Independent AI intelligence Two editions daily · ET
Fervor AI
Menu

Analysis · October 21, 2026 · repo

kuafuai/andeeagent-securitylocal-aiai-skills

Andee Turns Your Android Phone Into an AI Agent, and Its README Is the Safety Checklist

The permissions a phone agent needs are the same ones malware wants. One trending project says so out loud, and that honesty is the most useful thing in the repo.

Phone agents have a strange problem. To do anything useful (read a message, tap a button, fill a form) they need almost total control of the device. And the exact set of permissions that grants that control is the set security tools use to spot banking malware.

Most projects in this space bury that fact. One trending repo puts it in the README.

Andee, from KUAFUAI, sat at #16 on Trendshift's daily board when this was checked on the afternoon of October 21, two days after its v0.5.2 release. It is a single Android app that lets a language model of your choice see your screen and operate your phone. Its README says the permission set it asks for "is the same set Android banking trojans are detected by."

That sentence is the reason to read this project closely, even if you never install it. Andee writes down its own risks, specifically and in plain language. That list doubles as a checklist you can run against any phone agent, including the polished commercial ones that will tell you much less.

What Andee actually is

Strip away the personality in the README ("It is here to be the thing that lives in it") and the design is simple.

Andee has no normal app screen. Its interface is a floating ball that sits over whatever you are doing. Tap it, talk to it, and it acts.

Two Android features make that possible:

  • The accessibility service, a system feature built so screen readers and assistive tools can read and operate other apps. Andee uses it to see the screen, tap, type, swipe and take screenshots. Its config declares canPerformGestures, canRetrieveWindowContent and canTakeScreenshot.
  • An overlay window (SYSTEM_ALERT_WINDOW), the permission that lets an app draw on top of other apps. That is the floating ball and the subtitles.

The "brain" is a language model reached over the network. By default, the agent loop runs on the phone and calls "any OpenAI-compatible model you choose" (any provider or server that accepts the same request format as OpenAI's API), with https://api.openai.com/v1 as the default endpoint. (The README's Chinese-language card defaults to DeepSeek's API instead.) There is also a remote-brain mode where the loop runs on another machine and talks to the phone over a WebSocket hub (a relay server that keeps a live two-way connection open).

One thing to be clear about: "on-device brain" here means the loop runs on the phone. The model does not. The README does not describe running a model file on the device itself.

To read the screen, Andee sends the model a compact outline of the interface elements, and falls back to screenshots with a labeled grid when an app draws its own pixels. Voice goes through a speech provider, Volcengine by default with Google as an option.

There is even an optional robot dog, driven through a USB radio dongle, with a rule that it refuses to advance within 20 cm of an obstacle. It is a fun detail. It is also the clearest sign of how far this project wants an agent's reach to extend.

The threat model, in the project's own words

Here is what makes Andee unusual. Its README and security notes list the sharp edges directly. Each one is worth turning into a question.

1. It asks for the banking-trojan permission set

Beyond the accessibility service and the overlay, Andee can use SMS, call log, contacts, calendar, location, camera, the installed-app list and an exemption from battery optimization. The good news: the runtime permissions (SMS, contacts, calendar, location, camera and the like) are requested when a task needs them, and refusing one only disables that capability. The others go through different Android flows: overlay, accessibility and the battery exemption each have their own settings screen, and visibility into installed apps is declared in the app's manifest rather than asked for in a prompt.

There is also an optional grant you can only give over adb, Android's command-line debugging tool:

adb shell pm grant net.kuafuai.andee android.permission.WRITE_SECURE_SETTINGS

WRITE_SECURE_SETTINGS lets an app change protected system settings. The README says Andee uses it to re-enable a hidden accessibility helper in MIUI (Xiaomi's version of Android) so WeChat shows its real interface, and to switch to a fallback keyboard (ADBKeyboard) for typing, and that without it "nothing breaks." The code is less relaxed than the README: a comment in ImeSwitch.kt says that without the grant the app "cannot move the keyboard in either direction," which on MIUI "means it cannot type into another app at all." On Android 13 and newer, the README says typing goes through the accessibility service instead.

Question for any phone agent: which permissions does it need for the task you care about, and can you refuse the rest?

2. Everything it sees goes to your model provider

The disclaimer is blunt: "the conversation plus every tool result goes to whichever brain endpoint you configure." A screen read is a tool result. So the contents of whatever app is open, whether that is your inbox, your bank or a private chat, are sent to that endpoint. Speech goes to the voice provider.

The README also says: "No vendor backend, no account. The only thing it ever sends us is a version number and a phone model." The fuller DISCLAIMER is more precise, and more honest: that update check also sends the brand, Android release, UI language and a random install ID, the server sees your IP address and derives a rough location from it, and the check cannot be switched off without editing the source and rebuilding. It runs once on first launch and when you tap "Check again." None of that is screen content. But it is a good example of why you read the long document, not the tagline. And none of it changes the fact that your screen goes to someone's model.

Question for any phone agent: where does a screenshot of my banking app end up, and under whose data policy?

3. A debug server listens on your whole network, with no login

Andee runs its own WebSocket server on port 9008. Android's system log (Logcat) shows it starting on 0.0.0.0:9008, which means it accepts connections from any device on the same network, not only from the phone itself. The project's security notes say it does this "without authenticating clients," and call it a limitation that matters "on any network you do not control."

