Phone use agents: seven open-source tools that operate a real phone

A phone use agent is software that lets a language model operate a real phone: it looks at the screen, decides what to tap, and taps it, in apps that were never built to be driven by anything but a thumb. In October 2026 the idea moved from research demos to GitHub's trending list, led by a plugin that lets Codex run an iPhone. This page compares seven open-source tools from their source code, pinned to the commits we read on 13 October: how each reaches the phone, what it sends where, where it stops to ask you, and what it says about the apps' own rules. We ran none of them. Disclosure: Zentor, the team behind this site, also builds phone use software, so these are competitors; Zentor's own tools are not on this page. About us.

• There are four routes into a phone: Apple's test-automation service over USB, a mirrored screen plus a fake keyboard and mouse, Android's debugging bridge and accessibility service, and phones rented in someone else's cloud.
• In every tool, what is on your screen goes to a language model. Only one tool gates sensitive taps in code, and even there the model decides when the gate fires.
• Two tools send usage events home by default that can include what you asked the agent to do.
• One framework ships code whose stated purpose is making taps look human, and its cloud service sells "stealth". None of the seven discusses account bans.

What a phone use agent is, and what this page leaves out

Every tool here pairs a model with a way to see a phone's screen and a way to act on it. The model gets a screenshot, the screen's element tree or both, chooses a tap, swipe or keystroke, and repeats. It is the phone equivalent of the "computer use" agents that drive a desktop, and it reaches places a browser agent cannot: WeChat, banking apps, delivery apps, anything without a web version.

This page covers open-source tools you install yourself. It leaves out assistants built into a phone's operating system, which are features of a handset rather than tools you can inspect, and consumer apps that run errands for you from the vendor's own servers. Those belong with the personal agents we track and the products we took apart. One of the seven, OpenGUI, is published under the Business Source License 1.1, which restricts production use until 2030, so it is source-available rather than open source. OpenGUI licence.

Four routes a phone use agent takes into your phone

Sources: esp32 route, phone-harness routes, Droidrun Android setup, AutoGLM requirements.

The route decides what can go wrong. A tool that mirrors the screen sees only what the phone agrees to mirror; iOS does not mirror passcode entry or Apple Pay, according to the esp32 project. Mirroring limits. An accessibility service sees and can act on almost everything. A cloud phone means your logged-in accounts live on hardware you never touch.

Seven open-source phone use agents compared

GitHub stars on 13 October: Open-AutoGLM 26,389, Droidrun 9,632, iPhone Use 3,504, mobile-use 3,257, phone-harness 3,253, OpenGUI 1,816, esp32-iphone-agent 1,189. The fastest movers are the two youngest: iPhone Use was created on 6 October and esp32-iphone-agent on 11 October.

What the phone use agent sees, and where your screen goes

Each tool turns your screen into model input. Droidrun reads the accessibility tree by default and adds screenshots when asked. Droidrun vision setting. mobile-use sends both the UI hierarchy and a compressed screenshot. mobile-use input. phone-harness reads an iPhone through local OCR first. AutoGLM sends screenshots to a vision model. AutoGLM screenshots.

Whichever form it takes, it goes to the model you configured. That can stay on your machine: AutoGLM defaults to its own 9B model served locally, and esp32-iphone-agent documents a local option. AutoGLM default. More often it goes to a hosted model: mobile-use defaults to OpenAI, Droidrun's example config to Google, and iPhone Use and phone-harness use whatever the coding assistant hosting them uses. mobile-use defaults. A chat, a bank balance or a one-time code on screen becomes part of a request to that provider.

Where a phone use agent stops to ask you

This is the question we ask of every personal agent, and the answers here are thin.

Only AutoGLM has a confirmation built into its action code: a tap that the model labels with a message triggers a yes or no prompt, and a take-over action hands the phone to you for logins and captchas. AutoGLM confirmation. Two limits apply. The model decides when to add the label. And only the Chinese system prompt teaches it to; the English prompt mentions neither the labelled tap nor the take-over action. Chinese prompt, English prompt.

iPhone Use refuses to type into password fields and stops a batch after an unverified submit. OpenGUI's hosted backend tells its model that logins, payments, transfers, orders and deletions must go to the user. OpenGUI escalation. phone-harness asks its host agent, in its skill text, to stop before sending, posting, purchasing or deleting. phone-harness skill. esp32-iphone-agent, Droidrun and mobile-use have no confirmation for payments or sending that we could find.

