{
  "aliases": [],
  "authors": [
    "Lukas Aichberger",
    "Alasdair Paren",
    "Guohao Li",
    "Philip Torr",
    "Yarin Gal",
    "Adel Bibi"
  ],
  "details": {
    "arxiv_snapshot": {
      "abstract_hash_method": "sha256-utf8-whitespace-collapsed-v1",
      "abstract_sha256": "7e5622a83d74c18761a7ab88c98682d3903ce0b6700c7e9814f069bfba26e796",
      "submitted_at": "2025-03-13T18:59:12Z",
      "updated_at": "2026-01-27T18:10:17Z",
      "version": 3,
      "versioned_url": "https://arxiv.org/abs/2503.10809v3"
    }
  },
  "environments": [
    "desktop"
  ],
  "evidence": [
    {
      "method": "arxiv_api",
      "retrieved_at": "2026-10-17T07:57:44Z",
      "role": "primary",
      "sha256": "9ca057ee6538002c739e58a7b3f86fc51a434d085a33e5590f0720e4f27c6b24",
      "supports": [
        "name",
        "authors",
        "published_at",
        "updated_at",
        "identifiers.arxiv",
        "details.arxiv_snapshot"
      ],
      "url": "https://export.arxiv.org/api/query?id_list=2501.06497%2C2501.06994%2C2501.07834%2C2501.07927%2C2501.11233%2C2501.15570%2C2501.16403%2C2501.16609%2C2501.17391%2C2502.00372%2C2502.00392%2C2502.00964%2C2502.00988%2C2502.01562%2C2502.01839%2C2502.03723%2C2502.05174%2C2502.05227%2C2502.08489%2C2502.11221%2C2502.12130%2C2502.14496%2C2502.16587%2C2502.16786%2C2502.16796%2C2502.18356%2C2502.18512%2C2502.20383%2C2502.20390%2C2502.20582%2C2503.06378%2C2503.08026%2C2503.10613%2C2503.10809%2C2503.11579%2C2503.12228%2C2503.12461%2C2503.13843%2C2503.14495%2C2503.15426%2C2503.16036%2C2503.16248%2C2503.16975%2C2503.17671%2C2503.18102%2C2503.21889%2C2503.21949%2C2503.23803%2C2504.01328%2C2504.01377&max_results=50"
    },
    {
      "method": "editorial_primary_review",
      "retrieved_at": "2026-11-05T23:01:33Z",
      "role": "primary",
      "sha256": "b7001e189c17d6fa072573558661e37a7cb4c7709d33080603d72a969cc4ba39",
      "supports": [
        "name",
        "kind",
        "summary",
        "environments",
        "topics",
        "scope",
        "relations"
      ],
      "url": "https://export.arxiv.org/api/query?id_list=2503.02878%2C2503.06378%2C2503.06580%2C2503.07365%2C2503.07701%2C2503.08026%2C2503.08175%2C2503.10613%2C2503.10809%2C2503.11579%2C2503.12228%2C2503.12461%2C2503.12687%2C2503.13843%2C2503.14495%2C2503.15426%2C2503.16036%2C2503.16248%2C2503.16365%2C2503.16975%2C2503.17671%2C2503.18102%2C2503.20036%2C2503.21889%2C2503.21949%2C2503.23803%2C2504.01328%2C2504.01377%2C2504.03206%2C2504.03601%2C2504.06821%2C2504.07491%2C2504.09723%2C2504.10147%2C2504.11301%2C2504.11543%2C2504.11703%2C2504.12609%2C2504.12682%2C2504.14233%2C2504.14348%2C2504.17892%2C2504.18580%2C2504.20965%2C2505.00019%2C2505.00693%2C2505.01578%2C2505.02094%2C2505.03574%2C2505.03733&max_results=50"
    }
  ],
  "id": "arxiv:2503.10809",
  "identifiers": {
    "arxiv": "2503.10809"
  },
  "kind": "paper",
  "last_verified_at": "2026-11-05T23:01:33Z",
  "licenses": {
    "code": null,
    "data": null,
    "document": null,
    "weights": null
  },
  "links": [
    {
      "rel": "primary",
      "url": "https://arxiv.org/abs/2503.10809"
    }
  ],
  "name": "MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agents",
  "notes": "The annotation and scope were reviewed against the complete retained arXiv abstract (v3). Experiments, reported performance and artifact availability have not been independently reproduced.",
  "published_at": "2025-03-13",
  "relations": [],
  "review_status": "curated",
  "scope": "core",
  "summary": "Studies Malicious Image Patches (MIPs), altered screen regions that can steer screenshot-based OS agents into harmful mouse and keyboard actions.",
  "topics": [
    "safety-security",
    "screen-understanding"
  ],
  "updated_at": "2026-01-27",
  "url": "https://arxiv.org/abs/2503.10809"
}