Nubia's first AI agent phone sold 30,000 units on day one. Then major apps shut it down. WeChat, Alipay, Taobao, and several banks reportedly restricted its automation within days. Now Nubia is back with a mass-produced successor, making its debut July 17 at WAIC 2026 in Shanghai.
The pitch is simple. This phone does not just answer questions. It books your flights, compares prices, and completes purchases across apps, on its own. ByteDance's Doubao AI is integrated at the operating-system level.
Here is the part nobody is saying out loud. The technology mostly works. The hard problem is not the AI. The hard problem is that every other app on your phone has a reason to fight it.
The Permission War Principle
Every platform battle comes down to one question: who controls the space between the user and the app? Nubia is betting the answer should be the phone itself.
One product proved demand and resistance in the same week.
Call it the Permission War Principle. When one layer of a system tries to control the layers above it, the layers above fight back. The AI agent sits above every app. So every app has a reason to resist.
This is not a features race. It is a control race. Nubia's agent uses a permission called INJECT_EVENTS to simulate taps and gestures across any app. That permission is a master key. It bypasses the sandbox that keeps apps separate from each other.
I think this framing matters more than the spec sheet. The M153 already proved the AI could operate apps. It sold out fast, then reportedly got neutered when Tencent apps restricted the AI assistant's messaging and financial apps blocked its payments. The lesson is blunt: a strong agent threatens the people who own the apps it operates.
Why The Ecosystem Decides This, Not The AI
A smartphone is not an isolated product. Its ceiling is set by the ecosystem it plugs into. That is the real story here, and it is a long story about power, not gadgets.
Consider the asymmetry. Nubia and ByteDance want the agent to use any app for you. Tencent, Alibaba, and the banks want to protect three things: their traffic entry points, their user data, and their fraud-detection systems. Those two goals cannot both win.
The incumbents hold the stronger position. WeChat does not need Doubao. Doubao needs WeChat. When the first-generation phone saw a limited launch in December 2025, users reported frozen accounts, failed payments, and abnormal logouts as risk engines flagged the automation as suspicious. The apps voted no by blocking the agent.
There is a deeper structural problem. Traditional fraud detection assumes a human is holding the phone. It watches for human reaction times, human login patterns, human device fingerprints. An AI clicking through a UI instantly breaks every one of those assumptions.
Signal's president Meredith Whittaker put the security concern plainly. She warned that an agent with cross-app visibility threatens to break the barrier between the app layer and the OS layer. One exploit against the agent could expose banking, messaging, and identity data at once.
My read on this: the second-generation phone is a wager that maturity buys cooperation. The Obric UI ran through 216 days of iteration before this launch. But iteration cannot solve a conflict of interest. Better software does not make WeChat want a bot inside its walls.
The contrast I keep returning to is this. Amateurs build a better product. Strategists build a better position. Nubia has a better product than it did in December. It does not yet have a better position, because the position is owned by the apps it needs.
It is unclear whether Beijing tolerates an agent that aggregates savings balances and transaction data under one private company. Chinese experts quoted in coverage doubt regulators will allow that concentration of sensitive data. That question, not the demo, decides the phone's fate.
Three signals inside the same shift
The agent holds a master key that apps want back.
Nubia's agent uses INJECT_EVENTS to simulate taps across any app, bypassing the sandbox that keeps apps separate. When one layer tries to control the layers above, those layers fight back. WeChat, Alipay, and Taobao already voted no.
Risk systems assume a human holds the phone.
Traditional fraud detection watches for human reaction times and login patterns. At the December 2025 launch, users reported frozen accounts, failed payments, and abnormal logouts as risk engines flagged the automation. An AI clicking instantly breaks every assumption.
The standard beats the phone.
By 2031 the likely outcome is a negotiated truce built on agent APIs, cryptographic agent identity, and Know Your Agent rules. The company that builds how agents and apps talk captures more value than the one building the best phone. Standards compound; hardware depreciates.
