In early 2024, a finance employee at the engineering firm Arup joined a video call with his CFO and several colleagues. Following their instructions, he made 15 transfers totaling about US$25.6 million. Everyone else on the call was a deepfake. That was 2024. The tools behind such attacks have only improved since, and the evidence so far suggests the AI threat will not stop in 2027 it is likely to keep growing more powerful, more automated, and harder to spot.
No app was hacked and no password was cracked. What failed was the assumption that seeing and hearing someone proves who they are. Mobile apps lean on that assumption constantly: selfie checks, voice confirmations, one-tap approvals, SMS codes.
That is the core tension of AI in mobile app security. AI is making apps genuinely better, with smarter assistants, faster identity checks, and sharper fraud detection. The same technology makes attacks cheaper, more convincing, and easier to repeat. Meanwhile, businesses are adding AI features faster than they are securing them. IBM’s 2025 Cost of a Data Breach research found that of the organizations that reported a breach of an AI model or application, 97% said they lacked proper AI access controls.
The point is not that AI creates exotic, unstoppable threats. It is that it raises the stakes on old weaknesses (weak authentication, exposed APIs, unencrypted data) while adding a few new ones. Phones make this sharper, because they hold a person’s identity, money, messages, and second authentication factor in one pocket-sized device.
This article follows that thread how AI features change an app’s risk profile, how attackers use AI, which basic mistakes still cause the most damage, what documented incidents teach, and what developers and business leaders should do next. If you are building or buying a mobile product, a strong foundation in secure mobile app development is where most of this starts.
Why Every AI Feature Changes an App's Risk Profile
It is tempting to treat AI as a feature list and security as a separate checklist. In practice, each AI capability brings its own benefit and its own exposure. Mapping them side by side is one of the most useful exercises a product team can do before building.
| AI Feature | Business and User Benefit | New or Amplified Security Risk |
|---|---|---|
| Personalization and recommendations | Higher engagement, less noise | Behavioral profiles become a high-value data target; privacy-control failures |
| Chatbots and virtual assistants | 24/7 support, faster task completion | Sensitive text stored in logs; prompt injection; data leaking through model outputs |
| Biometric authentication and identity verification | Faster login, fewer passwords | Spoofing with synthetic faces or cloned voices; weak liveness checks |
| Predictive analytics and automated decisions | Better fraud and credit decisions, smarter routing | Manipulated inputs; opaque decisions that are hard to audit |
| On-device and cloud AI inference | Faster, more capable features | Exposed model endpoints, stolen API keys, abused compute |
| Third-party AI SDKs and APIs | Quicker delivery | Supply chain exposure and data sharing outside your control |
The pattern is consistent: AI increases the volume and sensitivity of the data an app handles, and it adds components, such as models, prompts, and external APIs, that traditional mobile security reviews did not cover.
That is why feature planning and threat modeling belong in the same meeting. Teams exploring AI features can learn more about integrating AI into applications with security requirements defined up front rather than bolted on after launch.
How Attackers Use AI Against Mobile Apps and Users
Attackers adopt AI for the same reason businesses do it saves time and scales. The evidence so far points to better versions of familiar attacks rather than entirely new categories.
Phishing that no longer looks like phishing
Language models remove the clumsy grammar that once gave scam messages away. The FBI’s 2025 Internet Crime Report, released in April 2026, was the first in the Internet Crime Complaint Center’s roughly 25-year history to include a dedicated section on artificial intelligence. It logged 22,364 complaints with an AI link and nearly $893 million in associated losses, and describes scammers using fake social profiles, voice clones, forged identification documents, and believable videos. Overall, cyber-enabled crime cost Americans nearly $21 billion, and phishing and spoofing, extortion, and investment schemes were the most frequently reported complaint types. Analysts reading the report note that the AI figure likely understates the problem, because victims often cannot tell whether AI was involved.
Phones add to the problem. Messages arrive by SMS, chat apps, and push notifications. Links are truncated on small screens, and people respond quickly. That is our analysis rather than a measured finding, but it explains why phishing-resistant authentication matters so much on mobile.
Deepfakes and voice cloning
The US Treasury’s FinCEN has seen the same pattern in financial services. Its November 2024 alert,FIN-2024-Alert004, reported an increase in suspicious activity reports describing suspected deepfake media, particularly fraudulent identity documents used to get past identity verification and authentication. Mitigations it points to include multifactor authentication, including phishing-resistant MFA, and live verification checks. For app builders, the risk lands wherever identity is confirmed by face or voice: account recovery, new-device enrollment, and high-value transfers.
