The Trust Boundary Moved to Your Pocket: On-Device Android Agents and the Controller Duty
Last month a phone started tapping through apps it had never been given an API for, with no SDK, no per-app integration and no vendor server in the path. In the Philippines that handset is almost certainly Android, at 86.28% of mobile OS share against 13.71% for iOS in October 2026 (Source: StatCounter, 2026). The National Privacy Commission enforces RA 10173, and the duties in that law attach to whoever decides how personal information is processed, not to whoever owns the server it would have run on (Source: Republic Act 10173, 2012).
!Infographic
The integration layer is now hardware people already own
Enterprise mobile automation used to be a procurement exercise: device management, a per-app SDK, a middleware tier between phone and system of record. NIST SP 800-124 Rev. 2, published in May 2023, treats the problem as managing mobile device security across a fleet, which presumes an owner with a fleet (Source: NIST SP 800-124 Rev. 2, 2023).
The current generation of Android agents inverts that shape. One Apache-2.0 application, no vendor server, no per-app integration, no SDK negotiated with each app's publisher. The integration surface is the screen the user is already looking at.
What the agent actually does
Mika, an open-source Android agent, operates apps and the web on a separate invisible background display. It opens apps, taps, types and scrolls there while the owner keeps the main screen, and it finds buttons the way a person does, by looking at them, with no app APIs or per-app integration (Source: Mika project documentation, 2026).
Each conversation gets a Linux sandbox that runs Python, Node and shell. Keys and memory are stored encrypted on the device, and no vendor server sits in the path (Source: Mika project documentation, 2026).
Mobile-Agent, in arXiv 2401.16158, documents the same architecture class: multimodal models that use visual perception to locate on-screen elements, then plan and operate (Source: Wang et al., arXiv, 2024). What moved is packaging and price.
The platform floor is a maintenance bill, not a purchase order
The stated requirements are narrow. Android 11 and up for chat, web and files; Android 12 and up to operate apps, with Android 14 or newer recommended; arm64 for the sandbox (Source: Mika project documentation, 2026). Android held 86.28% of Philippine mobile share in October 2026, down from 91.96% in January, still an enormous installed base above that floor (Source: StatCounter, 2026).
The catch is the control channel. App operation needs a one-time wireless debugging pairing, and Android disables wireless debugging after a Wi-Fi change or reboot (Source: Mika project documentation, 2026). A phone that reboots stops being an agent until somebody pairs it again.
Accessibility was a disability channel and is now a control channel
Google Play restricts the Accessibility API and the isAccessibilityTool flag to services designed to help people with disabilities access their device (Source: Google Play Console Help, 2026). Read that precisely: it is a distribution policy aimed at a capability class, enforced at the store.
Sideloaded APKs do not pass through that review, which is not the same as going unscanned. The gate that constrains accessibility-based automation is a store gate, so the constraint exists on one distribution path and not the other.
The control channel was built for assistive input, and it is now the cheapest route into software that never exposed an interface.
When the untrusted input is the screen
OWASP's LLM01:2025 entry on prompt injection notes that such inputs can affect the model even if they are imperceptible to humans, and do not need to be human-visible as long as the model parses them (Source: OWASP Gen AI Security Project, 2025).
For a screen-reading agent, the screen is that input: a rendered label, a notification banner, a block of text inside a page the agent opened. The person watching the main screen sees an app behaving like an app; the model sees tokens.
The prompt boundary and the display boundary are two different surfaces, and only one of them has a human on it. Any review that treats "the user can see what is happening" as a control is securing the wrong surface.
Who is the controller when the phone does the intake
RA 10173 Section 12 permits processing only when a condition exists, including the data subject's consent, or where processing is necessary and related to the fulfillment of a contract with that subject (Source: Republic Act 10173, 2012). Section 20(a) puts the duty on the personal information controller to implement reasonable and appropriate organizational, physical and technical measures against accidental or unlawful destruction, alteration and disclosure, and against any other unlawful processing (Source: Republic Act 10173, 2012).
Encrypting keys and memory on the device is a technical measure, and a real one. It is also only one of the three categories that clause names. Organizational and physical measures do not disappear because no vendor server exists, and "the data never left the phone" is not an answer when the phone decides what to read.
A team that ships an agent for its own operations is the controller for what it reads on a staff handset, agreement or not. Yano.AI building that for field staff would inherit the duty, and so would any agency issuing the handsets.
What the architecture review should ask
- Where does screen content go, and is it described in the privacy notice the user sees?
- What does the agent read while no human is watching the main display?
- Which measure satisfies Section 20(a) on the organizational side, and who audits it?
