. OpenAI. 2025. gpt-oss-120b & gpt-oss-20b model card. gpt-oss model card, 1:1.
  33. Christopher Rawles, Sarah Clinckemaillie, Yifan Chang, Jonathan Waltz, Gabrielle Lau, Marybeth Fair, Alice Li, William Bishop, Wei Li, Folawiyo Campbell-Ajala, et al. 2024. Androidworld: A dynamic benchmarking environment for autonomous agents. arXiv preprint arXiv:2405.14573.
  34. Tianneng Shi, Kaijie Zhu, Zhun Wang, Yuqi Jia, Will Cai, Weida Liang, Haonan Wang, Hend Alzahrani, Joshua Lu, Kenji Kawaguchi, Basel Alomair, Xuandong Zhao, William Yang Wang, Neil Gong, Wenbo Guo, and Dawn Song. 2025a. Promptarmor: Simple yet effective prompt injection defenses. Preprint, arXiv:250… find
  35. Yucheng Shi, Wenhao Yu, Wenlin Yao, Wenhu Chen, and Ninghao Liu. 2025b. Towards trustworthy gui agents: A survey. arXiv preprint arXiv:2503.23434. — [arXiv:2503.23434](https://arxiv.org/abs/2503.23434) find
  36. Qiushi Sun, Zhirui Chen, Fangzhi Xu, Kanzhi Cheng, Chang Ma, Zhangyue Yin, Jianing Wang, Chengcheng Han, Renyu Zhu, Shuai Yuan, et al. 2024a. A survey of neural code intelligence: Paradigms, advances and beyond. arXiv preprint arXiv:2403.14734. — [arXiv:2403.14734](https://arxiv.org/abs/2403.14734) find
  37. Qiushi Sun, Kanzhi Cheng, Zichen Ding, Chuanyang Jin, Yian Wang, Fangzhi Xu, Zhenyu Wu, Chengyou Jia, Liheng Chen, Zhoumianze Liu, et al. 2024b. Os-genesis: Automating gui agent trajectory construction via reverse task synthesis. arXiv preprint arXiv:2412.19723.
  38. Qiushi Sun, Zhoumianze Liu, Chang Ma, Zichen Ding, Fangzhi Xu, Zhangyue Yin, Haiteng Zhao, Zhenyu Wu, Kanzhi Cheng, Zhaoyang Liu, et al. 2025. Scienceboard: Evaluating multimodal autonomous agents in realistic scientific workflows. arXiv preprint arXiv:2505.19897. find
  39. Qiushi Sun, Zhangyue Yin, Xiang Li, Zhiyong Wu, Xipeng Qiu, and Lingpeng Kong. 2023. Corex: Pushing the boundaries of complex reasoning through multi-model collaboration. arXiv preprint arXiv:2310.00280. find
  40. Laurens van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-sne. Journal of Machine Learning Research, 9(86):2579–2605. find
  41. Sanidhya Vijayvargiya, Aditya Bharat Soni, Xuhui Zhou, Zora Zhiruo Wang, Nouha Dziri, Graham Neubig, and Maarten Sap. 2025. Openagentsafety: A comprehensive framework for evaluating real-world ai agent safety. Preprint, arXiv:2507.06134. find
  42. Junyang Wang, Haiyang Xu, Jiabo Ye, Ming Yan, Weizhou Shen, Ji Zhang, Fei Huang, and Jitao Sang. 2024a. Mobile-agent: Autonomous multi-modal mobile device agent with visual perception. In ICLR 2024 Workshop on Large Language Model (LLM) Agents. find
  43. Weiyun Wang, Zhangwei Gao, Lixin Gu, Hengjun Pu, Long Cui, Xingguang Wei, Zhaoyang Liu, Linglin Jing, Shenglong Ye, Jie Shao, et al. 2025a. Internvl3.5: Advancing open-source multimodal models in versatility, reasoning, and efficiency. arXiv preprint arXiv:2508.18265.
  44. Xinyuan Wang, Bowen Wang, Dunjie Lu, Junlin Yang, Tianbao Xie, Junli Wang, Jiaqi Deng, Xiaole Guo, Yiheng Xu, Chen Henry Wu, Zhennan Shen, Zhuokai Li, Ryan Li, Xiaochuan Li, Junda Chen, Boyuan Zheng, Peihang Li, Fangyu Lei, Ruisheng Cao, Yeqiao Fu, Dongchan Shin, Martin Shin, Jiarui Hu, Yuyan Wang,… find
  45. Xuan Wang, Siyuan Liang, Zhe Liu, Yi Yu, Aishan Liu, Yuliang Lu, Xitong Gao, and Ee-Chien Chang. 2025c. Poison once, control anywhere: Clean-text visual backdoors in vlm-based mobile agents. Preprint, arXiv:2506.13205. — [arXiv:2506.13205](https://arxiv.org/abs/2506.13205) find
  46. Zhenting Wang, Shuming Hu, Shiyu Zhao, Xiaowen Lin, Felix Juefei-Xu, Zhuowei Li, Ligong Han, Harihar Subramanyam, Li Chen, Jianfa Chen, et al. 2025d. Mllm-as-a-judge for image safety without human labeling. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 14657– 14666. find
  47. Zhiruo Wang, Zhoujun Cheng, Hao Zhu, Daniel Fried, and Graham Neubig. 2024b. What are tools anyway? a survey from the language model perspective. Preprint, arXiv:2403.15452. find
  48. Qianhui Wu, Kanzhi Cheng, Rui Yang, Chaoyun Zhang, Jianwei Yang, Huiqiang Jiang, Jian Mu, Baolin Peng, Bo Qiao, Reuben Tan, et al. 2025a. Gui-actor: Coordinate-free visual grounding for gui agents. arXiv preprint arXiv:2506.03143. — [arXiv:2506.03143](https://arxiv.org/abs/2506.03143) find
  49. Zheng Wu, Heyuan Huang, Xingyu Lou, Xiangmou Qu, Pengzhou Cheng, Zongru Wu, Weiwen Liu, Weinan Zhang, Jun Wang, Zhaoxiang Wang, and Zhuosheng Zhang. 2025b. Verios: Query-driven proactive human-agent-gui interaction for trustworthy os agents. Preprint, arXiv:2509.07553. — [arXiv:2509.07553](https://arxiv.org/abs/2509.07553) find
  50. Zhiyong Wu, Chengcheng Han, Zichen Ding, Zhenmin Weng, Zhoumianze Liu, Shunyu Yao, Tao Yu, and Lingpeng Kong. 2024a. OS-copilot: Towards generalist computer agents with self-improvement. In ICLR 2024 Workshop on Large Language Model (LLM) Agents.
