Google creates empty security permission for AI agents on Android
Google has added a new system permission called EXECUTEAPPFUNCTIONS to Android, designed to let autonomous AI agents invoke specific app functions without manual tapping. The permission lives inside the AppFunctionsManager framework and is currently reserved for first‑party Google software such as the Gemini assistant. While the cage is fully built and locked down, no third‑party agents have…
Key points
- Google added a new Android permission (EXECUTEAPPFUNCTIONS) for AI agents to run app functions directly
- The permission is currently limited to internal Gemini testers and contains no third‑party agents yet
- Google’s early security cage aims to prevent unsafe, unrestricted AI actions on users’ phones
The approach aims to replace fragile screen‑tap automation with a hyperlink‑like shortcut that triggers a task directly, reducing breakage when apps change UI layouts. Google limits the permission to a small, in‑house tester group and has not announced a public rollout timeline. By establishing the security model early, Google hopes to avoid the risks of unrestricted agents that could read messages or move money without user awareness.
If developers eventually publish shortcuts and obtain the permission, Android could support more reliable, privacy‑preserving AI‑driven interactions across apps, extending the same capabilities already used by Gemini in Google’s own services.
Google built a security cage for AI agents on Android, but it's still empty
androidpolice.com · 12 September 2026
Loading the full article…
This text was published by androidpolice.com and written by Ali Salman Zia. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
2sources- Google Built a Secure Cage for AI Agents on AndroidPress · propakistani.pk ·
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- Meta launches Muse personal AI agent in Singapore · 2 src
- Claude Code burns about 15–20% of tokens on 3‑word status line · 1 src
- Google plans consumer agentic AI in Gemini app by year-end · 1 src
- Sierra adds compliance tools to Horizon Agent Platform · 1 src
- OpenAI launches Decisions API for fast, structured AI judgments · 1 src
Comments
via GitHub Discussions