Faster, cheaper malware and probing
AI also lowers the cost and skill needed to probe apps, APIs, and credentials at scale. The practical effect is speed, not magic: automated tools test more targets per hour. Digital.ai’s 2026 threat report, discussed below, shows how heavily mobile apps are already being attacked.
Account takeover at scale
Stolen credentials remain the cheapest path into an account. AI helps attackers tailor lures and automate attempts, so apps with weak authentication, no rate limiting, and long-lived sessions are the first to fall.
Attacks on the AI itself
AI-enabled apps add targets that did not exist before. The OWASP Top 10 for LLM Applications catalogs risks such as prompt injection, where crafted input makes a model ignore its instructions or reveal data. The AI supply chain is a target too: in October 2026 the Cloud Security Alliance documented a run of intrusions at platforms that store customers’ AI provider credentials (covered below). Inside organizations, IBM found that “shadow AI,” meaning unsanctioned AI tools, was involved in one in five breaches it studied and added about US$670,000 to average breach costs.
IBM’s overall numbers are worth keeping in proportion. It found that 16% of the breaches studied involved attackers using AI, mostly for phishing or deepfake impersonation. That is significant and growing, but it also means most breaches still start with conventional weaknesses, which is where the next section begins. For US organizations the stakes are higher: IBM put the average cost of a breach in the United States at a record $10.22 million in 2025, compared with a global average of $4.44 million.
The Basics Still Break Apps Common Mobile App Vulnerabilities
TheOWASP Mobile Top 10 (2024 edition) provides a framework for identifying major mobile application security threats. Its ten categories cover improper credential usage, inadequate supply chain security, insecure authentication and authorization, insufficient input/output validation, insecure communication, inadequate privacy controls, insufficient binary protections, security misconfiguration, insecure data storage, and insufficient cryptography.
OWASP Foundation
For 2025–2026, security teams must also account for emerging threats involving AI integrations, autonomous agents, exposed APIs, and software supply chains. The latest OWASP GenAI LLM Top 10 (2026) highlights these evolving risks, including prompt injection, sensitive information disclosure, excessive agency, data poisoning, and unbounded consumption.
Six critical areas deserve particular attention in modern mobile applications.
- Credentials and authentication. Hardcoded API keys, reused passwords, and weak login checks give attackers a direct way in. For AI features, a provider API key embedded in the app binary can be extracted and abused, running up costs or exposing data.
Fix: Keep secrets on the server, route AI calls through your own backend, enforce multi-factor authentication, offer passkeys where possible, and use short-lived authentication tokens. - Authorization and session handling. Authentication asks who you are. Authorization asks what you may do, and it must be checked on the server for every request. Apps that trust the client let one user read another’s records by changing an ID. AI agents introduce additional risks when they have excessive permissions to access user information or perform actions.
Fix: Use short-lived tokens, refresh-token rotation, session revocation, per-request authorization checks, and least-privilege permissions for AI integrations. - Insecure data storage and privacy. Tokens, chat histories, or personal data saved unencrypted on the device, in logs, or in backups can be exposed if a device is compromised. AI integrations introduce additional risks when conversations, uploaded documents, and personal information are transmitted to external providers or retained unnecessarily.
Fix: Use the iOS Keychain and Android Keystore, encrypt sensitive local data, store the minimum, keep sensitive values out of logs and analytics, and review AI provider data-retention and privacy policies. - Insecure communication and API security. Data sent without strong transport encryption, or with certificate validation switched off, can be intercepted or altered on untrusted networks. Poorly secured APIs can also expose user records, enable unauthorized operations, or allow attackers to consume expensive AI resources.
Fix: Enforce HTTPS and modern TLS, maintain certificate validation, implement server-side authorization, introduce API rate limits and usage quotas, and monitor suspicious traffic. - Supply chain and third-party SDKs. Every analytics, advertising, or AI SDK is code you did not write that runs with your app’s permissions. Vulnerable libraries, compromised packages, and excessive data-sharing permissions can expose application users and business systems.
Fix: Maintain a Software Bill of Materials (SBOM), scan dependencies for known vulnerabilities, pin versions, verify trusted package sources, and review what data each SDK collects. - Input/output validation, AI prompt injection, and cryptography. Insufficient validation can expose applications to malicious payloads, injection attacks, and unexpected behavior. AI-powered applications face additional threats, including prompt injection, sensitive information disclosure, poisoned data, hidden context exposure, and unsafe model outputs. Weak algorithms, hardcoded keys, or home-built cryptography further undermine security.
