"Allow" to Achieve, Over-Privileged Inadvertently: The Unintended Cost of Task-Completion-Driven Pop-up Decisions in Mobile GUI Agents

2026-08-05

AI Summary

This study addresses the challenge of over-authorization in mobile GUI agents, which frequently encounter permission prompts during task execution yet lack systematic evaluation of whether they grant only necessary permissions. The authors introduce the concept of “permission literacy” and propose a four-tier permission framework integrating task relevance and privacy risk. Through controlled experiments on multimodal large language models using Android-style permission dialogs injected into real-world GUI tasks, they analyze the influence of task context and requester identity, leveraging synchronized screen captures, UI trees, and expert-validated scenarios. Findings reveal that agents exhibit task-dependent app trust bias and a task-priority override effect: changing the requester identity reduces authorization rates from 26/32 to 0/32. While just-in-time prompts mitigate unnecessary grants, their efficacy is inconsistent and may suppress legitimate authorizations. The work advocates decoupling task execution from permission granting as a design principle.

Abstract

Mobile GUI agents routinely encounter system permission dialogs during task execution, yet their ability to grant only permissions that are necessary for the delegated task remains largely unexamined. We present a systematic study of this capability, which we term Permission Literacy. We construct a four-level permission framework based on task relevance and privacy risk and validate the evaluated scenarios with three independent experts in GUI-agent safety. We inject Android-style permission popups into real GUI tasks and evaluate four frontier multimodal large language models using synchronized annotated screenshots and UI-tree hierarchies, making the requester, permission, justification, and available actions accessible to the agent. Beyond the main study, we conduct controlled interventions that separately vary task context and agent-visible requester identity. Under the same Calendar task, changing only the requester from Calendar to PiMusic reduces grants from 26/32 to 0/32, revealing a strong but task-conditioned App-Trust Bias. Holding a popup fixed while changing task context also substantially changes authorization decisions, revealing a systematic Task-Prior Override. Prompt interventions can reduce unnecessary grants, but their effectiveness is inconsistent across models and may come at the cost of suppressing legitimate grants. These results suggest that separating task execution from permission authorization is a promising design direction for future work.

Problem

• Permission Literacy
• Mobile GUI Agents
• Over-Privileged
• Task-Completion-Driven Decisions
• Privacy Risk

Innovation

• Permission Literacy
• App-Trust Bias
• Task-Prior Override
• Mobile GUI Agents
• Multimodal LLMs