Towards Trustworthy GUI Agents: A Survey
On the map: LLM agents and tool use → GUI and mobile agents
Abstract (arXiv)
Graphical User Interface (GUI) agents extend large language models from text generation to action execution in real-world digital environments. Unlike conversational systems, GUI agents perform irreversible operations such as submitting forms, granting permissions, or deleting data, making trustworthiness a core requirement. This survey identifies the execution gap as a key challenge in building trustworthy GUI agents: the misalignment between perception, reasoning, and interaction in dynamic, partially observable interfaces. We introduce a workflow-aligned taxonomy that decomposes trust into Perception Trust, Reasoning Trust, and Interaction Trust, showing how failures propagate across agent pipelines and compound through action/observation loops. We systematically review benign failure modes and adversarial attacks at each stage, together with corresponding defense mechanisms tailored to GUI settings. We further analyze evaluation practices and argue that task completion alone is insufficient for trust assessment. We highlight emerging trust-aware metrics and benchmarks that capture error cascades and the security/utility trade-off, and outline open challenges for deploying GUI agents safely and reliably.
Key facts. Cited by 33 papers in the map (data through 7 Oct 2026). Placed in GUI and mobile agents, one of 16 directions in LLM agents and tool use. Builds on 62 of its 121 references that are in the map. First posted on arXiv 30 Mar 2025.
Builds on
62 of 121 references.
Closest ancestors · 10
Same direction, newest first
- 2025VeriSafe Agent: Safeguarding Mobile GUI Agent via Logic-based Action Verification24 Mar
- 2025PC-Agent: A Hierarchical Multi-Agent Collaboration Framework for Complex Task Automation on PC20 Feb
- 2024GUI Testing Arena: A Unified Benchmark for Advancing Autonomous GUI Testing Agent24 Dec
- 2024Large Language Model-Brained GUI Agents: A Survey27 Nov
- 2024GUI Agents with Foundation Models: A Comprehensive Survey7 Nov
- 2024OS-ATLAS: A Foundation Action Model for Generalist GUI Agents30 Oct
- 2024MobileSafetyBench: Evaluating Safety of Autonomous Agents in Mobile Device Control23 Oct
- 2024Agent S: An Open Agentic Framework that Uses Computers Like a Human10 Oct
- 2024Navigating the Digital World as Humans Do: Universal Visual Grounding for GUI Agents7 Oct
- 2024Caution for the Environment: Multimodal LLM Agents are Susceptible to Environmental Distractions5 Aug
Other references · 52
- 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,210
- 2022WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agentscited by 1,197
- 2024GPT-4V(ision) is a Generalist Web Agent, if Groundedcited by 547
- 2023OPERA: Alleviating Hallucination in Multi-Modal Large Language Models via Over-Trust Penalty and Retrospection-Allocationcited by 468
- 2023Mitigating Hallucination in Large Multi-Modal Models via Robust Instruction Tuningcited by 439
- 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 406
- 2023Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignmentcited by 394
- 2024Agent-SafetyBench: Evaluating the Safety of LLM Agentscited by 280
- 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 226
- 2024From Persona to Personalization: A Survey on Role-Playing Language Agentscited by 206
- 2023AutoDroid: LLM-powered Task Automation in Androidcited by 178
- 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakagecited by 146
38 more
- 2024Is Your LLM Secretly a World Model of the Internet? Model-Based Planning for Web Agentscited by 144
- 2024Towards Safer Large Language Models through Machine Unlearningcited by 134
- 2024ST-WebAgentBench: A Benchmark for Evaluating Safety and Trustworthiness in Web Agentscited by 126
- 2024Cooperate or Collapse: Emergence of Sustainable Cooperation in a Society of LLM Agentscited by 120
- 2024Web Agents with World Models: Learning and Leveraging Environment Dynamics in Web Navigationcited by 116
- 2024Attacking Vision-Language Computer Agents via Pop-upscited by 112
