Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
In the wild Realized harm

PROMPTSPY: Android backdoor that drives the device through a hardcoded-prompt Gemini automation agent

AIR-2026-0111 AIR record · 2026-05-gtig-promptspy
Open in dashboard About
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
GeminiAutomationAgent, which leverages a hardcoded prompt to facilitate automated interaction with the targeted devicecloud.google.com
The record
Disclosed
2026-05-12
Vendor
Google / device owners
Product
Android devices; Gemini-driven automation agent
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft
System type
Generative model
Who acted
Agent acted — the embedded agent drove the victim's device UI autonomously
Attack surface
Computer-use agent
Autonomy level
Fully autonomous
Initial vector
Malicious android application
Impact type
Device takeover, Credential theft, Surveillance
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI04 – Agentic Supply Chain Vulnerabilities
MITRE ATLAS
AML.T0040 – AI Supply Chain Compromise
NIST AI RMF
MAP 4.1
EU AI Act
Annex III §2
ISO/IEC
TR 24028; 42001; 23894
AIUC-1
B. Security
Scope
tool failure
Mitigation
Scan dependencies and container images for vulnerabilities; Use trusted sources.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Infected Android devices; can replay captured PINs or lock patterns to regain access
Capability abused
device_ui_automationbiometric_gesture_replayautonomous_interaction
Taxonomy & references
OWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI02 Tool Misuse and Exploitationcomputer_use_agent_abusebiometric_replaymobile
Curator notes
First malware family in this corpus that embeds a computer-use style agent to operate a victim's device UI autonomously. Originally identified by ESET; GTIG's writeup is the source of record here. Victim counts not published.
Supporting sources
Cite as
Enkrypt AI. "PROMPTSPY: Android backdoor that drives the device through a hardcoded-prompt Gemini automation agent". AIR, AIR-2026-0111. https://agentincident.vercel.app/i/AIR-2026-0111/ (accessed 2026-10-19).