Google built a security cage for AI agents on Android, and it is still empty

Android Police's Ali Salman Zia set out to find a setting. After hearing that Google was bringing controls for AI agents to Android, he went looking through his own phone and found no toggle, no permission list, nothing he could actually tap. The answer, he writes in a September 13 report, was buried in developer documents, SDK release notes and a permission registry most Android users will never see.

What he found is that Google has built a real, functioning security cage for autonomous AI agents on Android, and that it is empty. Android contains a system permission called EXECUTE_APP_FUNCTIONS, reserved for approved agents; any app or assistant needs it before it can discover or run another app's functions. It is not on a menu and not in Developer options. It lives in Android's AppFunctionsManager framework and is gated almost entirely to first-party Google software such as Gemini.

The machinery behind it is AppFunctions. Instead of making an agent imitate finger taps around a screen, developers can expose a shortcut to a specific action inside their app, and Android keeps track of it. Ask Gemini to book a ride, and rather than opening the app and hunting for buttons, it triggers that action. Google compares this to letting outside tools connect to a service instead of using it like a person.

The appeal is tangible: no tapping, no breaking when an app moves a button in an update, and the agent records shortcuts rather than whole operation sequences, which is more robust. But it only works after a developer has built the shortcut, and right now almost nobody has.

That leaves an empty cage. Gemini's access to the system is limited to a small, handpicked in-house group of testers. The programme has no timeline for seeing daylight and could change without warning; getting real access today means applying to an early programme and waiting, with no guarantee of selection. For most developers, that is not yet worth the effort.

Building the cage before the tenant arrives is the right call, the report argues. Android has a habit of shipping features first and locking them down after something goes wrong, as location, background data and notifications all once did. Doing that with AI would be worse, because an unfettered agent could read messages or move money before anyone notices. Setting the rules before developers have ample reasons to push back matters most before real money and real users are involved. There is clearly appetite: third-party developers have already built Android agents the old way, tapping through screens via ADB, the fragile approach AppFunctions is meant to replace.

For now the permission set is carefully curated and controls almost nothing on a typical phone. The cage is built, tested and locked, and nobody has moved in. The moment to watch is not the permission's name in a registry but when Google opens the door to third-party developers; until then, agents on Android keep relying on the fragile old approach.