- 2023Volcano: Mitigating Multimodal Hallucination through Self-Feedback Guided Revisioncited by 96
- 2024Imprompter: Tricking LLM Agents into Improper Tool Usecited by 66
- 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
- 2024TrustAgent: Towards Safe and Trustworthy LLM-based Agentscited by 62
- 2024Refusal-Trained LLMs Are Easily Jailbroken As Browser Agentscited by 61
- 2024PAPILLON: Privacy Preservation from Internet-based and Local Language Model Ensemblescited by 54
- 2024WIPI: A New Web Threat for LLM-Driven Web Agentscited by 50
- 2023ASSISTGUI: Task-Oriented Desktop Graphical User Interface Automationcited by 45
- 2024Usable XAI: 10 Strategies Towards Exploiting Explainability in the LLM Eracited by 45
- 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 44
- 2024Evaluating Cultural and Social Awareness of LLM Web Agentscited by 43
- 2025Culture is Not Trivia: Sociocultural Theory for Cultural NLPcited by 40
- 2024OSCAR: Operating System Control via State-Aware Reasoning and Re-Planningcited by 37
- 2024CLEAR: Towards Contextual LLM-Empowered Privacy Policy Analysis and Risk Generation for Large Language Model Applicationscited by 33
- 2024CoCA: Regaining Safety-awareness of Multimodal Large Language Models with Constitutional Calibrationcited by 30
- 2024DynaSaur: Large Language Agents Beyond Predefined Actionscited by 30
- 2023AHA!: Facilitating AI Impact Assessment by Generating Examples of Harmscited by 26
- 2025Protecting Users From Themselves: Safeguarding Contextual Privacy in Interactions with Conversational Agentscited by 26
- 2025Nuclear Deployed: Analyzing Catastrophic Risks in Decision-making of Autonomous LLM Agentscited by 23
- 2024When LLMs Go Online: The Emerging Threat of Web-Enabled LLMscited by 22
- 2024Falcon-UI: Understanding GUI Before Following User Instructionscited by 22
- 2025Interpreting and Steering LLMs with Mutual Information-based Explanations on Sparse Autoencoderscited by 21
- 2024RapGuard: Safeguarding Multimodal Large Language Models via Rationale-aware Defensive Promptingcited by 19
- 2024PhishAgent: A Robust Multimodal Agent for Phishing Webpage Detectioncited by 16
- 2024MobA: Multifaceted Memory-Enhanced Adaptive Planning for Efficient Mobile Task Automationcited by 14
- 2023Towards Responsible Generative AI: A Reference Architecture for Designing Foundation Model based Agentscited by 13
- 2024Auto-Intent: Automated Intent Discovery and Self-Exploration for Large Language Model Web Agentscited by 13
- 2024MAG-V: A Multi-Agent Framework for Synthetic Data Generation and Verificationcited by 12
- 2025Enhancing Cognition and Explainability of Multimodal Foundation Models with Self-Synthesized Datacited by 12
- 2024Leveraging Large Vision Language Model For Better Automatic Web GUI Testingcited by 5
- 2024Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Modelscited by 4
- 2024Here's Charlie! Realising the Semantic Web vision of Agents in the age of LLMscited by 3
50 most cited of 52 All 52 (JSON)
Built on by
Citing papers per year: 2025: 15; 2026: 18.
33 papers.
Sort:
By area:
- 2025A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?cited by 23
- 2025MLA-Trust: Benchmarking Trustworthiness of Multimodal LLM Agents in GUI Environmentscited by 23
- 2025OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflowscited by 18
- 2026Uncertainty Quantification in LLM Agents: Foundations, Emerging Challenges, and Opportunitiescited by 15
- 2025Secure and Efficient Access Control for Computer-Use Agents via Context Spacecited by 10
- 2025SynWorld: Virtual Scenario Synthesis for Agentic Action Knowledge Refinementcited by 9
- 2025Agentic Knowledgeable Self-awarenesscited by 8
- 2025GEM: Gaussian Embedding Modeling for Out-of-Distribution Detection in GUI Agentscited by 8
- 2025Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directednesscited by 8
- 2025Characterizing Unintended Consequences in Human-GUI Agent Collaboration for Web Browsingcited by 7
- 2026PIRA-Bench: A Transition from Reactive GUI Agents to GUI-based Proactive Intent Recommendation Agentscited by 7