Fix: Validate inputs, treat AI-generated outputs as untrusted, restrict AI tools and permissions, protect model and vector databases, and use vetted platform cryptography libraries. - Emerging AI risks: excessive agency and unbounded consumption. The 2026 OWASP GenAI guidance identifies excessive agency and unbounded consumption as important risks for applications using AI agents and large language models. An AI agent with excessive permissions could access sensitive records or perform unauthorized operations, while uncontrolled model requests could create unexpected infrastructure costs or service disruptions.
Fix: Apply least-privilege access, establish token budgets and request limits, validate AI tool calls before execution, monitor unusual usage, and require human approval for sensitive operations
Backend APIs deserve special attention because the mobile client is only the front door. The OWASP API Security Top 10 covers vulnerabilities such as broken object-level authorization, broken authentication, unrestricted resource consumption, and security misconfiguration. These issues are especially important for AI endpoints that access sensitive information or incur costs per request.
A structured mobile application security review can help assess an application against relevant mobile, API, and AI security risks, identify vulnerabilities, and establish practical improvements before they become costly incidents.
What Real Incidents Teach Us
The cases below are documented. The last one is labeled hypothetical.
October 2026: attackers go after AI credentials
In October 2026, the Cloud Security Alliance documented several platforms that store customer secrets disclosing intrusions within about two weeks of each other, each exposing credentials for AI inference services. Its note lists Fireworks AI (October 9), OpenCode (October 17), and Railway (October 21), and says root causes, affected-user counts, and attribution remain undisclosed in several cases. Wiz has published its own analysis, Black October for AI Developer Platforms. The situation was still developing as of this writing.
The lesson: treat AI provider keys like payment credentials. Keep them server-side, scope and rotate them, and set spend limits and usage alerts.
Arup: a deepfake video call (2024)
Hong Kong police reported that a finance worker was deceived by a video conference in which the CFO and colleagues were deepfake recreations. He sent HK$200 million (about US$25.6 million) in 15 transactions. Arup later confirmed it was the victim and said fake voices and images were used, according to CNN’s report.
The lesson: a face or voice on a screen is no longer proof of identity. For apps that approve payments or recovery requests, require independent confirmation through a separate, pre-registered channel, with extra friction for unusual amounts or new payees.
DeepSeek’s iOS app: security basics skipped in a rush (2025)
After the app climbed the App Store charts, mobile security firm NowSecure assessed it and reported that it disabled Apple’s App Transport Security, sent some data without encryption, and stored data insecurely. Press coverage of the findings also cited outdated or weak encryption practices.
The lesson: these map directly onto OWASP’s insecure communication, insecure data storage, and cryptography categories. Hype cycles do not excuse skipping fundamentals, and users and enterprises increasingly check.
IBM’s 2025 data: AI adoption is outrunning governance
In its 2025 Cost of a Data Breach report, IBM found that 13% of organizations reported breaches of AI models or applications, and 97% of those said they lacked AI access controls. Of those incidents, 60% led to compromised data and 31% to operational disruption. IBM notes the number of AI-related breaches is small relative to its sample, and the research covers organizations broadly rather than mobile apps specifically.
The lesson: access control for AI systems is a basic gap, and it is fixable.
2026: Mobile apps are attacked within hours of release
Digital.ai’s 2026 Application Security Threat Report, published in May 2026 and based on telemetry collected in Q4 2025, found that 87% of the client-facing apps it monitors faced attacks, up from 55% in 2022. One enterprise customer saw hostile activity less than two hours after its app appeared in the store. The report also found iOS and Android attack rates had nearly converged (86% versus 89%), and that financial services apps were attacked at a 91% rate.
The lesson: treat store release as the start of the threat window, not the finish line. Harden the binary, protect the APIs behind it, and monitor from day one. Do not assume iOS is the safer platform.
2026: AI agents on phones create a new boundary
NowSecure’s October 2026 analysis describes a shift in how mobile apps are used. By its account, Apple’s iOS 27 lets Siri AI retrieve information and invoke actions inside apps without the user opening them, and Google’s Android AppFunctions follows a similar model. NowSecure reports that 24% of apps it tested from June to August 2026 had functionality potentially exposed to Siri AI and Apple Intelligence. Its 2026 survey also found that 95% of organizations say they deploy AI in mobile apps, while 37% do not monitor AI behavior in the apps they build. Both figures come from a mobile-security vendor’s own survey and testing, so read them as indicative rather than industry-wide.