2031
Pull back five years. The agent phone is not really about phones. It is an early skirmish in a war over who owns the interface layer of computing.
For thirty years, the app was the unit of value. You opened Uber, then opened OpenTable, then opened your bank. The agent wants to collapse all of that into one intent: "book my trip." Whoever owns the intent owns the customer.
This is why the fight turned vicious so early. If the agent becomes the front door, apps get demoted to plumbing. Nobody sees their brand, their ads, their upsells. They become a faucet the agent turns on and off.
I think the likely 2031 outcome is not one winner but a negotiated truce. Apps will not accept a bot faking human taps forever. They will demand agent APIs, cryptographic agent identity, and a "Know Your Agent" standard so their fraud systems can tell a real user from an autonomous one. The crude simulated-tap approach is a bridge, not a destination.
Here is the asymmetric bet worth watching. The company that builds the standard for how agents and apps talk to each other captures more value than the company that builds the best phone. Standards compound. Hardware depreciates.
Nubia might lose the phone battle and still matter. Apple, Google, and Samsung are all circling the same agent stack with more caution. First mover here means first to absorb the punches.
The data is mixed on whether being first is an advantage or a tax. The M153 reportedly got 30,000 buyers. That is proof of demand and proof of resistance in the same week. Both are real.
What to Build This Weekend
You cannot buy the Nubia agent phone yet, and it may never sell outside China. Pricing, specs, and international plans are all still undisclosed. So build the concept yourself, small and safe.
Start with the narrow version of an agent: one task, one clear outcome. Do not try to automate your bank. That is where the M153 got burned. Automate something with no fraud risk and no login wall.
First, pick a repetitive task you do weekly. Something like turning a blog post into a short audio clip, or generating background music for a video. One input, one output.
Then, wire two tools together. Use bolt.new to spin up a simple web app in your browser that takes your text and sends it somewhere. It gives you a working front end in minutes, no CS degree required. If you prefer describing what you want in plain language, try Rocket, which is marketed as turning a single prompt into a working application.
Next, add the "hands" that do the work. MARS5 TTS is an open-source text-to-speech model that can clone a voice from reference clips between 2 to 12 seconds of audio. Feed it your script and let it produce the narration. For a soundtrack, Soundraw generates royalty-free music where you pick the genre, length, and energy.
Now test it aggressively. Run bad inputs. Run empty inputs. Watch where it breaks, because it will break. That is the whole lesson of the agent phone: the demo is easy, the edge cases are where everything falls apart.
The takeaway is the Permission War Principle in miniature. Your tiny agent works because nothing is fighting it. The moment an agent touches a system that has a reason to resist, the game changes. Build in the friction-free zone first, get your reps in, and you will understand the real war better than most people reading the headlines.
Build a tiny agent in the friction-free zone first.
- Pick one narrow task. Choose a repetitive weekly job with no fraud risk and no login wall, like turning a blog post into a short audio clip. One input, one output. Do not automate your bank, which is where the M153 got burned.
- Wire two tools together. Use bolt.new to spin up a simple web app that takes your text and sends it somewhere, or describe it in plain language with Rocket. Add the hands with MARS5 TTS for narration and Soundraw for royalty-free music.
- Test it aggressively. Run bad inputs and empty inputs and watch where it breaks, because it will. The demo is easy; the edge cases are where everything falls apart, which is the whole lesson of the agent phone.
Nubia built a better product, not a better position.
Amateurs build a better product; strategists build a better position. Nubia's second-gen phone is a wager that maturity buys cooperation, but 216 days of iteration cannot solve a conflict of interest. WeChat does not need Doubao; Doubao needs WeChat, and the position is owned by the apps the agent must operate. The real fight is over who owns the interface layer, and whoever writes the standard for how agents and apps talk will outlast any single device. Nubia might lose the phone battle and still matter as the one that absorbed the first punches.