- 2025LaSM: Layer-wise Scaling Mechanism for Defending Pop-up Attack on GUI Agentscited by 6
21 more
- 2025Mobile GUI Agents under Real-world Threats: Are We There Yet?cited by 5
- 2026MirrorGuard: Toward Secure Computer-Use Agents via Simulation-to-Real Reasoning Correctioncited by 5
- 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
- 2025SWIRL: A Staged Workflow for Interleaved Reinforcement Learning in Mobile GUI Controlcited by 4
- 2025Say One Thing, Do Another? Diagnosing Reasoning-Execution Gaps in VLM-Powered Mobile-Use Agentscited by 4
- 2025A Survey on AgentOps: Categorization, Challenges, and Future Directionscited by 3
- 2026CUADebug: Diagnosing and Repairing Computer-Use Agent Failurescited by 3
- 2026AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operationscited by 2
- 2026Mobile GUI Agent Privacy Personalization with Trajectory Induced Preference Optimizationcited by 2
- 2026Trust the Right Teacher: Quality-Aware Self-Distillation for GUI Groundingcited by 2
- 2026Safe, or Simply Incapable? Rethinking Safety Evaluation for Phone-Use Agentscited by 1
- 2026Governance by Construction for Generalist Agentscited by 1
- 2026Software Engineering for and with GUI Agentcited by 1
- 2026Automated Trajectory Evaluation for Mobile Agents via Step-Level Consequence Reasoning and Aggregationcited by 1
- 2025From Craft to Constitution: A Governance-First Paradigm for Principled Agent Engineeringcited by 0
- 2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliabilitycited by 0
- 2026Mobile-Aptus: Confidence-Driven Proactive and Robust Interaction in MLLM-based Mobile-Using Agentscited by 0
- 2026Agent System Operations: Categorization, Challenges, and Future Directionscited by 0
- 2026Act2Intention: A Benchmark For Developing Active Mobile Agents Through Inferring User Intention from GUI Actionscited by 0
- 2026Terminal Agents: A Survey of AI Agents in Command-Line Environmentscited by 0
- 2026How Many Pixels Is a Digit Worth? Place-Aware Coordinate Entropy for GUI Agent Confidence Estimationcited by 0
- 2026How Many Pixels Is a Digit Worth? Place-Aware Coordinate Entropy for GUI Agent Confidence Estimation21 Sep 2026
- 2026Automated Trajectory Evaluation for Mobile Agents via Step-Level Consequence Reasoning and Aggregation21 Aug 2026
- 2026Terminal Agents: A Survey of AI Agents in Command-Line Environments20 Aug 2026
- 2026Act2Intention: A Benchmark For Developing Active Mobile Agents Through Inferring User Intention from GUI Actions14 Aug 2026
- 2026Software Engineering for and with GUI Agent10 Aug 2026
- 2026CUADebug: Diagnosing and Repairing Computer-Use Agent Failures31 Jul 2026
- 2026Trust the Right Teacher: Quality-Aware Self-Distillation for GUI Grounding16 Jun 2026
- 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation9 Jun 2026
- 2026Agent System Operations: Categorization, Challenges, and Future Directions1 Jun 2026
- 2026Mobile-Aptus: Confidence-Driven Proactive and Robust Interaction in MLLM-based Mobile-Using Agents27 May 2026
- 2026Governance by Construction for Generalist Agents20 May 2026
- 2026Safe, or Simply Incapable? Rethinking Safety Evaluation for Phone-Use Agents8 May 2026
21 more
- 2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability8 May 2026
- 2026Mobile GUI Agent Privacy Personalization with Trajectory Induced Preference Optimization13 Apr 2026
- 2026AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations10 Mar 2026
- 2026PIRA-Bench: A Transition from Reactive GUI Agents to GUI-based Proactive Intent Recommendation Agents9 Mar 2026
- 2026Uncertainty Quantification in LLM Agents: Foundations, Emerging Challenges, and Opportunities4 Feb 2026
- 2026MirrorGuard: Toward Secure Computer-Use Agents via Simulation-to-Real Reasoning Correction19 Jan 2026
- 2025OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflows28 Oct 2025
- 2025From Craft to Constitution: A Governance-First Paradigm for Principled Agent Engineering12 Oct 2025
- 2025Say One Thing, Do Another? Diagnosing Reasoning-Execution Gaps in VLM-Powered Mobile-Use Agents2 Oct 2025
- 2025Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directedness2 Oct 2025
