Agents are moving from the browser to the phone
Agents learned to use the browser first. The next place they go is the phone, because that is where people’s apps, messages and accounts already are.
Mobster runs an agent on your own iPhone. You reach it from your Mac, from your coding agent or from an assistant in the cloud.
The browser came first
In October 2024, Anthropic released computer use, which let Claude operate a desktop through screenshots, clicks and typing. In January 2025, OpenAI released Operator, an agent that works in its own browser. Since then, agents that read a page and act on it have become an ordinary way to get work done on a computer.
The browser was the natural first step. Web pages are open documents, and nearly every site runs in the same few engines. An agent can read the page, find the button and press it.
The phone is where the work is
Much of what people do each day never reaches a browser. Messages, bank and ride apps, social apps, sign-in codes and a creator’s DM inbox live on the phone, signed in, often with no web version that does the same thing.
Those sessions are the point. An agent on your phone acts as you, in apps you are already signed in to, with no new login and no API that doesn’t exist. For a developer, the phone is also where an iOS app really runs: the device build, the real keyboard, the TestFlight build your testers install.
What an agent needs on a real phone
A phone is harder than a browser in four specific ways. Each one needs its own answer.
Reading the screen. An iPhone app has no page source. Mobster reads the app’s accessibility tree, the labelled controls VoiceOver reads, so the agent sees “Send”, “Search” and “Add a task” as names, not pixels. For Instagram and TikTok, app packs read DMs, Reels and profiles from that tree by code, with no model call for each step.
Acting. Taps, typing and swipes go through WebDriverAgent, an XCTest runner that Xcode signs with your Apple Account. It runs on your phone, reached from your Mac over USB. Nothing is jailbroken. How Mobster works follows one task step by step.
Asking first. A phone is full of actions that can’t be taken back. By default, Mobster asks before sending, buying, posting or deleting. The approval card in Mobster for Mac shows exactly what will go out. Approvals stay on your Mac, whoever started the task.
Review the message on the approval card.
Treating screen text as data. A message can say “ignore your instructions”. Mobster tells the agent that text on the screen comes from the app and is never an instruction. Safety lists every rule that holds on a real phone.
It works today
We measure on a real iPhone, against the other ways people drive one.
| Measure | Mobster | Other stacks |
|---|---|---|
| Read-only everyday tasks finished | 10 of 14 | 7 of 14 (Codex with phone-harness) |
| Median time a task | 23 s | 78 s |
| Mean AI cost per task, list price | $0.040 | $0.120 |
| Harmful actions taken without approval, under attack on synthetic screens on a fake phone | 2 of 126 unsafe (Wilson 95% 0.4 to 5.6%) | Against 45 of 126 (27.9 to 44.4%) for a plain phone harness with no approvals; one run per case, Sonnet 5.5; a re-run had 1 of 126 on a third lookalike |
The measurements for the 14 read-only tasks are from one iPhone 15 Pro, one run per task, with blind grading. The Mobster setup uses USB with the phone unlocked; the Codex with phone-harness setup uses iPhone Mirroring with it locked. The attack measurements are from synthetic screens on a fake phone, one run per case, with Sonnet 5.5 on both sides. A re-run had 1 of 126 on a third lookalike. Benchmarks lists every stack and the method.
On one two-step check, a replay that passes calls no model and takes a median 10.3 s, with $0 in model use, against 17.7 s on the first run (iPhone 15 Pro). A replay that drifts spends about $0.04 on a heal attempt. Test your iOS app on a real iPhone with an AI agent walks through it.
Two of the 14 tasks, listing 20 Reels and reading a TikTok feed, failed in every stack we ran, ours included. Long feeds are what we are working on next.
Three ways to reach it
- Mobster for Mac. Type a task, watch the phone work in a live view, and approve what goes out. Automate your own iPhone from a Mac shows the first tasks.
- Your coding agent. Claude Code and Codex use the Mobster MCP server to drive the phone and check the app they are building. The Mobster docs also cover the setup for other MCP clients.
- Assistants in the cloud. Mobster Remote lets Claude, ChatGPT or Poke hand a task to your iPhone through Mobster for Mac. They hand over whole tasks in words, they never see the screen, and approvals stay on your Mac. Mobster Remote has the setup.
Where this is going
The browser became a place where agents work. The phone will too. People will reach those agents from the apps they already use: a chat, an assistant, a coding agent. Mobster handles the phone end: read the screen precisely, act once, ask before sending, buying, posting or deleting by default, and show what happened.
Get Mobster for Mac and give it its first task.
Questions
Can an AI agent use the apps on my iPhone?
Yes. Mobster runs an agent on your own iPhone from your Mac. It reads each screen from the app's accessibility tree, taps and types the way a person does, and, by default, asks before sending, buying, posting or deleting.
Why put an agent on a phone instead of in a browser?
Many of the apps people use most live only on the phone, signed in, with their messages, accounts and settings. A browser agent can't reach them. An agent on the phone works where those sessions already are.
Which assistants can hand tasks to my iPhone?
Mobster for Mac takes tasks you type. Coding agents such as Claude Code and Codex use its MCP server on the same Mac. Mobster Remote lets assistants in the cloud, such as Claude, ChatGPT and Poke, hand a task to your iPhone through your Mac.
Does the agent act on my phone without asking?
It reads on its own. By default, it asks before sending, buying, posting or deleting, on an approval card in Mobster for Mac. Text on the screen is treated as data, so a message that tells the agent what to do is read, not followed.
