pKVM

Android 17 is set to introduce AISeal, a new hardware-isolated sandbox built on protected kernel virtual machines (pKVM). The feature is designed to run AI workloads and automation tasks in a secure environment separated from the main operating system, limiting the risk that sensitive data or system processes are exposed. Developers are discussing what the change means for mobile AI apps and on-device security.

Android 17 introduces AISeal, a hardware-isolated sandbox built on protected kernel virtual machines (pKVM) that runs AI tasks entirely on-device, keeping automation data local rather than in the cloud. The catch: it requires advanced memory and NPU allocations found only in premium hardware, limiting the feature to high-end devices at launch.