Buddy: an open source app that lets AI agents (Claude Code, Codex, OpenCode) use your Android phone

I've been building Buddy, a free, open source (Apache 2.0) Android app. You type or say what you want in a floating bubble, and an AI agent reads the screen, taps and types through your apps to do it.

  • Your choice of agent: Claude Code, Codex, OpenCode, Antigravity or Grok, running inside the app (Alpine Linux via proot) on your own plan. OpenCode's free models need no account.
  • No root, adb or PC: it reads the screen and taps through the accessibility service.
  • Asks first: before anything is sent, posted, bought or deleted. It pauses when you touch the screen and never types passwords or payment details.
  • Builds apps: with Linux tools on, it builds real APKs on the phone. This week I drew a maze on a paper towel, took a photo, and it made it a tilt game. The first build crashed on launch; it found the bug and fixed it.

To be upfront:

  • What the agent reads on your screen goes to the AI service you pick.
  • It's early (2.2), tested most on a OnePlus 12 with Android 16.
  • It's not on Play (Google rejected the accessibility use), so it's an APK from GitHub releases, built by GitHub Actions from the source.

Source and releases: github.com/ghorbelhamdi/buddy-android

Happy to answer questions here.

all 20 comments

sorted by: hot top controversial new old
[–] 18 points 3 days ago (15 children)

Yeah, I'd recommend to be careful with apps like this. There's a lot of sensitive information on smartphones, including all your life of the past years, personal information of your friends, maybe nudes, passwords to everything...

  • source
  • hideshow 15 child comments
  • [+] -6 points 3 days ago (14 children)

    If the model is local and since the APP is FOSS, it's probably fine.

  • source
  • parent
  • hideshow 14 child comments
  • [–] 10 points 3 days ago (9 children)

    A bad command can mess up a lot of things. See people deleting their prod database because they gave the agent access. Local models are also more likely to make such mistakes usually

  • source
  • parent
  • hideshow 9 child comments
  • [–] [S] 2 points 2 days ago (5 children)

    If you have the right deterministic gates and checkpoints this becomes impossible. Only really an issue if you use the model raw.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 4 points 2 days ago* (last edited 2 days ago) (2 children)

    I think the news reporting of the last year or so paints a very different picture. We had OpenAI have their hacking agents escape their confines, it happened to their competitors, we have lots of ludicrous things going on since OpenClaw was invented... I think this is more of a theoretical/hypothetical argument... If you had deterministic and watertight gates, if they were configured in a very annoying way and if there weren't any bugs in any part of the harness and the setup. Nor any bugs or unforseen design choices in Android, the reachable apps and websites. Then you'd be safe. But such a thing doesn't exist in the real world. And you kind of don't want to babysit and micromanage your agents anyway, so the user isn't even motivated to set it up anywhere close to this.

  • source
  • parent
  • hideshow 2 child comments
  • [–] [S] 2 points 2 days ago* (1 child)

    I get your point, and well taken. Sure bugs, missed edge cases, zero days, regressions, incomplete test suites, etc continue to exist. But just like with anything, if you reduce your attack surface or other precautionary measures you can reduce your risk to near zero or at least acceptable enough to decide when and where it is appropriate to use various models, go to market, or what have you

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 days ago* (last edited 2 days ago)

    Well hypothetically you could make an effort. And you should. That was my point. "Be careful." In practice I'd invite people to follow up on that. I mean I'm currently looking at an app with a fairly simplistic heuristic to decide what's okay and what's not okay to do. It checks the labels of buttons to determine if the agent is publishing information to the internet... But simultaneously I'm also looking at the button below the comment box I'm currently typing in... And I can't help but notice it's labeled "Kommentar" and that word is not in the regex. So the actually existing "safety measure"(?) already fails here on the first opportunity presented and doesn't provide any security...

  • source
  • parent
  • [–] 2 points 2 days ago (1 child)

    Which software has deterministic trustworthy gates?

