On the evening of October 13, StepX Terminal (阶跃终端) opened pre-orders for the STEPX Neo Pioneer Edition — the world's first commercially available smartphone built around an agent-native operating system — at ¥3,999 (approximately $597 USD). The first sales event is set for October 16 at 10:13 AM CST.

What makes the STEPX Neo different from every AI phone already on shelves is not the price, the chip, or the rear MiniLED matrix display — it is what runs the device's core: the Model Context Protocol (MCP), a standard that the NSA's AI Security Center and the Cloud Security Alliance both flagged in 2026 for critical, unresolved security vulnerabilities. That protocol now sits at the OS level of a consumer smartphone made by a company operating under China's National Intelligence Law, which legally requires any Chinese organization to cooperate with state intelligence agencies on demand.

Not Another AI Overlay — a Rebuilt OS Architecture

Most smartphones sold as "AI phones" in 2026 — including Samsung, Xiaomi, and Huawei flagships — run large-language-model capabilities as privileged apps or system services layered atop a conventional Android stack. When an AI agent attempts a multi-step task on such a device, it must simulate human finger taps through screen-recognition and accessibility APIs — a brittle chain that fails the moment a button moves or a permission dialog interrupts.

StepX Terminal argues this architecture is the wrong foundation for autonomous agents. Step AOS 1.0, released alongside the STEPX Neo, is not an Android fork or a launcher replacement. According to StepFun, it was rebuilt from re-engineered components of Android, Linux, and RTOS into a system where the personal agent — called Step Amoo, nicknamed "A-zai" — is a first-class OS process, not a floating overlay. Amoo can invoke device capabilities through native tool calls that bypass the graphical layer entirely. That architectural choice is the STEPX Neo's legitimate claim to novelty — and also the source of its biggest risk, because the protocol powering those tool calls has a documented security problem.

Step AOS: How the MCP Atomic Capability Engine Works

The operational core of Step AOS is what StepFun calls an atomic capability engine: a layer that splits every device function into four groups — communication, apps, files, and system tools — and exposes each as a callable endpoint using MCP. MCP, originally created by Anthropic as an open standard for connecting AI models to external tools, functions as a universal adapter: any tool or service that implements the MCP specification can be invoked by any MCP-compatible agent without custom integration code.

On the STEPX Neo, this means Amoo does not send text to a message app and wait for a human to send it. It calls the "send message" tool endpoint directly, in the same way a developer's script would call an API. The same applies to payments via Alipay, ride bookings via Didi, and food orders via Meituan — all 300-plus Alipay services and a roster of major Chinese apps are pre-integrated as MCP tool endpoints. Alongside MCP, StepFun has built a proprietary agent-to-agent layer called H2A2A (Human-to-Agent-to-Agent), which lets partner apps expose specialized sub-agents to Amoo — delegating a slice of their service logic to the on-device orchestrator.

Above the atomic capability engine, Step AOS runs:

• A Natural User Interface (NUI) layer that accepts voice and visual input, with 6 microphones and a low-power audio chip running Whisper 1.0 for wake-word and dictation
• A two-domain memory system separating user personal data from agent working memory, running through a capture-understand-retain pipeline
• A tiered decision layer routing simple requests to the on-device Step Edge model and escalating complex reasoning to StepFun's cloud models
• Loop execution, which lets Amoo run multi-step task chains autonomously, surfacing for user confirmation only at high-risk nodes: payments, file deletions, and cross-app writes

A persistent bottom-panel task navigator displays every active and queued task in real time. On the device's rear panel, a small secondary MiniLED matrix displays the agent's state — thinking, tool call, output — as it cycles through live tasks, making the agent's activity visible to anyone who glances at the phone's back.

MCP Protocol at the Core — and the NSA Already Has Concerns

The decision to build Step AOS's capability engine around MCP is technically coherent — MCP is the closest thing the AI industry has to a universal tool-call standard, with more than 150 million downloads of MCP-compatible software by mid-2026. It is also the decision that poses the greatest risk for STEPX Neo buyers, because MCP's security model has been under documented fire from multiple major institutions in 2026.

In a guidance document published in May 2026, the NSA's AI Security Center warned enterprises that MCP's "adoption has outpaced the protocol's security model," identifying weak access controls, insufficient approval workflows, open-ended serialization, limited audit logging, and problematic token lifecycle management as unaddressed gaps. The NSA's concern is not theoretical: the protocol was designed initially for developer environments, and its STDIO transport mechanism has no built-in authentication.

