Divergent authorization boundaries and institutional guardrails bring AI smartphones to a crossroads.

The mobile phone industry in 2026 is experiencing a seemingly contradictory narrative.

IDC data shows that for the first time, AI-enabled phones accounted for more than half of China's mobile phone shipments, reaching 53%, and AI models made up about 68% of new phones launched in the first quarter. Meanwhile, Huawei, Xiaomi and Honor simultaneously raised the prices of their available phone models on September 1, with a maximum price increase of 1000 yuan per unit. The direct driver is that the spot price of memory chips has risen by more than 300% in three months, and DRAM has surpassed SoC to become the most expensive single component in mobile phones.

AI has made mobile phones more expensive, but the awkward fact is that the actual user utilization rate of AI functions is not high.

This gap is not a technical issue, but an ecosystem issue.

When AI is limited to single-point functions such as photo editing and translation, it cannot enter the actual task flow of users. A truly AI-powered mobile phone must allow agents to step out of the small circle of the system's built-in tools to call third-party applications — and it is at this critical point that a profound divergence has emerged in the industry.

01. From Unregulated Development to Standardization

The earliest way for agents to call third-party applications took a "shortcut" — taking manufacturers such as Honor as an example, their AI assistants simulate human clicks on the GUI interface through the "Accessibility Service" permission. This approach has low thresholds and wide coverage, but it inherently has the attribute of "impersonating the user subject", and risks will be exposed immediately once it involves financial transactions.

In December 2025, within 2 to 3 days after the release of the Doubao mobile phone preview version (Nubia M153), China Construction Bank, Agricultural Bank of China, WeChat, Alipay, Meituan and other platforms successively launched risk control measures, and the financial app operation function of this assistant was taken offline on December 6. This event became a turning point, proving that pure GUI simulation operations are unsustainable in high-risk fields, forcing the industry to shift from "technology first" to "rule first".

After that, rule construction accelerated. In December 2025, the "Dual Authorization Security Guidelines for End-Cloud Collaborative Agent Interaction" first established the "dual authorization" principle — obtaining authorization from both the user and the application party, and agents must declare their identity in an identifiable manner and collaborate through standardized interfaces.

In May 2026, three government departments jointly issued the "Implementation Opinions on the Standardized Application and Innovative Development of Agents"; in August, the Payment and Clearing Association launched the KYA Self-Discipline Convention, the first group safety standard for agents in the financial field was implemented, and the mandatory national standard was simultaneously approved for project establishment. From industry guidelines to mandatory national standards, the institutional level has achieved three leaps in less than a year.

It is worth noting that institutional construction is not only on paper.

On April 30, 2026, the Guangzhou Internet Court publicly heard the first unfair competition case involving AI agents and issued a behavior preservation ruling in court, and the "dual authorization" principle was recognized at the judicial level. This means that unauthorized cross-application operations by agents may not only violate industry standards, but also constitute unfair competition and face judicial injunctions.

While the system is taking shape, mass production and implementation are also accelerating. On September 14, the consumer version of the Doubao mobile assistant was released, with the mobile phone operation function opened in Beta, and the Screen Automated Operation Declaration Protocol (SAEP) launched simultaneously; on September 16, the Nubia NaviX Ultra was officially released. AI mobile phones are moving from proof of concept to large-scale delivery, on the premise that they must operate within the rules.

02. Divergence of Authorization Modes: The Essential Dispute Between Opt-in and Opt-out

After "dual authorization" became a consensus, a more subtle problem emerged: how is authorization initiated? At present, there are two types of practices in the industry.

On the surface, this is only the difference between "enabled by default" and "disabled by default", but the essence is far more than that.

Under the opt-in mode, developers need to actively invest resources for adaptation, and long-tail applications may be absent due to cost reasons, so that only head applications can be called in the end. The opt-out mode has wider coverage, but who will bear the statement cost becomes the core contradiction. Requiring thousands of developers to actively opt out is an unequal power relationship in itself.

The more critical variable is who the opt-out applies to. The AI version of Alipay is limited to its own mini-program ecosystem and takes effect after users actively enter, which is essentially internal platform governance. The Doubao Phone 2.0 is at the system layer, facing cross-application third parties, which means that system-level agents can include third-party applications in the operation scope by default without the active consent of third parties — this is a redistribution of the ecosystem by the system.