    I've tried looking into that and was disappointed.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 2 days ago*

    Yes. They delete prod databases, write blogs and penny dreadful and doxx their owners on Moltbook. Chat in underground message boards. Circumvent safety measures because that's a good way to fulfill a goal. I had my coding agent delete the test suite because it kept failing and it needed "to focus"... The internet is filled with funny anecdotes like that. And local models can do all of that. They're pretty "clever" these days.

  • source
  • parent
  • [–] 2 points 2 days ago (1 child)

    Oh yeah! But I think something like Qwen 3.8 27B should be able to handle it 🤔

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 2 days ago

    Curious too. In my tests Qwen3 4B and 8B handled one-step requests but fumbled multi-step ones (tapped the wrong buttons, then said it worked). gpt-oss 20B did better but was inconsistent: one run got a 2-step task right, the next claimed a tool didn't exist. I haven't tried a 27B yet, and I don't know if it'll even run usably on my RTX 2060 Super (8 GB). If anyone runs one through Ollama or llama.cpp, I'd love to hear how it does.

  • source
  • parent
  • [–] 5 points 3 days ago (2 children)
    • What the agent reads on your screen goes to the AI service you pick.

    Not especially fine.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 2 days ago* (last edited 2 days ago) (1 child)

    We're in !ocalllama@sh.itjust.works. So if this goes to the service you own (runs on your PC, for example) - I think it's fine. The author confirmed the local models are supported.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 3 days ago (3 children)
    • Asks first: before anything is sent, posted, bought or deleted. It pauses when you touch the screen and never types passwords or payment details.

    Lol, sure it does. How many times have wee seen this claim, now?

  • source
  • hideshow 3 child comments
  • [–] 3 points 2 days ago (2 children)

    Fair to be skeptical, but it isn't the model being asked nicely. Buddy checks every tap itself: when the button is Send, Post, Buy, Pay, Delete and similar (by its label or id, in several languages), Buddy stops and shows an approval card, whatever the model wants. It's a word list, so an oddly named button can slip through; it's all in Guard.java if you want to look: https://github.com/ghorbelhamdi/buddy-android/blob/main/app/src/main/java/app/buddy/assistant/Guard.java

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 days ago (1 child)

    When I see word matching like this, in the context of AI, I still fear it's embedded in text prompt interfaces, meaning it can be evaded. (D E L E T E instead of delete etc)

    It also doesn't tell me much about the wider risks and gaps of the connected system architecture - which, to be fair, I haven't inspected or analyzed, so I don't know one way or the other. One guard may be better than none, but doesn't define or fully describe overall/system risk.

    Naturally, I'm more risk-averse and skeptical than many other people. I guess the original commenter is, too. :)

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 2 days ago

    It doesn't match the model's text. The check runs in the accessibility service on the actual button the tap would land on: its label, icon description and view id, as the app reports them. The model can write D E L E T E all it wants, the button still says Delete. It also can't tap Buddy's own approval card to approve itself.

    Where it can miss: a button with an odd or blank label, and apps you mark as trusted, where asking is left to the agent. And agreed, it's one guard, not the whole risk picture. Prompt injection from what's on screen is the bigger open problem, and the approval card is the backstop there.

  • source
  • parent
  • 41 comments in c/android@lemdro.id view that post
    [–] 15 points 3 days ago (2 children)
  • [–] 11 points 3 days ago (1 child)

    It's not on Play (Google rejected the accessibility use)

    And rightly so. Stop making me side with Google.

    Maybe if it were designed to run completely locally I could respect it.

  • source
  • hideshow 1 child comment
  • [–] [S] 2 points 2 days ago

    It can now: since 2.2.25 it works with your own model server (Ollama, LM Studio or llama.cpp) on your network or over Tailscale, with no key, and nothing goes to an AI company. Honest caveat: small models (4–8B) handle simple requests but fumble multi-step tasks on the screen, so you'd want a bigger model for real use.

  • source
  • parent
  • [–] 19 points 3 days ago (3 children)

    Why would anyone in the right state of mind allow that shit to control your phone??

