Coding agents become first-class in Android Studio, Xcode and VS Code
Android Studio, Xcode 27, Copilot in VS Code and Cursor all added agent features in September 2026. What changed, and how to set up review and CI gates.
In September 2026, the IDEs that mobile developers depend on started treating coding agents as part of the toolchain. Xcode 27 shipped on September 14 with coding agents "powered by the model of your choice", and Android Studio began rolling out Bring Your Own Agent in preview on September 24. In the same month, GitHub Copilot in VS Code and Cursor added ways for agents to open pull requests, run on a schedule and delegate to subagents. If you already use a coding agent, you can now bring it into the IDE where your build, previews and emulator live.
What shipped
Android Studio
On September 24, 2026, Google started rolling out "Bring Your Own Agent" in preview, beginning with the canary release of Android Studio Rabbit 2. It supports "Google Antigravity, Claude Agent, and Codex".
The integration is the interesting part. Android Studio passes the full project graph and build setup to the agent "using Agent Client Protocol (ACP)". It also wires up build diagnostics, Compose Previews, SDK tools and emulator control, so the agent works with the same signals you see in the IDE.
Xcode 27
Xcode 27, released on September 14, adds "coding agents in Xcode, powered by the model of your choice". One concrete use on Apple's list is agent-driven localization of string catalogs.
GitHub Copilot in VS Code
Copilot in VS Code shipped versions 1.136 through 1.140 during September. The Agents window gained scheduled automations that run hourly, daily or weekly, and "agent merge", which handles review feedback, failed checks and merge conflicts. Both are in preview. From the same window, you can open a pull request "from a Copilot, Claude, or Codex agent session".
Cursor
Cursor added self-hosted machines for tool execution on September 2. On September 10 it added Projects, where a coordinator agent plans the work and delegates to subagents in the cloud. On September 23 it added the Rollouts and Security Review bots.
Framework vendors
Frameworks now ship context for agents as well. Next.js 16.3 (August 3) writes a version-matched AGENTS.md block, and Dart's Skills CLI 1.0 (September 8) bundles AI agent skills with pub packages. Expo shipped a connector for the Claude desktop app, "Connect Expo in Claude", on August 13.
What it means for your app
The first change is fewer context switches. Native IDEs now plug into the agent you already use, so you no longer need to jump between Claude Code and Android Studio or Xcode to get build and emulator context. On Android, ACP is the piece that makes this work.
On iOS, the most immediately useful feature for many teams is agent-driven localization of string catalogs. If your app ships in more than one language, it can take a slow, manual step out of each release. Treat the output like any other translation, and have a native speaker review it before it ships.
The second change is where review happens. With scheduled automations and agent merge, an agent can start work, respond to review comments and resolve conflicts with less human involvement. That moves the burden of safety to the gates around the merge: required checks, branch protection, and the rules for who may approve.
The third change is security scope. Agents now hold credentials and run tools on developer machines, and with Cursor's self-hosted machines, on your own infrastructure. In August, the ChainDrop npm worm stole AI-tool credentials (.claude, .cursor, .openai) and planted re-infection hooks in .claude/settings.json and .vscode/tasks.json, according to StepSecurity. Agent configuration is already something attackers target.
Finally, if you publish libraries or project templates, agent-facing context is becoming part of the package. Next.js and Dart already ship it, and teams that maintain internal libraries can do the same with an AGENTS.md file.
Setup checklist
- Choose one primary agent for the team, and check that it works in the IDEs you use: Xcode 27 for iOS, and the Android Studio Rabbit 2 canary for Android.
- Because Bring Your Own Agent is a preview on a canary build, run it in a separate Android Studio install and on a test project first.
- Watch how the agent uses build diagnostics and emulator control before you point it at client code.
- Turn on branch protection and required checks before you enable Copilot's agent merge or any agent that can open pull requests.
- Limit scheduled automations to low-risk jobs, such as dependency reports or lint fixes, until you trust their output.
- If you use Cursor's self-hosted machines, give them scoped credentials and no access to production secrets.
- Review changes to
.claude/settings.json,.vscode/tasks.jsonand similar agent or editor config in code review, the same way you review CI workflows. - Add an
AGENTS.mdto your own templates and internal libraries that tells agents how to build, test and run the project.
My take
I like the direction. Bring Your Own Agent over ACP is a good design for developers who already have a preferred agent, because it keeps the choice of model separate from the IDE. Xcode's "model of your choice" points the same way, and that gives mobile teams room to standardize on one agent across iOS and Android work.
The risk is speed without gates. Agent merge, scheduled automations and cloud subagents can produce more pull requests than a small team can review well. My recommendation is to let agents propose anything and merge nothing that has not passed the same checks and human approval a teammate's change would need.
Treat agent configuration files as code. Attackers already do, and a hook in a settings file can run with the access of the developer who opened the project.