NEW YORK — What happened
During its late September developer platform briefing, Google unveiled technical specifications for the Isolated Agent Runtime (IAR), a core architecture change slated for the upcoming Android 17 platform. The feature creates a strictly sandboxed intermediary layer between background autonomous AI helpers and installed application databases, requiring explicit permission tokens before an automated assistant can trigger actions across third-party applications.
Why it matters
As smartphones transition from passive notification centers into proactive agents that schedule flights, pay bills, and draft messages, the traditional mobile security model breaks down. Mobile operating systems originally relied on application-level permissions: an app either had access to your photos or it did not. Autonomous agents, however, need to bridge multiple apps simultaneously. Without strict hardware-backed sandboxing, a compromised or prompt-injected agent could easily exfiltrate private messages under the guise of organizing a calendar invite.
Deep dive
The IAR framework operates by treating AI agent execution threads similarly to Android's existing Virtualization Framework (AVF). Instead of permitting an agent to navigate an application's user interface via accessibility APIs—a common workaround that security researchers have criticized for years—IAR requires apps to publish declarative "Action Contracts." When an agent wants to perform a task, such as ordering groceries, it sends a structured schema request to the Android system. The operating system prompts the user with a cryptographic preview card showing the exact fields the agent wants to execute. The agent itself never sees the underlying app's memory space, personal authentication cookies, or full screen contents.
Report check
Claims: Google claims IAR prevents 99% of indirect prompt injection vectors targeting app data. Verified: Engineering documentation confirms that apps opting into Action Contracts block memory reads from accessibility tooling, closing widespread injection vectors demonstrated in 2024 and 2025. Rumor/Unverified: Reports suggest Google will make IAR mandatory for all Google Play Store apps by late 2027, but the company has not confirmed this enforcement timeline publicly.
Open questions
Will smaller independent app developers invest the time to build bespoke Action Contracts, or will ecosystem fragmentation leave users relying on legacy accessibility screen-scraping for lesser-known apps?