The Cloud Security Alliance's AI Safety Initiative published a detailed whitepaper in May 2026 naming three vulnerability classes that MCP deployments systematically underweight:

Tool poisoning: A malicious or compromised MCP server can embed hidden instructions in its tool descriptions—text the AI model reads as legitimate operational context but that secretly redirects the agent's behavior. In September 2025, an unofficial Postmark MCP server with approximately 1,500 weekly downloads was modified after marketplace approval to silently BCC every outgoing email to an attacker-controlled address. The user saw no indication that their email had been copied.

The confused deputy problem: When an MCP client is given broad access to multiple servers simultaneously, a compromised server can instruct the agent to use capabilities granted by a different, legitimate server — effectively borrowing permissions it was never granted.

Supply chain compromise: The CSA found that when scanning 67,057 MCP servers, 833 were enabling agent hijacking and 18 showed active tool poisoning attacks at the time of scanning. OWASP's MCP Top 10, published in 2025, rated tool poisoning at a DREAD score of 46.5 out of 50 — meaning the impact, exploitability, and affected user base all ranked at near-maximum severity.

Two critical CVEs affecting MCP infrastructure were disclosed in 2025 and early 2026. CVE-2025-6514 carries a CVSS score of 9.6 and describes an OS command injection flaw in the mcp-remote npm package — downloaded more than 437,000 times — that allows a malicious MCP server to achieve remote code execution on client devices. CVE-2025-49596 (CVSS 9.4) is an unauthenticated RCE flaw in MCP Inspector.

On the STEPX Neo, these vulnerabilities are not abstract developer concerns. Every community-contributed Skill or Agent in the STEPX marketplace is, by design, an MCP-connected endpoint. StepFun's supply-chain controls — blocking packages that contain .env files or API keys — address only the most obvious exfiltration patterns. They do not address tool poisoning via hidden instructions in tool descriptions, which is architecturally difficult to detect at the protocol layer.

China's National Intelligence Law Follows Every Byte

StepFun (阶跃星辰) is headquartered in Shanghai and incorporated under Chinese law. Its principal investors include Tencent, Qiming Venture Partners, and Shanghai State-owned Capital Investment, a state-linked entity. Under three interlocking pieces of Chinese legislation, StepFun and StepX Terminal are legally required to cooperate with Chinese government intelligence requests.

China's National Intelligence Law (2017), Article 7 states: "Any organization or citizen shall support, assist, and cooperate with state intelligence work in accordance with the law." Article 14 grants intelligence agencies the legal right to ask any organization or citizen to provide "necessary support, assistance and cooperation." This obligation applies to StepFun regardless of where its servers are physically located, regardless of what its privacy policy says, and regardless of whether any specific data has yet been requested.

The Data Security Law (2021) gives Chinese government bodies the authority to access data from Chinese companies during national security reviews, and requires companies to fulfill data provision obligations under applicable Chinese law. The Cybersecurity Law (2017) requires critical information infrastructure operators to store personal information and important data within Chinese territory.

The STEPX Neo, by design, collects the following categories of data:

• Voice input (6-microphone array, continuous wake-word monitoring)
• Long-term behavioral patterns (memory pipeline: capture, understand, retain)
• Cross-app transaction data (Alipay payments, Didi locations, Meituan orders, JD.com purchases)
• Real-time location data (via Amap/AutoNavi and Didi integrations)
• Task execution logs (Amoo's audit panel)
• Community marketplace behavioral data (phone-number-linked identity verification required for every publisher)

StepFun's "Trusted" security property states that personal data is "de-identified before cloud upload" and that precise geolocation and sensitive camera feeds require explicit permission before being exposed to model calls. These are company assertions. No independent security audit of Step AOS, Step Edge, or the STEPX Neo's data handling has been published as of October 14, 2026.

Practical steps for consumers: No mitigation fully eliminates the structural legal risk created by operating a device under this legal framework. Consumers who proceed with a STEPX Neo purchase can partially limit their exposure by: reviewing all installed community Skills and Agents before granting them broad permissions; using the audit panel to monitor logged tool calls; avoiding using the device for communications or transactions they consider sensitive; and not granting blanket file access to Skills from unverified publishers. Network segmentation — a common mitigation for IoT devices — is not practical for a primary smartphone.

Who Leads StepFun: Yin Qi's Background at Megvii

StepFun's chairman is Yin Qi, who joined the company after its ¥5 billion (approximately $747 million USD at current rates) Series B+ funding round. Yin Qi is the co-founder and former CEO of Megvii (旷视科技), one of China's largest facial recognition AI companies.

