Source-linked AI summary
WiP: Characterizing and Defending Against Mobile-Agent-Driven MFA Automation
Yimeng Liu, Hua Huang
TL;DR
Passcode-based MFA assumes human participation separates credential entry from passcode retrieval and submission, but mobile agents can complete those steps in one workflow. The paper evaluates a modular agent pipeline and a motion-based sensing defense; the pipeline completes all ten tested workflows, while sensing distinguishes human- and agent-driven sessions in both device-use conditions.
Problem
Passcode-based MFA assumes credential entry, passcode retrieval, and submission remain operationally separated through user participation, an assumption challenged by mobile agents that can perform the full workflow.
Source: §1 · p. 1Method
The paper decomposes MFA automation into specialized workers and evaluates device-motion sensing as a complementary signal of physical participation.
Source: §2.1 · p. 2Results
The two-agent design completed 10/10 workflows versus 3/10 and 6/10 for single-agent baselines; motion classification achieved 98.4% table-top and 92.6% hand-held accuracy.
Source: §3.2 · pp. 2–3, §3.3 · p. 3Takeaways & Limitations
The results demonstrate factor collapse and suggest motion sensing can provide complementary evidence of human participation during authentication.
Source: §1 · p. 1, §4 · p. 3The attack evaluation covers ten selected targets; future work will expand evaluation across services, devices, participants, and authentication workflows.
Source: §4 · p. 3
Abstract
from arXiv · showhide
Mobile agents automate smartphone tasks by interpreting interfaces, interacting with apps, and coordinating cross-app workflows. This capability challenges the human-mediated separation assumed by passcode-based MFA, creating factor collapse: valid authentication factors are combined within one autonomous environment. Our modular pipeline com- pletes all 10 authorized MFA workflows, compared with 3/10 and 6/10 for two single-agent baselines. We also de- velop a motion-based Android risk signal that distinguishes human- from agent-driven logins with 98.4% table-top and 92.6% hand-held accuracy across 116 pilot sessions. These results demonstrate factor collapse and motivate physical- interaction sensing as complementary evidence of user pres- ence.
1 Introduction
Passcode-based MFA assumes users keep credential entry, code retrieval, and code submission operationally separate, but mobile agents can complete the full workflow autonomously. The paper demonstrates end-to-end MFA automation and explores motion sensing as evidence of human participation.
Factor collapse
- Factor collapse occurs when an autonomous execution environment joins authentication operations that MFA assumes are operationally independent.The agent retrieves and submits valid factors through normal workflow actions rather than bypassing MFA.Source: §1 · p. 1
End-to-end automation
- The prototype completes email-OTP and authenticator-code workflows across ten representative websites and mobile applications.The workflows use authorized accounts.Source: §1 · p. 1
Sensing defense
- Short-window motion sensing preliminarily distinguishes user-driven from fully agent-driven login sessions.The proposed device-side defense detects the absence of ordinary human interaction during authentication.Source: §1 · p. 1
2 Attack Pipeline and Sensing Defense
The attack pipeline splits MFA automation into specialized workers, while the sensing defense uses device motion as a complementary signal of physical participation.
2.1 Agent-Driven Factor-Collapse Pipeline
- The modular pipeline assigns login and OTP retrieval to one worker and code entry and login completion to another.Workers exchange only the workflow state needed to continue, including the retrieved passcode.Source: §2.1 · p. 2
- Separating stages limits each worker’s action space and enables recovery of retrieval or code-entry failures without restarting earlier steps.The pipeline is intended as a systematic and reproducible basis for evaluating factor collapse.Source: §2.1 · p. 2
2.2 Physical-Interaction Sensing Defense
- The defense records accelerometer and gyroscope signals at 50 Hz during passcode entry and final submission, then classifies motion features with an extra-trees classifier.Features include signal magnitude, variance, motion energy, jerk, peak count, and frequency-domain energy; uncertain or agent-like sessions trigger additional verification.Source: §2.2 · p. 2
3 Evaluation
The evaluation tests a modular MFA-automation pipeline and a motion-sensing defense under specified service, action-budget, and device-use conditions.
3.1 Factor-Collapse Implementation
- The pipeline was implemented on MobileRun with GPT-5 mini, separate worker prompts and histories, and a controller that shared minimal state and retried failed stages.Source: §3.1 · p. 2
3.2 Factor-Collapse Attack Evaluation
- Ten commercial websites and mobile apps were tested using email-delivered OTPs or authenticator codes, with success defined as reaching post-login within 15 actions.Outcomes were manually verified and end-to-end completion time was recorded.Source: §3.2 · p. 2
- 10/10 workflows succeeded with the two-agent design, versus 3/10 and 6/10 for single-agent baselines; coordination modestly increased completion time versus detailed prompting.The two-agent design improved reliability by separating form interaction and OTP retrieval.Source: §3.2 · pp. 2–3, Figure 2 · p. 3, Figure 3 · p. 3
3.3 Physical-Interaction Sensing Evaluation
- 98.4% table-top accuracy and 92.6% hand-held accuracy were achieved; pooling both conditions yielded 95.7% accuracy across 116 sessions.The hand-held condition was more challenging because both user-driven and agent-driven sessions contained natural hand motion.Source: Figure 4 · p. 3, §3.3 · p. 3
4 Conclusion and Future Work
The modular design completes 10/10 workflows, outperforming both single-agent baselines, while pilot motion sensing distinguishes user-driven from agent-driven sessions. Future work will broaden evaluation and examine sensing reliability and user-intent safeguards.
4 Conclusion and Future Work
- 10/10 workflows were completed by the modular two-agent design, compared with 3/10 and 6/10 for two single-agent baselines.These results were obtained on ten selected targets.Source: §4 · p. 3
- 92.6% accuracy under hand-held use was achieved by the pilot motion-sensing classifier distinguishing user-driven from agent-driven sessions.Source: §4 · p. 3
- Future work will formalize the threat model and expand evaluation across services, devices, participants, and authentication workflows.Source: §4 · p. 3
- The authors plan to examine adaptive agents, sensor manipulation, and deployment conditions that may reduce physical-interaction sensing reliability.Source: §4 · p. 3
- Future work will investigate combining sensing-based risk signals with user confirmation and verifier-bound authentication to preserve user intent.The proposed approaches avoid relying solely on successful passcode submission.Source: §4 · p. 3