  • source
  • hideshow 3 child comments
  • [–] [S] 0 points 3 days ago (2 children)

    Fair question, so here are real ones:

    • Accessibility: with live voice (real-time, through your ChatGPT plan) you just talk to it. It does the tapping and reads things back, which helps people who can't easily see or use a touchscreen.
    • Testing apps: it exposes the phone as an MCP server, so Claude Code or Codex can drive your app on a real device for UI testing.
    • Building apps on the phone itself: Buddy was mostly developed that way, with Claude Code running on the phone and using Buddy's own phone tools to install and test each build.

    It asks before anything is sent or bought and stops when you touch the screen. Not for everyone, and that's fine.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 2 days ago

    Jesus Christ

  • source
  • [–] 20 points 3 days ago (1 child)

    Not a privacy invasion, at all. And you are abusing the accessibility features too? I'm proud of you.

  • source
  • hideshow 1 child comment
  • [–] [S] 0 points 3 days ago

    Fair concern, and it's not for everyone. The agent only sees the screen while it's doing a task you gave it, it asks before anything is sent, and it's open source, so you can check exactly what it does. If you'd rather not hand that to an AI, that's a completely reasonable choice.

  • source
  • parent
  • [–] 13 points 3 days ago
    [–] 16 points 3 days ago

    Oh hell no, never in my life will I let an agent control my phone. Fff— that.

  • source
  • [–] 9 points 3 days ago* (last edited 3 days ago) (2 children)

    Token work offloading.
    Unethical bingo sentences -- center square.

  • source
  • hideshow 2 child comments
  • [–] [S] -3 points 3 days ago (1 child)

    It's just an MCP server for the phone with an app to control it, basically computer use, but for Android. Agents using computers are already normal, so I'm not sure why phones would be different. And it runs on your own plan, or on local models if you'd rather keep it off the cloud entirely.

  • source
  • parent
  • hideshow 1 child comment
  • A much safer accessibility method would be a flutter webview. Local user will be confined to the webview instance and will still need to resolve ai agent challenges themselves.

    Accessibility-from-scratch utilizing a server\client with a linux shell is what something like Shizuku was made for. Elevated privileged activities like listing installed apps, running apps, running a url (elevated) are not normal in ai agent workflows. MCP server resources can be "patched" this way from a very specific call... hence offloading somebody else's token work.

  • source
  • parent
  • [–] 11 points 3 days ago

    Let Al have full access to your contacts and the first most likely device to have pictures of your genitals.

  • source
  • [–] 3 points 3 days ago (1 child)

    It's not on Play (Google rejected the accessibility use), so it's an APK from GitHub releases, built by GitHub Actions from the source.

    Did you explain its use as an accessibility aid being its core feature for differently abled people? If you have explained that as a core feature google could've budged. You would've needed to limit the API to select few like OpenAI, Gemini, Claude with additional guardrails and use reporting. But, it could've been accepted by google.

  • source
  • hideshow 1 child comment
  • [–] [S] 2 points 2 days ago

    I did appeal. Google's answer, word for word: "the app utilizes the accessibility API for performing autonomous actions... The accessibility API is not designed and cannot be requested for performing autonomous tasks." So the problem was the agent acting on its own, not which AI services it uses.

    The accessibility-tool exception is only for apps built mainly for people with disabilities. Buddy can help there, but it does a lot more, so claiming that wouldn't be honest. If anyone has gotten an agent app like this through review, I'm open to trying again.

  • source
  • parent
  • [–] 3 points 2 days ago

    Aw sweet, man made horrors entirely within my comprehension.

  • source
  • [–] 0 points 3 days ago* (last edited 3 days ago) (9 children)

    Excellent for local models running via OpenCode and helping with UAT on Android. Well done. What else is on your roadmap for this? Will you support Watch/TV/XR? F-Droid might take this.

  • source
  • hideshow 9 child comments
  • [–] [S] 1 point 3 days ago (8 children)

    Thanks, and thanks for the crosspost! Local models already work: in Settings you can add a custom OpenAI-compatible address (llama.cpp, Ollama or LM Studio on your network) and use it with OpenCode. It works best with models that are good at tool calling, since everything goes through phone tools.

    Other devices: it's built for phones, but someone already forked it to run on a Nintendo Switch with Android, with Joy-Con navigation: https://github.com/Lendss/buddy-switch. So other Android devices are clearly possible, I just haven't tested watches, TVs or XR myself.

