Balancing Interoperability and Security in the Age of AI

Over the last six months, we have been engaging closely with the European Commission (EC) after they opened specification proceedings related to Android interoperability for AI services, pursuant to the EU Digital Markets Act (DMA). At the center of this engagement is the EC’s desire to mandate that Android provides user-downloaded artificial intelligence (AI) agents with deep system-level access to powerful device capabilities. While the EC’s interoperability objectives align with Android's history and mission as an open ecosystem, the final measures undermine Android’s foundational security model, placing European consumers’ privacy, security, and safety at risk.

As the specification proceedings enter the implementation phase, we urge the EC to properly account for these risks through consultations with cybersecurity experts (many of whom have co-signed this blogpost) and ensure that necessary safeguards remain in place to protect Android users in Europe.

Where we started

The Android ecosystem already fosters a vibrant, competitive AI market. Today, prominent user-downloadable AI services like ChatGPT, Claude, and Perplexity are used by tens of millions of consumers daily on Android, operating securely within their app sandboxes and supported by Android’s robust developer tools. Meanwhile, Android device manufacturers bring even more deeply integrated experiences to their devices, both through their own innovative features and by partnering with third-party AI developers that they have vetted [1, 2].

Consumers expect Google and Android device manufacturers, as the stewards of the Android ecosystem, to ensure the security and privacy of their devices, especially for apps that are deeply embedded and granted access to highly sensitive capabilities, such as those at issue in these EC proceedings. Third parties simply do not have the same incentives to protect the safety of consumers’ devices. Android, through its open-source architecture and this model of vetted partnerships between device manufacturers and app developers, has already struck a balance between innovation and competition, on the one hand, and the safety and security of the ecosystem, on the other.

Where we are heading

Throughout the proceedings our senior engineers and security experts spent significant time with the EC in technical meetings, exploring how we could potentially open up Android even further while ensuring it remains a secure ecosystem.

Despite these efforts, the EC’s specifications mandate a fundamental overhaul of Android's security architecture, overlooking that this proven security model has already created the world's most open and interoperable mobile operating system for AI innovation. It is not surprising that when the EC published its draft measures in April, independent security experts sounded the alarm:

• "I can state with both knowledge and certainty that the European Commission’s technical proposals (or draft measures) are dangerous for the security of every citizen of this world, and they represent gross overreach." David Rogers MBE, CEO at Copper Horse and Former GSMA Fraud & Security Group Chair (link)
• "Opening capabilities first and adding protection later is how this risk becomes incidents; establishing the limits in advance is how interoperability and security come to reinforce one another rather than work against each other." Rubén Lirio, Global Cybersecurity Director at DEKRA, a EU Cybersecurity Lab and Notified Body (link)

While we are encouraged by positive progress since the Preliminary Findings, we continue to have very significant concerns that the final measures introduce several security loopholes, leaving European users vulnerable to mobile threats in the age of AI.

The table at the bottom of this post outlines just some of the risks the proposed measures would introduce, as well as potential conflicts with existing EU cybersecurity regulations and standards ¹ . As we move forward with the EC on implementation, it is crucial that these issues receive full consideration through direct consultation with cybersecurity experts and ecosystem stakeholders.

Modern fraud capitalizes on AI

The EC’s final measures underestimate the grim reality of modern fraud. As consumers increasingly rely on mobile devices for banking, private communications, and managing their digital identities, phones have become the primary target for malicious actors. Scammers are increasingly leveraging generative AI to deploy highly sophisticated social engineering scripts, hyper-realistic deepfakes, and polymorphic malware:

• Annual global scam losses have climbed to roughly 1% of global GDP. According to the Global Anti-Scam Alliance, $442 billion was lost to scams in one year and over 73% of the respondents experienced an online scam or attack in the last year. ²
• The vast majority of scams now begin on mobile devices. According to Pew Research Center, 68% receive a scam call weekly and 61% receive a scam text weekly. ³
• Users are facing daily threats of mobile scams. A 2025 report by Malwarebytes found that 44% of surveyed global users encounter a mobile scam every single day. This report also found that of the 36% of users who have fallen victim to a mobile scam, 52% suffered direct financial loss or fraud, and 27% lost access to critical digital assets or accounts. ⁴
• Scammers are weaponizing generative AI. Over 80% of phishing emails are AI generated, deepfake fraud attempts have risen by 2,000% since 2022, and around 3 in 4 AI voice scam victims have lost money as a result. ⁵
• AI-powered fraud has surged to an industrial scale. AI scams growing by over 1,210%. The FBI recorded over 22,000 AI-related complaints in a single year, costing people nearly $893 million. Experts project that U.S. losses alone from generative AI fraud will hit $40 billion by 2027. ⁶

We appreciate that the EC’s final measures allow a qualification process for a subset of the features at issue. However, this safeguard is only effective if we are allowed to implement it robustly. A qualification process without strong platform enforcement is mere security theater. Furthermore, it is alarming that a number of other sensitive features – including access to ambient data such as always-on microphone, camera, and on-screen content – are denied this protection and must be made available to any app. This significant exception ignores a dangerous reality: giving any unvetted app continuous, hidden background access to microphones and screens is precisely the capability that malware authors covet and exploit.

In addition, even where the final measures allow for a qualification process, the EC mandates that users be given a mechanism to bypass these protections entirely, granting high-risk capabilities like screen automation to any app. As we emphasized to the EC throughout the proceedings, these kinds of loopholes are a gift to scammers who regularly use social engineering to trick vulnerable users into handing over access to their most sensitive data.

Experts agree on the dangers of creating such loopholes in the name of interoperability. As Ashwini Rao, Co-Founder and CEO of Eydle, points out: "To balance innovation with user safety, mandates must incorporate a risk-based approach to interoperability. We must consider the risk from distinct vectors (Access Level, Data Scope, Action Type) and Consent Fatigue, which is exponentially worse due to continuous multi-step tasks. Otherwise, we are pushing the security and approval burden onto the users and leaving them vulnerable."

The EC’s final measures risk dismantling the multi-layered defense-in-depth strategy Android employs to keep users safe. As Forrester, a major business and technology research company, noted in their recent blog post: “the EU Commissioners are playing with fire.” Mitigating this risk needs to be a top priority for all stakeholders in the implementation phase.

Nascent technologies introduce novel risks and threats

AI agents are a rapidly developing and highly dynamic technology, which significantly heightens risks to users. Without sufficient safeguards, an insecure agent can become the primary attack vector through exploits like indirect prompt injection, where hidden instructions in external data hijack the agent’s behavior. When an autonomous agent is granted deep, low-level system access without vetting by the operating system or device manufacturer, the real world consequences are severe. This is not a hypothetical threat; it has been widely documented by security researchers, reported in the media, and echoed across the industry:

• Apple: “Security researchers have already shown that AI systems can be hijacked to steal personal data — like passwords and photos — and to permanently alter files and account settings without a user’s consent. As AI systems gain more capabilities, these risks are quickly increasing in frequency and scope.”
• Eydle: "Granting deep system access to third-party AI-related services introduces a paradigm shift in threat modeling. Traditional applications are deterministic, but AI agents are not. Ensuring integrity requires new frameworks to measure and verify the safety of non-deterministic AI systems, and these frameworks are still evolving. Mandates must consider this to ensure that we balance pace of innovation with user safety.”

Even other branches of the European Commission recognize these evolving threats. Just this week, as the EC began enforcing the EU AI Act, its own AI Office highlighted the need to evaluate the unique safety and security risks of agentic use, acknowledging that regulatory strategies for AI agents are still in preliminary stages.