  51. Zhiyong Wu, Zhenyu Wu, Fangzhi Xu, Yian Wang, Qiushi Sun, Chengyou Jia, Kanzhi Cheng, Zichen Ding, Liheng Chen, Paul Pu Liang, et al. 2024b. Os-atlas: A foundation action model for generalist gui agents. arXiv preprint arXiv:2410.23218.
  52. Tianbao Xie, Danyang Zhang, Jixuan Chen, Xiaochuan Li, Siheng Zhao, Ruisheng Cao, Toh Jing Hua, Zhoujun Cheng, Dongchan Shin, Fangyu Lei, Yitao Liu, Yiheng Xu, Shuyan Zhou, Silvio Savarese, Caiming Xiong, Victor Zhong, and Tao Yu. 2024. OSWorld: Benchmarking multimodal agents for open-ended tasks in…
  53. Fangzhi Xu, Qiushi Sun, Kanzhi Cheng, Jun Liu, Yu Qiao, and Zhiyong Wu. 2025a. Interactive evolution: A neural-symbolic self-training framework for large language models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (ACL), pages 12975–12993. Association…
  54. Fangzhi Xu, Hang Yan, Chang Ma, Haiteng Zhao, Qiushi Sun, Kanzhi Cheng, Junxian He, Jun Liu, and Zhiyong Wu. 2025b. Genius: A generalizable and purely unsupervised self-training framework for advanced reasoning. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguisti…
  55. Jingyi Yang, Shuai Shao, Dongrui Liu, and Jing Shao. 2025. Riosworld: Benchmarking the risk of multimodal computer-use agents. Preprint, arXiv:2506.00618. — [arXiv:2506.00618](https://arxiv.org/abs/2506.00618) find
  56. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik R Narasimhan, and Yuan Cao. 2023. React: Synergizing reasoning and acting in language models. In The Eleventh International Conference on Learning Representations.
  57. Biao Yi, Xavier Hu, Yurun Chen, Shengyu Zhang, Hongxia Yang, Fan Wu, and Fei Wu. 2025. Eco-agent: An efficient edge-cloud collaborative multi-agent framework for mobile automation. Preprint, arXiv:2505.05440. — [arXiv:2505.05440](https://arxiv.org/abs/2505.05440) find
  58. Zonghao Ying, Aishan Liu, Siyuan Liang, Lei Huang, Jinyang Guo, Wenbo Zhou, Xianglong Liu, and Dacheng Tao. 2024. Safebench: A safety evaluation framework for multimodal large language models. Preprint, arXiv:2410.18927. — [arXiv:2410.18927](https://arxiv.org/abs/2410.18927) find
  59. Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Fangqi Li, Zhuosheng Zhang, et al. 2024. R-judge: Benchmarking safety risk awareness for llm agents. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 1467–1490.
  60. Junlei Zhang, Zichen Ding, Chang Ma, Zijie Chen, Qiushi Sun, Zhenzhong Lan, and Junxian He. 2025a. Breaking the data barrier–building gui agents through task generalization. arXiv preprint arXiv:2504.10127. — [arXiv:2504.10127](https://arxiv.org/abs/2504.10127) find
  61. Yanzhe Zhang, Tao Yu, and Diyi Yang. 2025b. Attacking vision-language computer agents via pop-ups. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8387–8401, Vienna, Austria. Association for Computational Linguistics.
  62. Zhuohao (Jerry) Zhang, Eldon Schoop, Jeffrey Nichols, Anuj Mahajan, and Amanda Swearngin. 2025c. From interaction to impact: Towards safer ai agent through understanding and evaluating mobile ui operation impacts. In Proceedings of the 30th International Conference on Intelligent User Interfaces, IU… find
  63. Boyuan Zheng, Zeyi Liao, Scott Salisbury, Zeyuan Liu, Michael Lin, Qinyuan Zheng, Zifan Wang, Xiang Deng, Dawn Song, Huan Sun, et al. 2025. Webguard: Building a generalizable guardrail for web agents. arXiv preprint arXiv:2507.14293. \#\# Discussion Prioritizing Safety Recall in Risk Scenarios find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/sun-2026-os-sentinel-safety-enhanced-mobile/