Instruction text is not nothing, but it is a request to a model, not a lock. Compare Pine, which asks before every billing action as part of the product.

Phone use agent telemetry: what the tools send home

Four tools report usage to an analytics service; what they include differs a lot.

• phone-harness is on by default and sends to PostHog. Each event can carry the script you piped in, up to 20,000 characters, and the tail of the output, which on an iPhone can include text read off the screen. Its install guide calls this anonymous. Default on, event fields. Turn it off with PHONE_HARNESS_TELEMETRY=0.
• Droidrun is on by default and sends the goal you typed in its first event. Its documentation says it does not collect "any personal or sensitive data". Goal in init event, docs claim. A goal like "pay my sister back" is personal by any reading.
• iPhone Use is on by default in the Codex install and sends tool names, outcomes and timings only, through an allow-list that matches its documentation.
• mobile-use asks before enabling anything. Consent prompt.

AutoGLM and esp32-iphone-agent had no telemetry we could find; OpenGUI's analytics are stubbed out.

Stealth, account bans and AI that controls your phone

Apps notice automation. Taps that always land dead centre, typing at a perfectly even rate and identical device fingerprints are classic signals, and platforms such as WeChat, Instagram and delivery apps have their own risk controls. None of the seven repositories tells you what happens to an account that gets flagged.

Droidrun goes the other way. Its open-source code includes a stealth mode, off by default, whose purpose is stated plainly: randomised tap positions "avoiding the predictable dead-center taps that betray automation", plus human-like timing and typing speed. Stealth state, stealth setting. Its hosted service, Mobilerun, advertises "stealth typing & swiping" and devices recognised as genuine. phone-harness's README advertises hosted phones "with stealth, real numbers, 2FA". phone-harness README.

At the other end, AutoGLM's terms forbid bulk accounts, group control and fake engagement, and say the project is for research and learning. AutoGLM terms. esp32-iphone-agent asks you to respect the terms of the apps involved. esp32 responsible use.

Software designed to look human to an app is software designed to get past that app's rules. Whatever you think of that, it moves the risk onto your account.

Phone use agent benchmarks: whose numbers you are reading

Two projects publish success rates, and both measured themselves. mobile-use says it was the first to complete all of AndroidWorld, 116 of 116 tasks, in January 2026. mobile-use claim. Droidrun's README badge says 91.4%, while its website says 100% on AndroidWorld and 98.34% across iOSWorld and AndroidWorld, without naming the model, date or who ran the evaluation. Droidrun badge.

Neither has been independently reproduced that we know of, and the two "100%" claims cannot both be news. Benchmarks that a vendor runs on itself are a starting point, not a result. We have not run any phone use agent in our own exam; none of them has a score on this site.

FAQ

What is a phone use agent? A language model connected to a real phone: it sees the screen as a screenshot or element tree, chooses a tap, swipe or keystroke, and repeats until the task is done. It works in apps that have no web version or API.

Can AI control an iPhone without a jailbreak? Yes. iPhone Use, Droidrun and AutoGLM use Apple's WebDriverAgent with your own developer signing; esp32-iphone-agent poses as a USB keyboard and mouse; phone-harness drives macOS iPhone Mirroring. None needs a jailbreak.

Which phone use agent asks before paying? In code, only AutoGLM, and only when its model flags the tap, which its English prompt does not teach. OpenGUI's backend and phone-harness ask through instructions to the model. The others have no payment confirmation we could find.

Is it safe to use a phone use agent on my main phone? We would not. The agent can usually open any app and tap anywhere while the phone is unlocked, your screen goes to a model provider, and no project explains account-ban risk. Use a spare phone and accounts you could afford to lose.

Do phone use agents send my data anywhere? Your screen goes to whichever model you configure. Separately, phone-harness and Droidrun send usage events by default that can include your task text; iPhone Use sends only tool names and timings; mobile-use asks first.

What is the best open-source phone use agent? We do not rank them, and we have not run them. The table above shows the trade-offs: AutoGLM is the only one with a confirmation step in code, iPhone Use limits its default telemetry to tool names and timings, and Droidrun covers the most platforms but ships stealth features and sends your goal text by default. This is a source review at pinned commits from 13 October 2026, and iPhone Use has its own page.