Given these novel risks, standards development organizations and industry associations are still in the early stages of defining appropriate security and privacy guardrails. The European Telecommunications Standards Institute (ETSI) only released their standard for Securing Artificial Intelligence (SAI); Baseline Cyber Security Requirements for AI Models and Systems in December 2025, a high level standard that does not yet address the nuances of agentic threats. In similar regulatory contexts, it has been important to ensure that cybersecurity experts have sufficient time to map risks to technical standards, compliance tools, and platform controls. For example, in a blog post, Sergio Casanova, CTO at Brightsight noted that “recent changes to the EU AI Act timeline have underscored the value of preparation. The additional time before full implementation gives organizations an opportunity to understand the requirements more clearly, improve internal processes, and strengthen their approach to risk and assurance."

While the EC’s final measures allow for a qualification process, they also mandate the creation of a Trusted Certification Authorities (TCAs) program that would allow apps to complete the process and gain access to restricted features through a third-party, without any oversight by Google or device manufacturers. We welcome the potential to leverage independent third-party expertise to inform our evaluations. However, given the novel risks and early stages in developing an effective security model, Google and device manufacturers—the entities with the comprehensive threat intelligence, system-level telemetry, and direct accountability to protect users—must retain the authority for maintaining the certification lifecycle for agents, including approval, suspension, and revocation, to ensure these measures do not compromise ecosystem safety. By integrating third-party assessments into a process where Google maintains final review and enforcement, we can strike the right balance, keeping European consumers safe while supporting an interoperable ecosystem.

The importance of security by design: EU cybersecurity regulation

It is striking that these final measures come at a time when the EU is reinforcing the foundational principles of "security-by-design" and "security-by-default" across its broader cybersecurity regulations. Enforcing competition rules in isolation creates a direct tension with cybersecurity policy, one that must be carefully managed to avoid putting users at risk.

Testing and certification lab DEKRA highlighted this exact friction in their June blog post: “This is where the two regulations come into direct conflict in the context of AI agents for security. The DMA seeks to open these powerful capabilities to third-party agents, whereas the CRA seeks to keep the device's exposure to a minimum."

Industry experts emphasize that these two priorities must work in tandem. As Jose Ruiz, Cybersecurity BU Director at Applus+ Laboratories, noted: “Applus+ Laboratories welcomes initiatives that promote innovation, interoperability, and consumer choice across the digital ecosystem. At the same time, any evolution of platform access models should be carefully assessed to ensure continued compliance with security-by-design principles and the objectives of the Cyber Resilience Act. Achieving both competition and cybersecurity is not only possible, but essential for maintaining user trust and the long-term resilience of digital services.”

Looking forward

As we enter the implementation phase, we want to be clear: implementing these measures without rigorous security safeguards risks irreparable harm to device manufacturers, app developers, and most importantly, consumers.

As an open platform that has long championed interoperability, Android has consistently demonstrated that interoperability and security can coexist. To maintain this balance, platforms must retain the authority to enforce rigorous guardrails while working alongside cybersecurity experts to define baseline criteria. This collaborative approach ensures AI agents can innovate safely without opening backdoors for malicious actors to exploit.

It is critically important that the application of the final measures during the implementation phase reflects a shared commitment to balancing interoperability and security in the age of AI.

Below are some of the independent experts who support our call to deeply consult cybersecurity professionals, ensuring European consumers are not left with weaker protections than the rest of the world.

Signed by:

1. Rubén Lirio, Global Cybersecurity Director at DEKRA
2. Jose Ruiz, Cybersecurity BU Director at Applus+ Laboratories
3. Sergio Casanova, Chief Technology Officer at SGS
4. Thai Duong, Chief at Calif
5. David Rogers MBE, CEO at Copper Horse
6. Amit Elazari, CEO and Co-Founder of OpenPolicy
7. Tatyana Bolton, Head of Cyber Practice at Monument Advocacy
8. Alan Snyder, CEO at NowSecure
9. Frank Heidt, Managing Director at Leviathan Security Group
10. Ashwini Rao, Co-Founder and CEO at Eydle
11. Joel Scambray, Senior Vice President of Technical Assurance Services at NCC Group
12. Wouter Slegers, CEO at TrustCB (EUCC & SESIP Certification Body and Notified Body for eIDAS and CRA)