DIGITAL LIFE

AI applications and the hidden danger of smartphone permissions

Every time you install a new application, your smartphone presents a series of access requests that most users accept without reading. ESET, Europe's largest cybersecurity company, issued a warning on March 19, 2026, about the real and growing risks associated with this practice, with particular emphasis on AI apps (Artificial Intelligence applications). The habit of clicking "allow" without evaluating the implications can expose banking credentials, real-time location, and screen content to third parties without the user's knowledge.

Whenever a new application is installed or a feature is activated, the operating system presents a permission request. This mechanism acts as an "invisible sentinel" that regulates access to device data and resources — but its effectiveness depends entirely on the user's attention. While some permissions are essential for the functioning of applications, others are excessive or serve purposes that have nothing to do with the stated usefulness of the tool. One of the most sophisticated attack vectors exploited by malicious applications is the use of overlay permissions to execute clickjacking techniques. In this scenario, the user believes they are interacting with legitimate interface buttons, but in reality, they are clicking on invisible elements that authorize actions in the background. This tactic subverts the operating system's security mechanisms and facilitates the installation of malware without raising immediate suspicion.

AI applications as a new risk vector...The proliferation of Artificial Intelligence-based applications has introduced a new layer of risk to digital privacy. Many of these tools request permanent access to the microphone, contact list, and even the content visible on the device's screen. This continuous collection allows for the creation of detailed business profiles and exposes confidential information in case of interception or data leakage.

Health and fitness applications represent a similar risk, collecting biometric data with potential real-world impacts, such as sharing with insurance companies or third-party entities. In both cases, the user grants permissions voluntarily, convinced that they are interacting with a trustworthy application. Accessibility as an attack vector...Originally designed to support users with motor or visual limitations, accessibility services offer almost total control over the smartphone. When this permission is granted to an untrusted application, attackers can intercept SMS authentication codes and monitor all interactions performed on the device. This is often the central mechanism used by spyware and ransomware to steal banking credentials and demand financial ransoms.

Managing app permissions safely...Before allowing or blocking, always consider if a permission is necessary for the app in question to do its job.Another good rule of thumb is to only “allow once” or “while using.” Only safety apps like “Find My” should really have access 24/7/365.

You should be asked to review your permissions regularly with many apps. But it may be a good idea to proactively audit permissions. Here’s how:

iOS...Go to Settings > Privacy & Security.

Scroll to the bottom and tap (or turn on) App Privacy Report.

This shows you which apps accessed your data and when.

Alternatively:

Go to Settings > Apps.

Select a specific app (e.g., Instagram).

You will see a list of all toggles (Camera, Mic, Contacts). Turn off anything that isn't essential.

Android...Go to Settings > Security & Privacy > Privacy > Privacy Dashboard.

Tap on 7-Day View (top right menu) to see a timeline of every app that used your sensors over the last week. (These steps may not be the same across all Android-powered devices, so do check.)

If you see an app using the microphone at 3:00 AM, tap it to revoke access immediately.

Alternatively (navigation paths still vary across Android skins):

Go to Settings > Apps > [App Name].

Ensure "Manage app if unused" (or "Pause app activity if unused") is toggled ON.

If you don't use the app for a few months, Android will automatically strip its permissions, delete temporary files, and stop notifications.

Above all, only ever download apps from legitimate stores (Google Play/App Store). Read their reviews first before deciding whether to do so. Consider installing a mobile security solution from a reputable security provider.

Permission risk levels...The assessment of the danger associated with each permission depends on the application's context and its potential for abuse:

Permission--Risk level--Security impact(below):

-Screen overlay--Critical--Allows clickjacking and interaction with invisible elements

-Accessibility services--Critical--Grants total control and interception of SMS authentication

-Microphone and camera--High--Enables active listening and remote activation

-Background location--Medium/High--Allows continuous physical tracking and routine profiling

-SMS and call logs--High--Exposes security codes and two-factor authentication

Risk mitigation strategies...The most effective defense requires regular auditing of granted access through the privacy settings available on both Android and iOS. Ricardo Neves, Head of Marketing and Communication at ESET Portugal, recommends applying the principle of least privilege: “before accepting any permission, users should question whether this authorization is truly necessary for the application to function.”

Fundamental best practices include (below):

-Downloading apps only from official stores

-Reading reviews and comments from other users before installation

-Revoking unnecessary permissions after installation

-Selecting “allow only during use” or “only once” whenever possible

-Regularly updating the operating system and installed applications

-Using antimalware solutions from recognized vendors

Key highlights(below):

-AI applications are increasingly requesting permanent access to the microphone, contacts, and screen content.

-Overlay permissions allow clickjacking — the user clicks on invisible elements without knowing.

-Accessibility services, when granted to malicious apps, allow total control of the device.

-Background location allows continuous physical tracking without active user interaction.

-Regular review of permissions on iOS and Android is the main line of individual defense.

mundophone