NowSecure Launches AI-Native App Testing; Ethics Research Focuses on AI "Ghosts"

Mobile app security leader NowSecure has introduced a set of artificial intelligence-native features for its testing platform, including a chat assistant, a Model Context Protocol (MCP) server, and new detection for vulnerabilities specific to AI-powered mobile apps. The additions target a fast-moving problem: NowSecure's 2026 Mobile App Risk Management Survey found that 95% of organizations already run AI inside their mobile apps, yet 37% said they cannot fully see what that AI is doing.

The new AI Chat lets security teams ask plain-language questions about their app portfolio, with answers grounded in binary analysis and runtime data pulled from real devices. The MCP server and an expanded API open NowSecure's mobile risk knowledge graph to outside software, allowing engineering teams to feed findings, testing methods, remediation guidance, and compliance mappings into their own AI agents and DevSecOps pipelines. NowSecure is also advancing AI Navigator, its tool for automatic app exploration and triage, and adding detection aimed at AI-specific exposures such as opaque data flows, shifting identity models, and widening supply-chain risk. The company's testing of 50,000 mobile apps found that 53% contain AI components, many of which slip past conventional app review. NowSecure CEO Alan Snyder framed the update as a way to automate testing without giving up the visibility teams need to make sound risk decisions, noting that AI is "reshaping both mobile development speed and app risk".

Simultaneously, new behavioral research published by scientists at the University of Colorado Boulder highlights a rapid consumer surge in conversational AI "ghosts"—sometimes called "griefbots" or "deathbots"—prompting calls for standardized ethical guardrails around post-mortem digital personas. The study, published in the Proceedings of the 2026 Designing Interactive Systems Conference, offers the first scientific glimpse at how people use "generative ghosts," AI agents trained on data about the dead. Platforms like Project December and Séance AI use journal entries, social media posts, and texts from the deceased to train text-based ghosts for surviving loved ones to chat with.

In their inaugural study, the research team recruited 16 people who had lost a close relative or friend. Participants chatted with two iterations of an AI ghost—one speaking in first person ("reincarnation") and another using third person ("representation"). Subsequent interviews found that participants overwhelmingly preferred the first-person ghost. The more accurate and life-like the ghost's emotional tone, dialect, and conversational rhythm, the better. While people seemed willing to overlook occasional AI inaccuracies, they cringed if the bot used the wrong term of endearment. When asked if they would use the technology again, everyone said yes—but some feared they would become overly reliant on it. "We anticipate that within our lifetimes it may become common practice for people to create custom AI agents to interact with loved ones and the broader world after their death," said Jed Brubaker, an associate professor of information science and senior author of the study.

In daily business operations, software engineering teams are no longer performing manual code vulnerability sweeps. Instead, autonomous AI auditors continuously analyze mobile apps on actual hardware devices, catching data leakages and rogue model behaviors before apps hit consumer app stores. NowSecure's platform lets teams automate testing and fixes while keeping the human approval steps that regulated environments require. As AI ghosts become a commercial reality, the CU Boulder research provides the first empirical foundation for designing these systems with ethical guardrails—recognizing both their potential to help grieving individuals and their risk of emotional over-reliance. July 2026 marks a decisive shift in both mobile app security and AI ethics. The era of manual code audits and unregulated AI personas is ending. The era of AI-native security testing and evidence-based ethical frameworks for generative ghosts is already here.