Buddy: an open source app that lets AI agents (Claude Code, Codex, OpenCode) use your Android phone

I've been building Buddy, a free, open source (Apache 2.0) Android app. You type or say what you want in a floating bubble, and an AI agent reads the screen, taps and types through your apps to do it.

  • Your choice of agent: Claude Code, Codex, OpenCode, Antigravity or Grok, running inside the app (Alpine Linux via proot) on your own plan. OpenCode's free models need no account.
  • No root, adb or PC: it reads the screen and taps through the accessibility service.
  • Asks first: before anything is sent, posted, bought or deleted. It pauses when you touch the screen and never types passwords or payment details.
  • Builds apps: with Linux tools on, it builds real APKs on the phone. This week I drew a maze on a paper towel, took a photo, and it made it a tilt game. The first build crashed on launch; it found the bug and fixed it.

To be upfront:

  • What the agent reads on your screen goes to the AI service you pick.
  • It's early (2.2), tested most on a OnePlus 12 with Android 16.
  • It's not on Play (Google rejected the accessibility use), so it's an APK from GitHub releases, built by GitHub Actions from the source.

Source and releases: github.com/ghorbelhamdi/buddy-android

Happy to answer questions here.

you are viewing a single comment's thread
view the rest of the comments
[–] 4 points 2 days ago* (last edited 2 days ago) (2 children)

I think the news reporting of the last year or so paints a very different picture. We had OpenAI have their hacking agents escape their confines, it happened to their competitors, we have lots of ludicrous things going on since OpenClaw was invented... I think this is more of a theoretical/hypothetical argument... If you had deterministic and watertight gates, if they were configured in a very annoying way and if there weren't any bugs in any part of the harness and the setup. Nor any bugs or unforseen design choices in Android, the reachable apps and websites. Then you'd be safe. But such a thing doesn't exist in the real world. And you kind of don't want to babysit and micromanage your agents anyway, so the user isn't even motivated to set it up anywhere close to this.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 2 points 2 days ago* (1 child)

    I get your point, and well taken. Sure bugs, missed edge cases, zero days, regressions, incomplete test suites, etc continue to exist. But just like with anything, if you reduce your attack surface or other precautionary measures you can reduce your risk to near zero or at least acceptable enough to decide when and where it is appropriate to use various models, go to market, or what have you

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 days ago* (last edited 2 days ago)

    Well hypothetically you could make an effort. And you should. That was my point. "Be careful." In practice I'd invite people to follow up on that. I mean I'm currently looking at an app with a fairly simplistic heuristic to decide what's okay and what's not okay to do. It checks the labels of buttons to determine if the agent is publishing information to the internet... But simultaneously I'm also looking at the button below the comment box I'm currently typing in... And I can't help but notice it's labeled "Kommentar" and that word is not in the regex. So the actually existing "safety measure"(?) already fails here on the first opportunity presented and doesn't provide any security...

  • source
  • parent