My Android AI agent can only open links it already has a reason to open

The author has developed Kryzz AI, a free and open-source Android app that features an agent mode capable of searching the web, reading pages, and writing files. One of the smaller but significant updates in version 1.1.2 ensures the agent cannot open any URL it pleases. The problem arises when an agent reads web pages, which contain text written by strangers.

A naive agent loop might follow instructions from a page to fetch another URL and include the user's notes in the query. To avoid this, the rule implemented in Kryzz is that the fetch_url tool only opens links shared in the chat, search results from the same chat, or sites explicitly named by the user. Any other URL is refused, and the agent must search or ask for permission.

This small allowlist prevents the page-reading tool from being a blank cheque and ensures the agent cannot steer itself to a brand-new address on its own or turn a made-up URL into a fake citation. While this restriction may require an extra step (a search) before the agent can read a page, it is considered acceptable. The author acknowledges that it is not a complete defense against prompt injection, as a page allowed to be read can still contain junk instructions.

To counteract this, comprehensive answers go through one review pass against the actual tool results. Additionally, there is a per-turn cost cap (default $0.25) to prevent a confused loop from running up the bill. The agent's actions are transparent, with every agent answer having a work log detailing the queries, pages, and files.

The models are not on-device; instead, requests go from the phone to OpenRouter (or optional providers turned on). The APK is a debug build for Android 9+, and while a signed release build is still on the list, it is not available yet. The release version can be downloaded from the following GitHub link: https://github.com/kriddss3/kryzz-ai/releases/tag/v1.1.2.