Behind this divergence are different answers from various manufacturers to "ecosystem rules in the agent era". It is clear that the route dispute has become clearly visible.

Doubao Phone has chosen the system-level GUI screen automation path, matching the SAEP declaration protocol with a 30-day public notice period. After the public notice period, applications that do not reject will be open for operation by default, which essentially replaces the previous technical confrontation with "rule negotiation".

Xiaomi takes the path of prioritizing structured interfaces — opening SDKs, supporting the MCP protocol, realizing native collaboration through the AppTool SDK, and requiring developers to actively adapt. OPPO and vivo have more complex technical paths, with system service calls and simulated clicks coexisting, but they have not yet launched a comparable declaration protocol.

Apple's App Intents and Google's AppFunctions are typical opt-in modes, where developers actively declare the intents that can be called, while Google is tightening relevant rules in reverse. Since January 2026, the Google Play policy has listed "AI reads the screen and clicks buttons on behalf of users" as a violation, and the AAPM mode of Android 17 will automatically revoke the permissions of unofficial accessibility tools.

Sui Gang, director of the 404 Lab, a cybersecurity institution, has a sharp judgment on this. He believes that SAEP is more of a post-incident remedy for ecological crises, rather than a security design. After the Doubao mobile phone preview version was collectively blocked by WeChat, Alipay, banks and other platforms for risk control in December last year, ByteDance re-entered the market through a "rule negotiation" path.

He pointed out that the sentence "Whether the intent-level restriction has complete system enforcement capability depends on the target version" in the protocol means that the enforceability of the declaration is questionable. The screen automation operation means that the assistant has obtained the read and operation capability for the entire screen — it can see chat records, bank card numbers, verification codes, and can also simulate clicks and input, which is de facto system-level proxy permission, far more valuable than any single application permission.

The author believes that system-level opt-out will face strong institutional resistance in high-risk fields, and will eventually move towards "layered authorization": high-risk fields such as finance, payment, and medical care will enforce opt-in and establish whitelists, while low-risk fields will allow limited opt-out but must be supported by transparent declarations and convenient exit channels.

The value of SAEP is that it gives application parties a formal channel to say "no", which is a step forward from technical confrontation. But whether it can be accepted by the industry does not depend on the will of ByteDance, but on whether other manufacturers are willing to endorse it. In the short term, the second identical agreement will most likely not appear.

03. Institutional Fences Are Taking Shape: From Principles to Enforceable Rules

If we connect the institutional documents of the past year, we will find that they are not scattered emergency responses, but are building a three-layer governance framework.

The first layer is the identity layer. The dual authorization principle requires agents to "declare their identity in an identifiable and verifiable manner", and the KYA mechanism requires "know your agent", which means that agents will no longer be anonymous automated scripts, but need to have verifiable digital identities — who they are, who they represent, what permissions they have, and what they can do must be traceable and auditable. This layer solves the problem of "who you are".

The second layer is the behavior layer. The group standard in the financial field clearly stipulates that "no automated operation of the GUI interface of financial apps is allowed without the authorization of financial institutions". The Payment and Clearing Association requires hierarchical and categorized management according to high, medium and low risks, and the project approval of mandatory national standards raises permission management and behavior control to mandatory requirements.

This layer solves the problem of "what you can do", the core of which is risk classification — not all operations require the same intensity of authorization, and the risk level of checking the weather is vastly different from that of transferring funds.

The third layer is the responsibility layer. Lu Lei, Vice Governor of the People's Bank of China, clearly put forward that "payment requires predictable results, definable responsibilities, and traceable tracks". The behavior preservation ruling of Guangzhou Internet Court confirmed the unfair competition nature of unauthorized operations in judicial practice. This layer solves the problem of "who is responsible when something goes wrong".

When an agent performs operations on behalf of a user, once an error occurs, is the responsibility on the user, the agent provider, or the application party? The system is giving the answer: traceable track is the premise of responsibility definition, and dual authorization is the basis of responsibility division.

