AnTrap is a benchmark that injects realistic dynamic anomalies — such as unexpected pop-ups and action misuse — into Android GUI agent trajectories, organized into a four-layer taxonomy of ten anomaly subcategories. Evaluating 16 leading GUI models reveals universal vulnerability to these runtime anomalies, with even the strongest models suffering significant performance drops. Reinforcement learning training in adversarial environments fixes single-step traps but cannot resolve deeper contextual failures like state deadlocks, exposing limits that training alone cannot address.
