Apple and Google have both told the European Commission that its interoperability measures for AI assistants put users at risk, and both have commercial reasons for saying it. Apple wants to protect Siri’s privileged position on iOS. Google wants to keep certification authority over Android and the device manufacturer relationships that depend on it. Their record supports the skepticism: the Free Software Foundation Europe reported in April 2026 that Apple had produced a working solution for none of 56 formal interoperability requests, with several rejections resting on scope arguments that Apple’s own technical documentation contradicts.
The commercial motive explains why they are speaking. Whether the underlying claim holds is a separate question, and the independent evidence on what happens when a non-deterministic system holds operating system privileges points the same direction they do.
What the measures grant
Google set out its objections on August 5 in a post signed by twelve independent security practitioners, including certification and notified bodies the EU relies on under eIDAS and the Cyber Resilience Act. The final measures in the Android specification proceedings require that downloaded AI agents receive access to ambient device data, covering always-on microphone, camera, and on-screen content, with no qualification process available for that category. Where a qualification process does apply to other sensitive capabilities, the measures require a mechanism allowing users to bypass it. Apple describes an equivalent obligation on its side: any virtual assistant able to read and send messages, make purchases, access files, and execute actions across installed apps, operating autonomously without ongoing user visibility.
That combination is the specific configuration security researchers have spent two years warning against. Meta’s Rule of Two, one of the more widely adopted architectural heuristics for agent design, holds that a single agent should carry at most two of three properties: processing untrusted input, accessing sensitive systems, and changing external state. The measures mandate all three at once.
The attack is in production and scaling
Indirect prompt injection, where instructions hidden in a webpage or document redirect an agent’s behavior, remains unsolved at a fundamental level. Language models process instructions and retrieved content in a single token sequence with no reliable mechanism for enforcing privilege boundaries between them, which is why the input validation techniques that eventually contained SQL and shell injection have no equivalent here. OWASP contributors made this argument in these terms at Infosecurity Europe in June.
There are defences that could help. Capability-based systems and information-flow monitors such as CaMeL, FIDES, and Progent report strong results against benchmark attacks, and every published assessment of them concludes that layered mitigation reduces harm while leaving a gap.
The attack has moved out of demonstration and into live deployment against the open web. Google reported in April 2026, based on repeated Common Crawl scans, a 32 percent relative increase in malicious injection payloads on the public web between November 2025 and February 2026. Forcepoint’s threat hunting found live payloads triggering on the same patterns. Forcepoint’s summary of the risk gradient is the operative point for this debate: a browsing AI limited to summarizing carries low risk, and an agent that can send email, run commands, or process payments becomes a high-impact target.
Two EU regulations issuing opposite instructions
The Cyber Resilience Act requires manufacturers of products with digital elements to apply security-by-design and security-by-default principles, minimize exposure, and exercise due diligence over third-party components. The Radio Equipment Directive’s delegated act, through the harmonized standard EN 18031, covers network protection, personal data protection, and fraud prevention on the same hardware. The DMA specification decisions require those manufacturers to open that exposure to any third party a user selects and to provide a documented route around whatever vetting they build. DEKRA, an EU notified body, has published the observation that the two regimes conflict directly on agentic access.
The standards work that certification would rest on arrived after the mandate and remains thin. ETSI published EN 304 223, the first European standard for AI cybersecurity baselines, in December 2025. It names indirect prompt injection as a distinct risk class and sets thirteen lifecycle principles across sixteen pages, which gives certification bodies a framework while offering them nothing prescriptive about an agent holding system privileges on a consumer handset. The Commission’s own AI Office said in late July that its approach to agentic safety remains preliminary.
The missing referee
Specification proceedings run through the competition directorate, which is mandated and staffed to assess contestability and fairness. A claim about injection resilience, biometric asset isolation, or bootloader integrity has nowhere to land there, so it enters the file as a gatekeeper compliance argument and receives the discount that gatekeeper arguments have earned. ENISA, the AI Office, and the CRA implementation teams hold the relevant expertise and have no standing in the proceeding.
Fixing this requires procedure rather than new law, and it would cost the Commission very little. Specification decisions that mandate system-level access should carry mandatory consultation with ENISA and the AI Office before they bind, with the security assessment published alongside the competition analysis. Where the two regimes conflict, the conflict should be resolved on the record and named as such. Certification lifecycle authority, including suspension and revocation, needs to sit with an entity holding device telemetry and able to act within hours.
The DMA’s objective here is sound and platform control over assistant defaults is a genuine competition problem and it deserves a remedy. The remedy currently being specified will set the security posture of European phones for a decade, and the directorate writing it has no mandate to evaluate whether it is safe.