Pinky Lets AI Agents Tap Your Phone, But Payments Wait for You

DIYgod has released Pinky, free software that lets AI agents tap, swipe and type on real iPhones and Android phones, with approval rules meant to keep a person in charge. ^[1]

Pinky is a desktop app for macOS, Windows and Linux. It connects agents to a phone through MCP, a standard interface that lets software use tools, and it carries no AI model of its own. ^[1][2][5] A user brings an agent that speaks MCP, and Pinky hands that agent the phone's screen and controls. The repository sums up its goal in a single line: "Let AI agents use your phone, with you in the loop." ^[1]

The project is released under the Apache-2.0 licence. It was created on GitHub on November 6, 2026, and it calls itself pre-alpha, which means early and unfinished. ^[1][3] This story is developing, and much of what Pinky promises has not yet been tested by anyone outside the project.

Why a phone is different

Giving an agent a browser is one thing. Giving it a phone is another. Messaging, shopping and banking apps may have no web equivalent, and on a phone a tap does not merely produce text. It can send a message, delete a photo or move money.

That is the problem Pinky sets out to manage. Its answer is to put the rules in the gateway, not in the instructions given to the agent. ^[1][4][5] A rule written into a prompt is a request, and a clever enough input can talk a model out of it. A rule enforced by the gateway is not something a prompt can switch off.

What the gateway does

By default, payments, trades and transfers stop and wait for a person. In settings, a user can add other actions to that list, including sending messages, deleting content, making calls and changing settings. ^[1][4][5]

The person approves through the desktop interface. If no answer comes within 60 seconds, the request times out and is denied. ^[2][3]

Banking, wallet and password-manager apps are hidden from agents unless a person says otherwise. Agents also cannot type into password or one-time-code fields. A user can allow a banking or wallet app for a single task, after which the agent may read that app's screen for the task. ^[1][2]

Takeover is built in. A person can pause the agent and drive the phone through Pinky's mirrored display, and Pinky provides a stop control. On Android, Pinky says, simply touching the phone pauses the agent. ^[1][4]

Pinky also keeps records. It stores task steps, screenshots and screen video on the user's own computer, for 30 days by default, with a setting to switch recording off. Its acceptance checklist says nothing is recorded from a blocked app, a lock screen or the person's own use of the phone. ^[1][4]

Which phones, and how

The project supports Android 10 to 17 and iOS 17.4 or later. On iOS 27 and later, nothing needs installing on the phone. On iOS 17.4 through 26, a helper must be installed from a Mac running Xcode, Apple's developer toolkit. ^[1]

On Android 13 and later, agents can work on a hidden second display, so the phone's own screen can stay off and locked in supported cases. The checklist notes platform quirks. Android 17, for one, may require keeping the phone awake with its screen dark. ^[1][4]

The door the gateway cannot close

Pinky's own documents carry its most important warning. The gateway governs actions that pass through it. An agent allowed to run shell commands, meaning the ability to type commands directly into the computer's system, may be able to control an Android phone through ADB, Android's debugging and device-control tool, and skip Pinky's rules entirely. ^[1][5]

The project recommends sandboxing such agents, meaning walling them off from the rest of the system, or connecting the phone to a different computer. ^[1][5]

The candour is welcome, and the point deserves weight. A safeguard around one route to a device is not a safeguard around the device.

The approval prompt protects a user only if the agent has no other way in, and arranging that falls to the user. If the setup is wrong, the gateway is bypassed without a prompt.

Early cracks

The blocking of finance apps has also drawn criticism. AI Polix reported on November 9 that a code review by a group called Tokenstrom found the blocking partly relies on keyword heuristics, rough rules that match on words, and that it missed several German banks. ^[3] The Tokenstrom review itself is not available to this paper, so the finding rests on AI Polix's account.

A keyword list will always lag the app stores. A bank with an unfamiliar name, or an app in another language, can slip past a filter that looks for the usual words.

The project's own checklist is frank about its status. It describes tests on real Android phones and iPhones, but separates those from checks run only on emulators, which are virtual phones running on a computer, and from tests not yet finished. ^[1][4]

No one outside the project has yet published how often the payment and sensitive-action detectors miss across different apps, languages and phone models. Nor is it public what screen content reaches the chosen agent during a task, which depends on how that agent's maker handles data.

What it adds up to

Pinky is worth taking seriously for its design, not for its maturity. A gateway that holds risky taps for a human, denies when the human is away, and keeps the human's hand on the phone is a concrete answer to a question most agent builders have only waved at.

The design is sound, but it is a design and not yet a guarantee. Until the ADB path is closed by setup or by software, and the finance-app filter is tested well beyond one country's banks, the sensible way to run Pinky is the way its authors suggest: on a spare phone, with an agent that cannot reach the shell.

What to watch is whether the maintainers answer the bank-blocking finding, and whether the pre-alpha label comes off.