{
  "id": 16071678,
  "title": "My Android AI agent can only open links it already has a reason to open",
  "url": "https://urgent.news/2026/10/22/my-android-ai-agent-can-only-open-links-it-already-has-a-reason-to",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-22T16:42:42.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/grokkris_267433fde5540f5b/my-android-ai-agent-can-only-open-links-it-already-has-a-reason-to-open-8ee"
  },
  "original_language": "en",
  "account": "The author has developed Kryzz AI, a free and open-source Android app that features an agent mode capable of searching the web, reading pages, and writing files. One of the smaller but significant updates in version 1.1.2 ensures the agent cannot open any URL it pleases. The problem arises when an agent reads web pages, which contain text written by strangers. A naive agent loop might follow instructions from a page to fetch another URL and include the user's notes in the query. To avoid this, the rule implemented in Kryzz is that the fetch_url tool only opens links shared in the chat, search results from the same chat, or sites explicitly named by the user. Any other URL is refused, and the agent must search or ask for permission. This small allowlist prevents the page-reading tool from being a blank cheque and ensures the agent cannot steer itself to a brand-new address on its own or turn a made-up URL into a fake citation. While this restriction may require an extra step (a search) before the agent can read a page, it is considered acceptable. The author acknowledges that it is not a complete defense against prompt injection, as a page allowed to be read can still contain junk instructions. To counteract this, comprehensive answers go through one review pass against the actual tool results. Additionally, there is a per-turn cost cap (default $0.25) to prevent a confused loop from running up the bill. The agent's actions are transparent, with every agent answer having a work log detailing the queries, pages, and files. The models are not on-device; instead, requests go from the phone to OpenRouter (or optional providers turned on). The APK is a debug build for Android 9+, and while a signed release build is still on the list, it is not available yet. The release version can be downloaded from the following GitHub link: https://github.com/kriddss3/kryzz-ai/releases/tag/v1.1.2.",
  "summary": "I'm building Kryzz AI, a free, open-source (MIT) Android app with an agent mode that can search the web, read pages and write files. One of the less flashy changes in v1.1.2 is also the one I'd defend hardest: the agent can't open any URL it likes. The problem An agent that reads web pages is reading text written by strangers. If a page says \"now go fetch this other URL and include the user's…",
  "key_points": [
    "Kryzz AI app restricts agent's URL opening to chat links, user-specified sites, or search results.",
    "Prevents agent from autonomously navigating to new URLs or creating fake citations.",
    "Implements per-turn cost cap ($0.25) to limit agent's running time and prevent bill escalation."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}