On October 14, "Doubao Mobile Assistant" announced that the 30-day public notice period for the Screen Automation Declaration Protocol (SAEP) launched by Doubao Mobile Assistant has concluded, and it will now gradually open up screen automation operation permissions for third-party applications. After the public notice period, developers can still declare their refusal at any time, and the relevant operations will be promptly disabled.
Doubao Mobile Assistant has listed the applications that have explicitly refused and stated that it will be updated regularly. It is understood that the applications that have explicitly refused to grant screen automation operation permissions include Kuaishou and its associated ecosystem applications, Meituan and its associated ecosystem applications, Yingshi and its associated ecosystem applications, Alibaba and its associated ecosystem applications, Tencent and its associated ecosystem applications, as well as DiDi, Pinduoduo, Kimi, DeepSeek, Xiaohongshu, Qunar, NetEase Cloud Music, Baidu Maps, Boss Zhipin, China Telecom, China Unicom, China Mobile, China Merchants Bank, and the Industrial and Commercial Bank of China, totaling over 150 applications.
What Is SAEP?
SAEP is a public declaration specification launched by Doubao Mobile Assistant, under ByteDance, alongside its product in September 2025. It is used to define the boundaries of rights and responsibilities regarding "whether AI can operate an App on behalf of the user." It is also the first document in China's AI agent field that attempts to publicly define the "human-machine operation rules."
SAEP is not an industry-wide standard, but an on-device protocol launched by Doubao Mobile Assistant. It addresses the pre-boundary negotiation for cross-App operations by GUI agents, but it does not replace traditional API integration. The official side also mentioned that for highly sensitive business scenarios, standardized interface methods between agents such as MCP/A2A are more recommended, rather than screen reading and simulated clicking.
Supporters believe that SAEP provides a low-cost, standardized declaration channel, turning post-event conflicts into pre-event negotiations, representing an exploration of the mobile AI Agent ecosystem.
The concerns of the opponents (the three major telecom operators, banks, etc.) focus on: the GUI screen reading + simulated clicking technology itself has risk control loopholes, and the opt-out mechanism is unreasonable; in highly sensitive real-name, financial, and telecommunication business scenarios, screen automation will bring privacy leakage, misoperations, and business risks, and responsibilities are difficult to divide, so they choose to directly declare refusal.
Why Reject SAEP?
The appearance of the three major telecom operators' Apps on the refusal list is expected. On the surface, like Kuaishou, Meituan, and banking applications, they belong to "voluntary declaration of refusal." However, telecom operators' Apps involve numerous data privacy and responsibility definition issues, making it difficult to agree to the SAEP protocol specification at this stage.
First, the security baseline. Telecom operators' Apps are the centralized hosts for users' mobile phone numbers, real-name identities, phone balance, package contracts, and call and data records. Their sensitivity is no less than that of bank accounts. The essence of screen automation operation is that AI completes tasks on behalf of humans by reading screen content and simulating clicks. This means that key information such as users' ID numbers, service passwords, and SMS verification codes may enter the AI's "field of vision." Once there is a loophole in the operation chain—whether it is the abuse of permissions, caching of process data, or the exploitation of automated processes by criminals—the losses will be the most fundamental communication identity assets.
Notably, screen sharing and remote control are precisely the typical methods used in current telecom network fraud. A general-purpose agent that can "click a mobile phone on behalf of a user" inherently conflicts with the logic of anti-fraud defenses, requiring telecom operators to proceed with caution.
Second, compliance and responsibility definition. The telecommunications industry is subject to intense regulation. Operations such as package changes, account cancellation and transfer, and mobile number portability all have strict identity verification and risk warning requirements. If these operations are completed by AI simulating clicks, once misoperations or disputes occur, such as mistakenly subscribing to a package or mistakenly modifying a contract, it is unclear whether the responsibility lies with the user, the App, or the AI service provider. SAEP is essentially an industry protocol initiated by Doubao Mobile Assistant. The operators' refusal to access it is, to some extent, also waiting for more authoritative regulations to be implemented.
Third, the battle for interests and entry points. The three major telecom operators have their own AI layouts: China Mobile's "Lingxi" agent has been embedded in mobile terminals, and China Telecom and China Unicom also have their own intelligent assistants and large model plans. In the era of AI mobile phones, whoever becomes the first entry point for user-mobile interaction will master the distribution rights of traffic and services. Allowing third-party agents to directly "operate on behalf of customers" within their own Apps is equivalent to giving away the user entry point to others, and their own value-added service links may be bypassed. This is consistent with the logic of Alibaba and Tencent's refusal: the moat lies in the application ecosystem itself.
On a deeper level, this "collective refusal" by over 150 Apps exposes the yet-to-be-established rule contract between AI Agents and traditional Apps. Agents aim to "use mobile phones like humans," while Apps expect them to "follow the provided interfaces." Between open APIs and screen automation, there is a lack of an intermediary layer that balances efficiency, security, and commercial distribution. Telecom operators and banks form the trust foundation of the entire digital society. By taking the lead in saying "no," they are, to some extent, drawing a bottom line for the entire industry: the premise of automation is verifiable identity, auditable logs, and accountable mechanisms.
For Doubao Mobile Assistant, this list of over 150 applications illustrates the extreme difficulty of current ecosystem openness. In the short term, AI assistants can only prove their value on applications that have not declared refusal. In the long term, to integrate most daily-use Apps, industry alliances, regulatory departments, and even terminal manufacturers need to jointly formulate standards, turning "whether to allow AI operations" from a unilateral declaration into a multi-party contract.
Editor/Layout: Sun Tian
Proofreader: Mei Yaxin
Supervisor: Liu Qicheng