Separately, an AI-security incident tracker lists CVE-2026-35394, reported in April 2026, in the open-source mobile-mcp tool. According to that listing, unvalidated URLs could trigger arbitrary Android intents, which means an AI agent workflow could be manipulated into actions such as starting calls or app installs.
The lesson: when an agent can call your app’s functions, every exposed action needs its own authentication, validation, and user-confirmation rules. Test complete workflows, not just individual screens.
2025: Tea, a misconfigured backend holding identity documents
In July 2025, the US-based dating-safety app Tea confirmed a breach affecting users who signed up before February 2024. Users on 4chan found a publicly accessible Firebase storage bucket, and Tea confirmed unauthorized access to a legacy database holding about 72,000 images, including 13,000 selfies and ID photos, according to Fox News. Independent researchers then showed that roughly 1.1 million direct messages were exposed as well. This was a configuration failure, not an AI attack.
It matters here because of what was exposed. Verification selfies and ID documents are exactly the raw material that makes synthetic-identity and deepfake fraud easier. That connection is our analysis, not a finding reported in the Tea coverage.
The lesson: lock down cloud storage by default, retire legacy buckets, and avoid keeping identity documents longer than needed.
Hypothetical scenario (illustrative only, not a real case)
Imagine a banking app that lets customers reset a password with a selfie. An attacker collects a customer’s public photos and videos and builds a synthetic face. If the app relies on a simple liveness check, with no device binding or behavioral signals, the reset might succeed. Layered verification (device trust, behavioral risk scoring, and a step-up check for high-risk actions) is what breaks this chain.
AI Cybersecurity on the Defensive Side: Strengths and Limits
The same technology that helps attackers is also a real advantage for defenders, when it is used with care.
Where it helps. Behavioral analytics can spot an unusual login, a new device, or a transaction pattern that does not fit the account holder. Risk-based authentication can then add friction only when behavior looks suspicious, keeping ordinary use smooth. Automation can revoke sessions or isolate accounts in seconds. IBM reported that organizations using AI and automation extensively in security operations saved an average of US$1.9 million in breach costs and shortened the breach lifecycle by about 80 days.
Where it falls short. False positives frustrate real customers and overload analysts. Models can be evaded or poisoned by determined attackers. Automated lockouts need human review paths. And AI cannot compensate for missing fundamentals: an app with exposed APIs and unpatched dependencies is not saved by a smarter detector.
The honest conclusion is that neither side holds a permanent advantage. What matters is investing in layered, continuously tested defenses, rather than betting on one tool.
Mobile Data Protection: A Practical Playbook
These actions are grouped by who owns them, so teams can assign them.’
For developers and engineering teams
- Threat-model every AI feature before building it. Ask what data goes in, what comes out, who can call it, and what happens if it is manipulated.
- Never ship secrets in the app. Route calls to AI providers through your backend, which holds the keys and enforces limits.
- Treat model output as untrusted input. Validate it before it triggers actions, and give AI features the least privilege possible.
- Defend against prompt injection. Separate instructions from user content, restrict which tools or data a model can reach, and filter sensitive output.
- Rate-limit and monitor AI endpoints to prevent abuse, scraping, and runaway costs.
- Redact sensitive data from prompts, logs, and analytics, and set retention limits.
- Strengthen identity checks. Combine liveness detection with device binding and behavioral signals, and add step-up verification for high-risk actions.
- Automate security in CI/CD with dependency scanning, secrets detection, and static and dynamic analysis, followed by manual penetration testing before major releases. A dedicated security testing and QA process makes this routine rather than a last-minute scramble.
- Verify against standards. Use OWASP MASVS for mobile apps, the NIST AI Risk Management Framework for AI governance, and CISA’s secure-by-design guidance.
Two additions from the 2025–2026 incidents: audit every action your app exposes to assistants or agents, with confirmation for high-risk ones; and audit cloud storage and backend rules before each release, because misconfigurations like Tea’s remain a leading cause of exposure.
For business and product leaders
- Inventory your AI. List every AI feature, vendor, and data flow, including tools employees adopted on their own. IBM’s shadow-AI findings show why.
- Write an AI governance policy. IBM found that 63% of breached organizations either lacked one or were still developing it.
- Require out-of-band approval for payments and sensitive changes. The Arup case shows that a convincing call is not authorization.