- 2025Secure and Efficient Access Control for Computer-Use Agents via Context Space26 Sep 2025
- 2025SWIRL: A Staged Workflow for Interleaved Reinforcement Learning in Mobile GUI Control27 Aug 2025
- 2025A Survey on AgentOps: Categorization, Challenges, and Future Directions4 Aug 2025
- 2025LaSM: Layer-wise Scaling Mechanism for Defending Pop-up Attack on GUI Agents13 Jul 2025
- 2025Mobile GUI Agents under Real-world Threats: Are We There Yet?6 Jul 2025
- 2025MLA-Trust: Benchmarking Trustworthiness of Multimodal LLM Agents in GUI Environments2 Jun 2025
- 2025GEM: Gaussian Embedding Modeling for Out-of-Distribution Detection in GUI Agents19 May 2025
- 2025A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?16 May 2025
- 2025Characterizing Unintended Consequences in Human-GUI Agent Collaboration for Web Browsing15 May 2025
- 2025SynWorld: Virtual Scenario Synthesis for Agentic Action Knowledge Refinement4 Apr 2025
- 2025Agentic Knowledgeable Self-awareness4 Apr 2025
- 2025A Survey on the Safety and Security Threats of Computer-Using Agents: JARVIS or Ultron?cited by 23
- 2025MLA-Trust: Benchmarking Trustworthiness of Multimodal LLM Agents in GUI Environmentscited by 23
- 2025OS-Sentinel: Towards Safety-Enhanced Mobile GUI Agents via Hybrid Validation in Realistic Workflowscited by 18
- 2026Uncertainty Quantification in LLM Agents: Foundations, Emerging Challenges, and Opportunitiescited by 15
- 2025Secure and Efficient Access Control for Computer-Use Agents via Context Spacecited by 10
- 2025SynWorld: Virtual Scenario Synthesis for Agentic Action Knowledge Refinementcited by 9
- 2025Agentic Knowledgeable Self-awarenesscited by 8
- 2025GEM: Gaussian Embedding Modeling for Out-of-Distribution Detection in GUI Agentscited by 8
- 2025Just Do It!? Computer-Use Agents Exhibit Blind Goal-Directednesscited by 8
- 2025Characterizing Unintended Consequences in Human-GUI Agent Collaboration for Web Browsingcited by 7
- 2026PIRA-Bench: A Transition from Reactive GUI Agents to GUI-based Proactive Intent Recommendation Agentscited by 7
- 2025Mobile GUI Agents under Real-world Threats: Are We There Yet?cited by 5
12 most cited of 26 All 26 (JSON)
- 2026How Many Pixels Is a Digit Worth? Place-Aware Coordinate Entropy for GUI Agent Confidence Estimation21 Sep 2026
- 2026Automated Trajectory Evaluation for Mobile Agents via Step-Level Consequence Reasoning and Aggregation21 Aug 2026
- 2026Terminal Agents: A Survey of AI Agents in Command-Line Environments20 Aug 2026
- 2026Act2Intention: A Benchmark For Developing Active Mobile Agents Through Inferring User Intention from GUI Actions14 Aug 2026
- 2026Software Engineering for and with GUI Agent10 Aug 2026
- 2026CUADebug: Diagnosing and Repairing Computer-Use Agent Failures31 Jul 2026
- 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation9 Jun 2026
- 2026Mobile-Aptus: Confidence-Driven Proactive and Robust Interaction in MLLM-based Mobile-Using Agents27 May 2026
- 2026Governance by Construction for Generalist Agents20 May 2026
- 2026Securing Computer-Use Agents: A Unified Architecture-Lifecycle Framework for Deployment-Grounded Reliability8 May 2026
- 2026Mobile GUI Agent Privacy Personalization with Trajectory Induced Preference Optimization13 Apr 2026
- 2026AgenticCyOps: Securing Multi-Agentic AI Integration in Enterprise Cyber Operations10 Mar 2026
12 newest of 26 All 26 (JSON)
Similar, not cited
Close in wording, no citation either way
- 2025Toward a Human-Centered Evaluation Framework for Trustworthy LLM-Powered GUI Agents
- 2026ADeptS-Bench: Measuring the Trustworthiness of Computer Use Agents Across Devices
- 2026Faithful Mobile GUI Agents with Guided Advantage Estimator
- 2026Do GUI Agents Know When Not to Act? Enabling Conflict-Aware Termination for Multimodal GUI Agents
- 2025GUI-Robust: A Comprehensive Dataset for Testing GUI Agent Robustness in Real-World Anomalies
- 2025VeriOS: Query-Driven Proactive Human-Agent-GUI Interaction for Trustworthy OS Agents
- 2025OS-Kairos: Adaptive Interaction for MLLM-Powered GUI Agents
- 2026Alignment Is Local: A Paired Diagnostic for GUI Agents under User-Side Persuasion