    F-Droid: good timing. Buddy now builds all its native parts (proot, talloc and friends) from source in CI, with no prebuilt binaries in the repo, which was the main thing in the way. So an F-Droid build should be doable now. Until then, releases are on GitHub and the app updates itself.

  • source
  • parent
  • hideshow 8 child comments
  • [–] [S] 3 points 3 days ago (1 child)

    Update: it's now submitted to F-Droid, with reproducible builds, so the F-Droid and GitHub versions will be the same app signed with the same key, and you can switch between them: https://gitlab.com/fdroid/fdroiddata/-/merge_requests/56198

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 3 days ago (5 children)

    Local models already work: in Settings you can add a custom OpenAI-compatible address (llama.cpp, Ollama or LM Studio on your network)

    You should've mentioned this in the readme 🙂 I'll check it out!

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] 2 points 3 days ago* (last edited 3 days ago) (4 children)

    Done: 2.2.25 makes this easy. Ollama, LM Studio and llama.cpp are in the service list, plain http works on your own network and over Tailscale, and no key is needed. README has a section now: https://github.com/ghorbelhamdi/buddy-android#local-models

    Honest results so far, on a PC with an RTX 2060 Super: Qwen3 8B and 4B handle simple one-step requests (battery, phone status), but multi-step tasks on the screen failed. The 4B tapped the wrong buttons in the calculator and then claimed it worked. So for real tasks you'll want a bigger model; I'm trying gpt-oss 20B next.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 2 days ago* (3 children)

    It's is expected, they're small models. But something like Qwen 3.8 27B or Qwen 3.8 Flash Next should handle it.

    How much VRAM do you have? If it's a 12GB card and you also happens to have 64 GB of RAM, you should be able to run Qwen 3.8 Flash Next with Q3. It's one of the most "hyped" local models right now (because it's quite capable and has somewhat realistic HW requirements).

  • source
  • parent
  • hideshow 3 child comments
  • [–] [S] 2 points 2 days ago* (last edited 2 days ago) (2 children)

    Update: you were right. Qwen3.8 27B (unsloth UD-IQ3_XXS) did the calculator task correctly (1234×5678 = 7,006,652), but took 18 minutes on my 8 GB card, almost all of it reading the prompt and screen on the CPU.

    Qwen3.5 9B is the interesting one: one run typed the wrong numbers and claimed success, the next did it right in about 2 minutes. So small models can do it, just not reliably yet.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 2 days ago* (last edited 1 day ago) (1 child)

    Yeah, 27B only usable if you can fit it entirely in VRAM. Only MoE models are fine to split, like the mentioned Qwen 3.8 Flash Next. Even though it's large, only the active 6B parameters needs to be located in VRAM, the rest can be in RAM and SSD.

  • source
  • parent
  • hideshow 1 child comment
  • [–] [S] 2 points 1 day ago

    Good call. Qwen3.6 35B-A3B runs fine split between my 8 GB card and RAM, and gets the task right. Flash Next is too big for 32 GB. The latest Buddy (2.2.27) also fixes local models with Codex, which your suggestion helped me find.

  • source
  • parent
  • [+] -17 points 3 days ago (8 children)

    People are so mean these days, show some support

  • source
  • hideshow 8 child comments
  • [–] 20 points 3 days ago (4 children)

    Name a single good reason that I should support this

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 2 points 3 days ago (2 children)

    One: someone who can't see the screen can just talk to it, with live voice, and it does the tapping and reads things back. For a lot of people, that's the difference between using a phone app themselves and needing someone to do it for them.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 3 days ago (1 child)

    Something wrong with the old voice access?

    I'd be worried something as unpredictable as an LLM would put more disabled users in danger that it would help.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 3 days ago (2 children)

    Everything related to AI gets down voted. Controversial at best.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 3 days ago*

    Curious why. Seems people vote against datacenters in their vicinity, against the flood of self-promote by AI agents in the remaining somewhat human corners of the internet, against the flood of dubious vibe-coded projects which for some reason all have the same description that starts with "I built ..."

  • source
  • parent