- Train for AI-era social engineering. Include deepfake and voice-clone scenarios in staff exercises.
- Rehearse incident response. Assign owners, prepare customer and regulator communications, and run a tabletop exercise at least once a year.
- Make a vulnerability disclosure channel public, so researchers can report issues before attackers exploit them.
- Budget for security after launch, not only before it. Threats and dependencies keep changing.
Making Security Part of How You Build
A checklist only works if someone owns it. The teams that stay ahead tend to share three habits.
- Security-first planning. Security requirements sit in the backlog next to features, and a feature is not done until its threat model and tests are.
- DevSecOps in the pipeline. Automated checks run on every build, so fixes are cheap and fast instead of discovered in production.
- Transparency with customers. Clear privacy notices, minimal data collection, and prompt breach communication build the trust that AI features depend on.
Organizations building intelligent products need partners and teams who combine software engineering, AI, and delivery discipline. Agile Stormers works across application development, software development, digital transformation, and security is most effective when it is built into that work from the first sprint, not added at the end.
The Future of AI in Mobile App Security
Several shifts are already visible.
- Passkeys and passwordless login reduce phishing exposure, but raise the bar for liveness and deepfake resistance in recovery flows.
- Zero Trust thinking, where every request is verified regardless of device or network, is becoming the default for sensitive apps.
- Adaptive, risk-based security will adjust authentication strength in real time as signals change.
- Privacy-preserving AI, such as on-device inference, keeps raw data closer to the user and reduces what a breach can expose.
- Regulation is tightening in the US through a patchwork of rules. The FTC polices unfair or deceptive data practices, states such as California have comprehensive privacy laws, financial and health apps face sector rules such as GLBA and HIPAA, and FinCEN has issued guidance on deepfake-enabled fraud. Expect more scrutiny of AI governance and incident reporting.
- Securing the AI supply chain, meaning models, datasets, and third-party AI services, is becoming a standard engineering discipline.
Agentic mobile platforms are the newest frontier. With iOS 27’s Siri AI and Android AppFunctions, as NowSecure describes them, apps expose actions to on-device agents. Security reviews will increasingly need to cover what agents can discover, how they chain actions, and which steps require user confirmation.
To prepare, map where AI touches your app, assess each point against OWASP and NIST guidance, and invest in monitoring before an incident forces the issue.
Innovation Must Go Hand in Hand with Security
The Arup employee did not fail because he was careless. He failed because the technology made deception effortless and the process trusted what it saw.
That is the lesson for everyone building with AI. Every intelligent feature you ship is a promise to users that their data and identity are in careful hands. AI makes that promise easier to make and harder to keep.
The answer is not to slow innovation. It is to pair it with discipline: fix the fundamentals, secure the AI components, verify identity with more than a face or a voice, and keep testing. AI in mobile app security will be won by teams that treat protection as part of the product, not a patch on top of it.
The next wave of mobile apps will not be judged by who added AI first. They will be judged by whose users still trust them a year later. If you are planning an AI-enabled mobile product, explore Agile Stormers’ Digital Transformation Services to start that conversation.
Frequently Asked Questions
How is AI changing mobile app security?
It is changing both sides. Defenders use AI for anomaly detection, fraud scoring, and faster response. Attackers use it for convincing phishing, impersonation, and automation. AI features also add new targets, such as prompts, model endpoints, and AI supply chains.
What are the biggest cybersecurity threats to mobile applications?
The OWASP Mobile Top 10 (2024) highlights improper credential usage, inadequate supply chain security, insecure authentication and authorization, insecure communication, and insecure data storage, among others. Phishing and account takeover remain major real-world entry points.
Can AI-powered cyberattacks compromise mobile apps?
Yes, mostly by making existing attacks more effective rather than by inventing new ones. AI improves phishing, enables impersonation, and speeds up probing of weak authentication and APIs. Apps with sound fundamentals are much harder targets.
How can developers protect AI-powered mobile applications?
Start with strong authentication, encryption, and secure APIs. Then add AI-specific controls: keep provider keys on the server, treat model output as untrusted, defend against prompt injection, redact sensitive data, and rate-limit AI endpoints. Test regularly and monitor continuously.
What is the future of AI in mobile cybersecurity?
Expect wider use of passkeys, risk-based authentication, Zero Trust, and privacy-preserving AI, alongside tighter regulation. Defenders will rely more on AI, but human oversight and solid engineering will stay essential.