In plain terms: on café Wi-Fi, another device on that network may be able to talk to your phone agent's debug interface. The README also notes that the app's secrets vault is not yet tied to the phone's lock screen.

Question for any phone agent: what ports does it open, who can reach them, and do they require a login?

4. There is no guardrail on payments

On payments, the README says "this project has no guardrail on that path." The only block is Android's own FLAG_SECURE, a flag some apps set to stop screenshots, and it advises keeping a human present for anything financial. It also reminds you that messages and orders the agent sends under your name are yours.

Question for any phone agent: what stops it from paying, sending or deleting without me, and is that a rule in code or a hope in a prompt?

5. Any page you open can steer it

"Anyone who can get you to open a page can influence it." That is prompt injection, described in one sentence: text on a website or in a message that the model reads and treats as instructions. A phone agent that reads your screen reads whatever an attacker managed to put on it.

Question for any phone agent: what happens when the screen itself contains instructions?

The license has conditions, too

The repo is often summarized as Apache-2.0. The LICENSE file is titled "ANDEE OPEN SOURCE LICENSE (Apache License 2.0 with additional conditions)," and the conditions matter if you build on it:

  • You may not remove the product name, icon or copyright notices if you distribute it to end users.
  • Unless authorized in writing, you may not run it "as a service that drives, controls, or reads devices belonging to third parties."
  • Shipping it as a component of a product you offer to others "requires prior written authorisation from KUAFUAI."
  • Contributors grant KUAFUAI the right to relicense their contributions under other terms, and future versions may change license.

For personal use and tinkering, none of this gets in your way. For a startup thinking "we could wrap this into a phone-agent product," it is a stop sign until you talk to the authors.

Put this into practice

The safe way to try Andee is the same as the safe way to try any phone agent: assume the worst on the list above and arrange things so it cannot hurt much.

1. Use a spare phone. Android 11 or newer, a real device (the README requires one), signed into nothing that matters. No banking apps, no work email, no password manager. This step removes most of the risk by itself.

2. Get the bare APK, not a bundled one. The README offers three routes. A hosted service called CodeFlying, which the README describes as separate from the project, ships a build with keys preconfigured and gives you a finite free token allowance, after which "tokens are purchased." The bare debug APK from the releases page has no keys and CodeFlying switched off. Or build it yourself:

# Requires JDK 17 to 20 (the Gradle 8.4 wrapper cannot run on 21+),
# Android SDK platform 34 and build-tools 34.0.0
./gradlew clean :app:assembleDebug
# or, with the phone connected over USB:
./gradlew installDebug

3. Grant permissions in the README's order. Overlay first, then enable the accessibility service, then tap the ball to allow the microphone. Add your model and voice keys under the gear icon (⚙ → Backend → On-device). Without a model key, the brain does not run at all, and without a voice key, the app looks like it has a network problem.

4. Pick your model endpoint on purpose. It defaults to OpenAI's API. If you would rather your screen contents go elsewhere, point it at another OpenAI-compatible endpoint you trust, such as one you host. Use a key with a spend cap, created only for this.

5. Decide on the adb grant knowingly. On a recent Pixel-style phone running Android 13 or newer, you can likely skip it, since typing goes through the accessibility service. On Xiaomi phones running MIUI, the code says typing into other apps depends on it; on other older devices, the docs do not say. Either way, it is a powerful grant, so give it to a spare phone only.

6. Only run it on a network you control. Because of the unauthenticated debug socket, home Wi-Fi with no guests is fine for testing; a conference network is not.

7. Start with dull tasks. "Open the calculator and add these numbers." "Set a timer." Watch what it reads and what it taps before you hand it anything with a send button.

What to expect: the release APK is a debug build, and Andee labels itself experimental, with no warranty, and says it is "pre-1.0 on purpose." The README warns that some vendor Android builds switch the accessibility grant off after updates or force-stops, and that some apps (WeChat on certain MIUI devices) return empty screens. Plan for some fiddling.

Honest limitations

This article is a reading of the project's own documentation, plus the repo metadata checked on October 21. It is not a hands-on test, so nothing here claims Andee works well on any particular phone or task.

The risks listed above are design risks the authors disclose, not evidence of anything malicious. The authors deserve credit for writing them down.

Star counts on trending repos move fast; Andee had about 2.1k according to a shields.io read on October 21.

And the bigger limitation is not Andee's. Every phone agent built on the accessibility service inherits the same core problem: the permission that lets it help you is total. Better prompts do not change that. Only narrower permissions, real confirmation steps and endpoints you trust do.

The checklist to keep

The useful thing to take away is the list, not the app. Before you install any agent that can see and touch your phone, ask five questions: which permissions does it need and can I refuse the rest, where do my screen contents go, what does it open to the network, what stops it from paying or sending without me, and what happens when the screen contains instructions.

Andee answers all five in public, and some of the answers are uncomfortable. That puts it ahead of most products that will ask for the same access with a nicer onboarding screen.

Sources: kuafuai/andee README, LICENSE, DISCLAIMER, ImeSwitch.kt, releases (v0.5.2 reviewed, read October 21, 2026), Trendshift daily board (read about 15:15 ET, October 21, 2026), shields.io stars.