- What happens to the pairing, the memory and the run logs when the handset is returned, lost or resold?
FAQ
Q: Does an Android agent need an app API to drive another app?
A: No. It identifies controls from the rendered screen, the approach documented for multimodal mobile agents, then taps or types at those elements (Source: Wang et al., arXiv, 2024).
Q: Which Android version does app operation require?
A: Android 12 and up operates apps, Android 14 or newer is recommended, and chat, web and files work from Android 11 (Source: Mika project documentation, 2026).
Q: If the agent runs entirely on the phone, does RA 10173 still apply?
A: Yes. Section 20(a) binds the personal information controller to safeguards regardless of where the processing runs (Source: Republic Act 10173, 2012).
Q: Does sideloading avoid the Google Play accessibility restriction?
A: Sideloaded builds skip Play's review of accessibility services, but the restriction is a distribution policy on one channel, and privacy duties attach to the deployment rather than the channel (Source: Google Play Console Help, 2026).
Key Takeaway
The capability stopped being an enterprise integration and became a configuration on a handset, so the review has to move with it. Name the controller, the technical measure and the organizational one, and write down what happens when the phone is rebooted, resold or lost. Which of those can you answer today without opening a vendor contract?
Sources
- StatCounter, Mobile OS Market Share, Philippines
- Mika, on-device AI agent for Android
- Google Play Console Help, AccessibilityService policy
- OWASP Gen AI Security Project, LLM01:2025 Prompt Injection
- Republic Act No. 10173, Data Privacy Act of 2012
- NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise
- Wang et al., Mobile-Agent, arXiv 2401.16158
Mentions
本来用 mika 来做安卓控制的，现在又得换回 ADB 直接控制。 是好项目 wangzan101/mika
Mika (4.6k stars) is an Apache-2.0 Android agent that runs your apps and the web on a hidden background screen — no Mika server, data stays on the phone. #Android #AIAgents wangzan101/Mika
Mika 的玩法越来越丰富了： 1、Mika 干不了的活，直接安排其他 AI 干，多个 AI 一起干，比强更强 2、找到免费的 API key，注册白嫖一波 期待大家挖掘 Mika 更多的使用场景。 Mika：wangzan101/mika t.co
Phone Agent 看来最近很火，现在有不少开源项目了👍 这个兄弟的开源项目在wangzan101/mika 听说dsh go做的Phone Agent完成度更高，但是我觉得控制移动端常见的玩法也就是干爬虫的活了😂 比如可以不用抓包逆向爬想了解的数据，不用写繁琐需要更新的appium uiautomater这类自动化脚本 能落地的商业玩法能想到的也就是做自动化测试/ugc平台截流，但是不知道效率如何？ 没玩，感觉对我来说能省的最多的事就是外卖优惠券比价了🥲
Mika 群的的老哥太强了，基于 Mika 二开，现在我已经看不懂他这个是用来干啥的了，有谁能看明白吗？🤣🤣🤣 Mika：wangzan101/mika t.co
Mika 现在已经支持语音功能，随时随地，想到，就能做到，欢迎下载使用体验。 Mika：wangzan101/mika
The Trust Boundary Moved to Your Pocket: On-Device Android Agents and the Controller Duty Last month a phone started tapping through apps it had never been given an API for, with no SDK, no per-app integration and no vendor server in the path. In the Philippines that handset is almost certainly Android, at 86.28% of mobile OS share against 13.71% for iOS in October 2026 (Source: StatCounter, 2026). The National Privacy Commission enforces RA 10173, and the duties in that law attach to whoever decides how personal information is processed, not to whoever owns the server it would have run on (Source: Republic Act 10173, 2012). !Infographic The integration layer is now hardware people already own Enterprise mobile automation used to be a procurement exercise: device management, a per-app SDK, a middleware tier between phone and system of record. NIST SP 800-124 Rev. 2, published in May 2023, treats the problem as managing mobile device security across a fleet, which presumes an owner with a fleet (Source: NIST SP 800-124 Rev. 2, 2023). The current generation of Android agents inverts that shape. One Apache-2.0 application, no vendor server, no per-app integration, no SDK negotiated with each app's publisher. The integration surface is the screen the user is already looking at. What the agent actually does Mika, an open-source Android agent, operates apps and the web on a separate invisible background display. It opens apps, taps, types and scrolls there while the owner keeps the main screen, and it finds buttons the way a person does, by looking at them, with no app APIs or per-app integration (Source: Mika project documentation, 2026). Each conversation gets a Linux sandbox that runs Python, Node and shell. Keys and memory are stored encrypted on the device, and no vendor server sits in the path (Source: Mika project documentation, 2026). Mobile-Agent, in arXiv 2401.16158, documents the same architecture class: multimodal models that use visual perception to locate on-screen elements, then plan and operate (Source: Wang et al., arXiv, 2024). What moved is packaging and price. The platform floor is a maintenance bill, not a purchase order The stated requirements are narrow. Android 11 and up for chat, web and files; Android 12 and up to operate apps, with Android 14 or newer recommended; arm64 for the sandbox (Source: Mika project documentation, 2026). Android held 86.28% of Philippine mobile share in October 2026, down from 91.96% in January, still an enormous installed