Google Play opens up private apps built with vibe coding

On Tuesday, October 13, Google announced a change to Google Play: ordinary people can now build Android apps with vibe coding and run them on their own phones, without a developer account. TechCrunch and Bloomberg covered the news first, and other outlets followed.

The idea is simple. You describe what you want in natural language, build the app in Google AI Studio, and install it from the Play Store on your own device. The app sits in a private listing that only its creator can see.

Quick summary

Apps built in Google AI Studio can be published as private Play Store listings without a developer account. They don't appear in search or recommendations. The feature starts in the United States for users 18 and older, and Google says more sharing options are coming in the months ahead.

What Google announced

According to the coverage, the feature works like this:

Who can use it: anyone with a Google account who is 18 or older. At launch it's limited to the United States and some other selected markets, which Google hasn't fully listed in every report.
Where the app is built: in Google AI Studio, Google's AI development platform.
Where it lives: in a private library in the Play Store, separate from the public catalog. It doesn't show up in search or listings, and only the creator can access it.
Rules: private apps must still follow existing Google Play policies. Google says AI Studio has built-in security checks meant to keep harmful or inappropriate content out of apps.
Limits: the feature doesn't work with Antigravity, Google's other AI development platform. One source also says there are limits on the in-app services these developers can charge for.

Sam Bright, vice president and general manager of Google Play, described the shift as moving from "there's an app for that" to "there's an app for me." The quote captures the intent: the app stops being a product built for millions of users and becomes something made for one person.

What comes next

Google plans to let creators share their apps with a small group of trusted people. If an app becomes popular, it could move to public distribution. That step would require a developer account and a Trust and Safety review.

One outlet reports a $25 registration fee for that developer account, but I couldn't confirm the amount in a second source, so check it before relying on it.

What's still unclear

The coverage leaves some questions open:

When the feature reaches Brazil and other countries.
How large the "trusted group" can be, and how sharing will be controlled.
How the security review works when an app moves to public distribution.

I also didn't find expert analysis of sideloading or malware risk tied to this feature. What exists are user opinions, such as the discussion on Hacker News, which isn't a substitute for a technical assessment.

Why it matters

The change removes an old barrier. To publish an Android app, you needed a developer account, programming knowledge, and patience with store review. With vibe coding, someone who doesn't write code can describe what they want and test the idea on their own phone.

That has a clear upside. Small personal apps, like a shopping list, a habit tracker, or a calculator for one specific task, become reachable for people who have never written code.

It also raises a question: who reviews the code the AI generates for these users? The coverage itself notes that these apps are written by AI agents, not engineers. Google says its safety and security guidelines will be enforced more strictly in professional review, when an app reaches more people.

The risk is real, even for small apps

Security problems in AI-built apps aren't hypothetical. One developer who reviewed 20 AI-built apps on the Play Store reported security problems in seven of them. Four shipped secrets inside the app, including a Google Cloud private key. That's one case, not a measure of the whole ecosystem, but it shows the pattern.

Broader research points the same way. A Veracode study found that AI models have become much better at producing working code over three years, but the security of that code hasn't generally improved. SecurityWeek also covers vibe-coded apps with exploitable flaws. Most of that research looks at web apps, so it's indirect evidence for Android, not proof.

The most common mistakes fall into four areas: authentication, database permissions, secrets stored in code, and input validation. Someone who doesn't understand these can expose their own data, and other people's, without noticing.

If you build apps with vibe coding

A few simple habits help, even for a personal app:

Never put API keys, passwords, or certificates in the code. Use environment variables or the platform's secret store.
Check database access rules before you publish, not after.
Ask the AI to explain its authentication code, then verify what it did.
Test with fake data before using real information.