Can Android GUI Agents Handle Runtime Anomalies Without Breaking?

What AnTrap Measures

An Android GUI agent controls a phone the way a person would. It taps buttons, reads screens, and decides what to do next. Researchers from eight institutions built AnTrap to see what happens when the environment fights back.

The benchmark injects perturbations into live execution trajectories. A perturbation might be a sudden pop-up, a misread screen, or an action that does not do what the agent expected. The pipeline keeps the original task solvable. That matters. If the task becomes impossible, the agent cannot be blamed for failing.

Sixteen leading models went through the gauntlet. Every single one lost ground. The strongest models suffered significant performance degradation. The paper does not name the models. It does not say how much each one dropped.

The Four Layers of Failure

The taxonomy sorts anomalies into four layers. State anomalies corrupt what the agent sees. Thinking anomalies corrupt how the agent reasons. Action anomalies corrupt what the agent does. Round anomalies corrupt the flow across multiple steps.

Ten fine-grained subcategories sit inside those layers. The paper lists them. It does not define each one in the abstract. State deadlock appears as a deep contextual trap. It emerges across rounds. The agent reaches a condition where no valid action exists, yet the task remains incomplete.

Single-step traps live at the state and action layers. They look like a wrong button label or a popup that steals focus. The agent can learn to dodge them. Deep contextual traps do not work that way. They require memory and planning across many steps.

Training Fixes Some Traps But Not Others

The team ran GRPO training in two settings. One used the original environment. The other used the adversarial environment with traps injected. The comparison separates environment-learnable anomalies from reasoning-bottlenecked ones.

Adversarial reinforcement learning handles single-step traps. The agent sees the popup enough times to learn a workaround. State deadlock resists this approach. Training in environments with traps alone does not resolve the intrinsic limitation. The agent needs something beyond exposure. The paper does not specify what that something is.

Where the Benchmark Stops

AnTrap proves that current agents are universally vulnerable. It gives a taxonomy and a pipeline. It shows which failures yield to training and which do not. It does not offer a new architecture. It does not measure how often these anomalies happen in real user sessions. It does not say whether a user would notice the difference between a trained agent and an untrained one.

The submission date is 25 Aug 2026. The version is v1. The file size is 4,271 KB. The DOI is 10.48550/arXiv.2608.24099.