Phones and Tablets with AI Agents

Assistants that read the screen and act inside other apps.

ByteDance's Doubao phone agent used a system-level permission to read the screen and tap through other apps, and WeChat, Alipay and two state banks pushed back within weeks. ByteDance cut off WeChat control and limited the agent on finance and gaming apps; no regulator acted.

AI assistant reach on phones: Gemini app, monthly users 1,000 · Aug 2026; Apple Intelligence iPhones 450 · Q1 2026; HarmonyOS 5 and 6 devices 32 · Dec 2025. Users and devices are different measures AI ASSISTANT REACH ON PHONES Gemini app, monthly users 1,000 · Aug 2026 Apple Intelligence iPhones 450 · Q1 2026 HarmonyOS 5 and 6 devices 32 · Dec 2025 MILLIONS; UNITS DIFFER BY ROW USERS AND DEVICES ARE DIFFERENT MEASURES
Gemini monthly users
1B+
Apple Intelligence iPhones
450M+
Nubia M153 price
CNY 3,499
Registry incidents
0

Deployments

Phone agents now act across apps; platforms, not regulators, set the first limits

The Doubao assistant on ZTE's Nubia M153 could book, order and reply by tapping through third-party apps. Apple's app-acting Siri, now built on Gemini-based models, had not shipped as of March 2026. Microsoft Recall snapshots a PC screen every few seconds and was relaunched as opt-in after a 2024 pause.

Flagship phones and tablets deployments
DeploymentDeveloper / operatorWhereScaleAutonomyStatusControls declared
Doubao Phone AssistantByteDance / ZTE (Nubia M153)ChinaLimited release, sold out (Dec 2025)Acts across apps by voiceRestricted after platform pushbackExplicit consent; no payments or identity checks
Apple Intelligence and SiriApple, with Google Gemini models / AppleGlobal450 million+ capable iPhones (Q1 2026)Assistant; app actions delayedPartly shippedOn-device and Private Cloud Compute
Microsoft RecallMicrosoft / PC makers (Copilot+ PCs)GlobalInstall count not disclosed (Apr 2025)Continuous captureShipping, opt-inOpt-in; Windows Hello; local encryption

Recent events

  • WeChat users on the Nubia M153 were force-logged-out in December 2025.
  • Agricultural Bank of China and China Construction Bank apps told users to disable the Doubao agent.
  • Apple said on January 12, 2026 that Gemini would be the base of future Apple Foundation Models.
  • Microsoft paused Recall in June 2024 after a proof of concept pulled data from its database.

Attack surface

Five of ten attack-surface dimensions rate very significant or critical

No dimension rates critical. Ratings use five levels, from limited to critical, and cover the paths an attacker or a failure can take into the agent.

Attack surface by dimension: Physical access significant; Identity and authentication very significant; Command and control channels significant; Perception and sensors very significant; Connectivity surface significant; OTA and update pipeline very significant; Data capture and retention very significant; Integrations and permissions very significant; Behavioral and policy boundary significant; Multi-agent coordination limited but growing Physical access SIGNIFICANT Identity VERY SIGNIFICANT Command and control SIGNIFICANT Perception VERY SIGNIFICANT Connectivity SIGNIFICANT OTA updates VERY SIGNIFICANT Data capture VERY SIGNIFICANT Integrations VERY SIGNIFICANT Behavior boundary SIGNIFICANT Multi-agent LIMITED BUT GROWING
Attack surface rating by dimension. Longer, darker bars are rated higher.
Phones and tablets attack surface by dimension
DimensionRatingWhy
Physical accessSignificantDevice theft, lost devices, and shared device contexts present access to AI-accumulated context
Identity and authenticationVery significantPlatform accounts (Apple ID, Google account, Microsoft account) tie identity to all device AI features
Command and control channelsSignificantVoice assistant access, share-sheet integration, system-level shortcuts, third-party AI app interfaces all present command paths
Perception and sensorsVery significantCameras, microphones, location, biometric sensors, motion sensors
Connectivity surfaceSignificantCellular, WiFi, Bluetooth, NFC, ultra-wideband
OTA and update pipelineVery significantOS updates from Apple, Google, Microsoft are the primary AI capability delivery mechanism
Data capture and retentionVery significantThe most distinctive dimension
Integrations and permissionsVery significantApp integration, third-party AI routing (such as Apple Intelligence to ChatGPT), enterprise integrations, cloud sync
Behavioral and policy boundarySignificantAI assistant policies, generative content guardrails, prompt injection through ingested content
Multi-agent coordinationLimited but growingCross-device AI synchronization, AI agents that coordinate across apps, emerging agentic capabilities

Incidents

No registry incident involves phones and tablets yet

The 137AI Incident Registry logs an incident when an agent's failure or misuse caused harm or a regulator acted, and public sources name the developer, the failed control and how it was found. No phones and tablets case meets that bar yet. Candidates go on the review list in the registry methodology.

Rules

No rule addresses agents acting inside other apps

Rules that apply to phones and tablets
RuleJurisdictionWhat it requiresStatus
EU AI Act Article 5 prohibitionsEUBans manipulative AI, untargeted face scraping and workplace emotion recognitionIn force Feb 2, 2025
CAC and MPS face recognition measuresChinaAlternatives to face ID; registration above 100,000 peopleEffective Jun 1, 2025
Platform controls at WeChat, Alipay and banksChinaPrivate blocking of agent-driven sessionsDec 2025

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Agent class
Personal and ambient
Datasets
ai_deployments.csv (3 rows for this page); ai_attack_surface.csv (10 rows); ai_incidents.csv (0 linked)
Key sources
Doubao restrictions (Yicai)
ByteDance phone agent (Caixin)
Counterpoint
Last verified
October 2026