base above that floor (Source: StatCounter, 2026). The catch is the control channel. App operation needs a one-time wireless debugging pairing, and Android disables wireless debugging after a Wi-Fi change or reboot (Source: Mika project documentation, 2026). A phone that reboots stops being an agent until somebody pairs it again. Accessibility was a disability channel and is now a control channel Google Play restricts the Accessibility API and the isAccessibilityTool flag to services designed to help people with disabilities access their device (Source: Google Play Console Help, 2026). Read that precisely: it is a distribution policy aimed at a capability class, enforced at the store. Sideloaded APKs do not pass through that review, which is not the same as going unscanned. The gate that constrains accessibility-based automation is a store gate, so the constraint exists on one distribution path and not the other. The control channel was built for assistive input, and it is now the cheapest route into software that never exposed an interface. When the untrusted input is the screen OWASP's LLM01:2025 entry on prompt injection notes that such inputs can affect the model even if they are imperceptible to humans, and do not need to be human-visible as long as the model parses them (Source: OWASP Gen AI Security Project, 2025). For a screen-reading agent, the screen is that input: a rendered label, a notification banner, a block of text inside a page the agent opened. The person watching the main screen sees an app behaving like an app; the model sees tokens. The prompt boundary and the display boundary are two different surfaces, and only one of them has a human on it. Any review that treats "the user can see what is happening" as a control is securing the wrong surface. Who is the controller when the phone does the intake RA 10173 Section 12 permits processing only when a condition exists, including the data subject's consent, or where processing is necessary and related to the fulfillment of a contract with that subject (Source: Republic Act 10173, 2012). Section 20(a) puts the duty on the personal information controller to implement reasonable and appropriate organizational, physical and technical measures against accidental or unlawful destruction, alteration and disclosure, and against any other unlawful processing (Source: Republic Act 10173, 2012). Encrypting keys and memory on the device is a technical measure, and a real one. It is also only one of the three categories that clause names. Organizational and physical measures do not disappear because no vendor server exists, and "the data never left the phone" is not an answer when the phone decides what to read. A team that ships an agent for its own operations is the controller for what it reads on a staff handset, agreement or not. Yano.AI building that for field staff would inherit the duty, and so would any agency issuing the handsets. What the architecture review should ask - Where does screen content go, and is it described in the privacy notice the user sees? - What does the agent read while no human is watching the main display? - Which measure satisfies Section 20(a) on the organizational side, and who audits it? - What happens to the pairing, the memory and the run logs when the handset is returned, lost or resold? FAQ Q: Does an Android agent need an app API to drive another app? A: No. It identifies controls from the rendered screen, the approach documented for multimodal mobile agents, then taps or types at those elements (Source: Wang et al., arXiv, 2024). Q: Which Android version does app operation require? A: Android 12 and up operates apps, Android 14 or newer is recommended, and chat, web and files work from Android 11 (Source: Mika project documentation, 2026). Q: If the agent runs entirely on the phone, does RA 10173 still apply? A: Yes. Section 20(a) binds the personal information controller to safeguards regardless of where the processing runs (Source: Republic Act 10173, 2012). Q: Does sideloading avoid the Google Play accessibility restriction? A: Sideloaded builds skip Play's review of accessibility services, but the restriction is a distribution policy on one channel, and privacy duties attach to the deployment rather than the channel (Source: Google Play Console Help, 2026). Key Takeaway The capability stopped being an enterprise integration and became a configuration on a handset, so the review has to move with it. Name the controller, the technical measure and the organizational one, and write down what happens when the phone is rebooted, resold or lost. Which of those can you answer today without opening a vendor contract? Sources - StatCounter, Mobile OS Market Share, Philippines - Mika, on-device AI agent for Android - Google Play Console Help, AccessibilityService policy - OWASP Gen AI Security Project, LLM01:2025 Prompt Injection - Republic Act No. 10173, Data Privacy Act of 2012 - NIST SP 800-124 Rev. 2, Guidelines for Managing the Security of Mobile Devices in the Enterprise - Wang et al., Mobile-Agent, arXiv 2401.16158