Discussions at the expert level also point to the core issue of "enforceability". Zhang Yunquan, a member of the National Committee of the Chinese People's Political Consultative Conference and a researcher at the Institute of Computing Technology of the Chinese Academy of Sciences, affirmed the demonstration significance of SAEP. He believes that applications can declare accessible and inaccessible areas according to pages and businesses, and will not be operated if they do not actively access within the 30-day public notice period, which reflects the attitude of treating the application ecosystem as a partner rather than a mere operated object.

But he also pointed out that the arrangement of "no response and no rejection is regarded as operable" after the public notice period is open to question: can the notification really reach the vast number of small and medium-sized applications? How to make up for the losses between the time when the application is called and the time when the problem is found and rejected? His suggestion is that the mechanism of "knock first, then visit" should be continued, instead of automatically turning to default opening after 30 days.

The superposition of the three-layer framework is pushing AI mobile phones from "technical products" to "regulated financial-grade infrastructure". This is not a bad thing — without institutional fences, agents can only hover in low-risk areas forever, and cannot enter high-value scenarios such as payment, wealth management, and government services. The system is not the enemy of innovation, but the premise of large-scale innovation.

04. Where Will AI Phones Go

In the short term, AI mobile phones will still be in a stage of mixed authorization and layered governance. System-level agents will generally adopt a mixed mode of "declaration + default coverage + high-risk whitelist". Declaration protocols such as SAEP will become the industry standard, and agents must explicitly declare their identity and intent when operating third-party applications. High-risk fields such as finance, payment, and medical care will establish a strict opt-in whitelist mechanism, and agents without cooperative authorization are not allowed to intervene.

Low-risk fields allow opt-out, but the exit channel must be convenient and transparent. The core feature of this stage is "controllable radicalness" — manufacturers want to expand the coverage of system-level agents, but they must act within the red line of the system.

In the medium term, standardized interfaces will become the mainstream, and GUI simulation will be a supplementary measure. With the maturity of standardized interface frameworks such as Apple's App Intents and Google's AppFunctions, more and more third-party applications will actively open structured capability interfaces, and agents no longer need to "read the screen and click", but directly call application capabilities through standardized APIs.

This is similar to the evolution from "web crawlers" to "open APIs" in the early days of the mobile Internet. By then, the adaptation cost of the opt-in mode will be greatly reduced, and the GUI operation under the opt-out mode will be reduced to a supplementary method for applications that have not been adapted. The KYA mechanism will be implemented as an executable agent identity authentication system, and each agent will have a verifiable digital identity and permission profile.

AI mobile phones will evolve from "assistants" to "task agents". When a user says "help me arrange the trip to Shanghai next week", the agent can independently complete a series of cross-application operations such as booking tickets, booking hotels, synchronizing calendars, and notifying relevant people.

In the long run, agent-native operating systems will emerge, and application forms will be migrated. When agents become the main entry for interaction, the form of applications will undergo fundamental changes: migrating from "independent apps that users actively open" to "capability components called by agents".

Developers no longer need to carefully design every interface, but need to encapsulate core capabilities into structured services that can be understood and called by agents. But this does not mean that system-level agents can override everything. The institutional framework will ensure user sovereignty and the rights of application parties: users have final control over the scope of authorization of agents, application parties have the right to decide the openness of their own capabilities, and system-level agents cannot use platform advantages to force third-party applications to be included.

The winner is not the one with the strongest calling capability, but the one with the strongest ecological governance capability, who can not only attract developers to actively access, but also protect the rights and interests of users and developers within the compliance framework.

The core logic of this path is that technology determines how fast AI mobile phones can go, and the system determines how far they can go. AI mobile phones have become more expensive but the utilization rate is not high. The answer is not to stack more functions, but to let AI truly enter the user's task flow. To enter the task flow, it is necessary to cross the application boundary. To cross the boundary, the authorization problem must be solved. To solve the authorization problem, a sustainable ecological cooperation model must be found within the institutional framework, and this is the real second half of the AI mobile phone industry.

This article is from the WeChat official account "DoNews" (ID: ilovedonews), written by Yang Zishan, and authorized for release by 36Kr.