Open-source Android AI agents can turn hidden screen text into host commands, and all five tested frameworks failed at least six lab attacks.