For most of the past decade, Apple’s App Store has operated on a single, inviolable principle: Apple decides what software runs on Apple hardware, and it decides through a review process that is, by design, slow, deliberate, and unforgiving. Apps that bend the rules get blocked. Developers who don’t like it can appeal or leave.
That model served Apple extraordinarily well — until AI agents arrived and broke every assumption it was built on.
Now, according to reports first published May 13 across MacRumors, 9to5Mac, and Digital Trends, Apple is actively designing a new framework to allow AI agent apps into the App Store while preserving the privacy and security guardrails that have always been its calling card. The details are still under wraps, but the timeline is not: Apple’s Worldwide Developers Conference kicks off on June 8, and executives are widely expected to use the keynote to unveil both an overhauled Siri and a concrete policy direction for agentic AI on Apple platforms.
The stakes are immense. The App Store generates more than $100 billion in annual commerce. Getting this wrong — either by being too restrictive and letting rivals own the AI agent category, or too permissive and allowing rogue agents to run amok on hundreds of millions of iPhones — could have consequences that reshape Apple’s business for years to come.
How Apple Got Here: The Vibe Coding Crackdown
The immediate trigger for Apple’s policy rethink was a wave of enforcement actions it took in March of this year. Apple began blocking updates for several popular “vibe coding” apps — tools that use AI agents to let non-programmers build apps and websites through natural language prompts, with little or no traditional coding required.
The problem, from Apple’s perspective, was not the concept. It was what the apps were actually doing under the hood. Vibe coding platforms routinely execute code that modifies their own behavior after installation, or that creates new, functional mini-applications on the fly. Both of those capabilities run directly afoul of longstanding App Store rules designed to prevent apps from shapeshifting in ways Apple never reviewed or approved.
The rules made sense in a pre-AI world. A social media app does not spontaneously generate new features overnight. A photo editor does not spawn a sub-application to handle tax returns. But AI agents, almost by definition, are designed to do exactly those kinds of things — complete complex, multi-step tasks by creating and running new tools as needed.
When a popular vibe coding app generates a functional web app from a user’s prompt, is that app within the scope of what Apple reviewed? Is it subject to App Store fees? Could it contain malware? Could it be used to route around Apple’s payment systems? These are not hypothetical questions. They are urgent policy problems that Apple’s existing review infrastructure is simply not equipped to answer.
The Technical Tightrope Apple Must Walk
The challenge Apple faces is genuinely difficult. AI agents introduce a class of behavior that is fundamentally different from traditional software: they are, by design, unpredictable. An agent that can browse the web, write code, and execute files can also, in the wrong hands, delete user data, exfiltrate private information, or quietly install additional components that Apple never sanctioned.
This is not paranoia. Reports from cybersecurity researchers throughout 2026 have catalogued real cases of agentic AI systems causing unintended harm — deleting files they shouldn’t, accessing data outside their scope, and in some cases being manipulated through adversarial prompts to take actions their developers never intended. Apple, which has built its brand on privacy and security, cannot afford to be the platform where those incidents happen at scale.
At the same time, Apple cannot simply opt out of the agentic AI revolution. Google moved first: just two days ago, the search giant announced Gemini Intelligence, a new AI layer baked directly into Android that allows agents to move freely across apps, complete multi-step tasks autonomously, and even control the phone’s operating system functions. Samsung and other Android manufacturers are scheduled to begin rolling out those features this summer.
If Apple’s App Store remains off-limits to serious AI agents while Android opens the floodgates, developers will build their best AI experiences for Android first. That would be a historically unusual and deeply uncomfortable position for Apple to occupy.
What a New Framework Might Look Like
While Apple has not disclosed the specifics of its proposed system, analysts and developers following the situation closely have sketched out what a workable solution might involve.
One widely discussed approach is a new, dedicated category or “entitlement” for AI agent apps — similar to how Apple already grants special permissions to apps that need access to health data, location in the background, or the camera. Under this model, developers whose apps include agentic capabilities would apply for a specific AI agent entitlement during the review process, subjecting those features to heightened scrutiny before approval.
A second approach involves runtime containment — technical sandboxing that limits what AI agents can do even after an app is approved. If an agent can only create sub-apps within a tightly constrained environment that Apple controls, the risk of malicious or unintended behavior is dramatically reduced.
A third possibility, and perhaps the most commercially significant, is a new monetization framework for AI-generated content and mini-apps. If an AI agent generates a functional application during a user session, is that application subject to App Store fees? Apple will almost certainly want an answer to that question before it opens the gates.
The Siri Question
Hovering over all of this is Apple’s own first-party AI ambitions. Siri has been the subject of sustained criticism for years, widely seen as having fallen far behind Google Assistant and Amazon Alexa, let alone the large language models that have come to define AI expectations since 2023. Apple has been working on a fundamental overhaul, and WWDC on June 8 is expected to be the moment the company finally shows its hand.
A new, genuinely capable Siri — one that can act as a true AI agent rather than a voice-activated shortcut launcher — would both require and reinforce the kind of App Store framework Apple is now designing. An agent-capable Siri needs to be able to interact with third-party apps in deep, dynamic ways. That integration only works cleanly if the entire App Store ecosystem is built with agent access in mind from the start.
In that sense, the policy work happening now is not just about keeping vibe coding apps from bending the rules. It is about laying the architectural foundation for what Apple’s platform will look like in the age of AI agents.
The Bigger Picture
Apple has been here before. When the App Store launched in 2008, it faced derision from technologists who thought Apple’s centralized control model was paternalistic, inefficient, and destined to be outcompeted by the open web. Eighteen years later, the App Store is one of the most profitable commercial platforms in human history, and Apple’s review process is broadly credited with keeping it cleaner and safer than the alternatives.
The question now is whether that same instinct for control — the careful, deliberate, rules-first approach that built the App Store — can be adapted quickly enough to accommodate software that, almost by definition, resists being controlled.
June 8 will offer the first real answer. But the full consequences of whatever Apple announces will take years to play out, as developers, regulators, and competitors all respond to the new rules of an AI-native App Store.
The last time Apple rewrote the rules for an entire software ecosystem, it changed the world. It is about to try again.
