Android Studio previews Bring Your Own Agent: redraw your project boundaries

What happened on 2026-09-24

On 2026-09-24, the Android Developers Blog announced Bring Your Own Agent (BYOA), which lets developers connect an AI coding agent of their choice to Android Studio. The post names Claude Agent, Codex and Antigravity as examples. BYOA is in preview starting with the Canary release of Android Studio 'Rabbit 2'. Android Studio gives the agent the project graph, build setup and platform details through the Agent Client Protocol (ACP). Any ACP-compliant agent can connect, and users sign in with their own plan or supply an API key. The capabilities listed include reading, writing and editing files, running shell commands and tests, searching the web, spawning subagents, and using build diagnostics, Compose Previews, SDK tools and emulator control. On security, the post mentions granular permissions that let routine work proceed automatically while riskier actions require approval. It does not describe further data-handling controls.

What it means for your threat model

The change has nothing to do with apps being cloned, but it moves a boundary on the source-code side. Built-in IDE assistants used to have fairly narrow capabilities and predictable data flows. Now an external agent can read the whole project, run commands and go online, and project content may be sent to and processed by whichever provider you choose, under that provider's terms. For teams protecting app logic, the risk concentrates in a few places: keystore paths and passwords, keys in local.properties, unreleased core algorithms, and R8 rules and manifest settings. The first three are about confidentiality. The last is about integrity: an agent that loosens keep rules or marks a component as exported to 'fix the build' can quietly widen what your release exposes. To be fair, none of these risks is unique to BYOA, since any command-line agent brings them. What BYOA changes is that this way of working now sits on the default path of the official IDE.

Checks you can put in place

First, keep keystores and their passwords outside the project directory and inject them through CI secret management, so they never sit in folders an agent can read. Second, before enabling an agent, check the chosen provider's data-use terms, including whether code is retained or used for training. Third, require human approval for shell commands, file deletion and network access. Fourth, in code review, examine changes to proguard-rules, exported attributes in AndroidManifest and network security configuration on their own, whether a person or an agent made them. Fifth, run a secret scan before every commit.

Your checklist

• Move keystores and passwords out of the project directory and inject them via CI
• Require approval for agent shell commands and network access
• Review changes to R8 rules and manifest exported attributes separately