In October 2019, the United States Department of Commerce placed Megvii on the Entity List, restricting US companies from exporting technology to it without a license, citing the company's alleged role in enabling the surveillance of Uyghurs and other Muslim minorities in Xinjiang. In December 2021, the US Treasury Department prohibited US persons from investing in Megvii under investment restrictions targeting Chinese surveillance-technology companies. In January 2024, the Department of Defense added Megvii to its list of "Chinese Military Companies."

Yin Qi has not been personally charged with any wrongdoing; the US designations apply to Megvii as a company. However, his background as the founder and CEO of a US-sanctioned facial recognition company is directly relevant context for any consumer evaluating whether to grant an AI agent OS-level access to their smartphone — including access to camera feeds, location data, and biometric voice recognition.

First to Ship — but Not the Only to Claim It

StepX Terminal's "world's first" claim for the STEPX Neo requires a qualifier. At the World Artificial Intelligence Conference (WAIC 2026) in Shanghai (July 17–20), at least two other Chinese companies previewed devices with comparable "agentic phone" claims.

Nubia, in partnership with ByteDance's Doubao AI, unveiled the NaviX Ultra and described it as the "world's first mass-produced AI agent phone." Honor showed off its RobotPhone concept, which pairs a physical motorized gimbal camera with an agentic mobile OS. Neither the NaviX Ultra nor the Honor RobotPhone has commercially launched as of October 14, 2026. The STEPX Neo's genuine claim is narrower and more accurate: it is the first agent-native smartphone to open pre-orders and commit to an actual sales date. StepFun beat both rivals to a commercial starting line, which is a meaningful distinction — but readers should know that the "world's first" framing was a competitive claim made by three companies at the same conference before any of them had shipped.

The STEPX Neo received China's inaugural L3 AI Terminal Intelligence Classification — the highest tier of China's national AI terminal certification — and was named WAIC 2026's "Treasure of the Hall" award recipient.

Benchmark Claims Without Named Benchmarks

Step Edge — StepFun's on-device foundation model, optimized for the Snapdragon 8-series processor's compute constraints — is described in company materials as leading "comparable edge models across 29 benchmarks." StepFun has not named the 29 benchmarks it references, the benchmark suite it used, the test conditions applied, or whether any third party has replicated the results.

Self-reported benchmark leadership is a common practice in the AI industry and a well-documented reliability problem. The AI benchmarking literature describes widespread issues with overfitting to benchmark datasets, cherry-picked test conditions, and selective disclosure of favorable results. For any purchasing decision that rests on Step Edge's performance relative to competitors — including decisions about which tasks to trust the agent with unsupervised — independent replication of StepFun's claimed benchmark results does not yet exist.

Ecosystem Gaps and Operational Friction

An agent-native OS running 300-plus Alipay services and integrations for Didi, Meituan, Ctrip, JD.com, Baidu, Weibo, WPS, CapCut, and Amap (AutoNavi Maps) is a compelling capability demonstration for users in mainland China who rely on those services daily. For users outside China, the practical value picture looks significantly different.

The STEPX Neo has no announced international release date, price, or carrier availability. Its pre-integrated ecosystem is built around Chinese apps; international equivalents are not part of the launch roster. StepFun's developer documentation and Step Studio tools are currently in Chinese; English documentation has not been confirmed at launch.

The H2A2A protocol — StepFun's proprietary agent-to-agent standard — is a closed system. No independent security analysis of H2A2A's design has been published. Developers building on it depend on StepFun's continued support and compatibility maintenance, a constraint that creates operational risk for enterprise use cases.

An Alibaba executive speaking at WAIC 2026 noted that "an agentic OS cannot be built by any single company alone" and called for open ecosystem standards. The implicit critique of proprietary agentic protocols applies to H2A2A specifically.

The STEPX Token Plan — twelve consecutive months of 10 billion model tokens per month bundled with the device purchase — addresses the unpredictable per-query billing problem for consumer agent loops. StepX Terminal has not disclosed what happens to token access or pricing when the twelve-month plan expires. Buyers who build workflows around Amoo's continuous agent capabilities are committing to a device whose post-year-one cost of use has not been stated.

Hardware, Price, and What Comes With It

The STEPX Neo Pioneer Edition ships in a single configuration:

• Snapdragon 8-series processor
• 16 GB RAM / 256 GB storage
• Secondary rear MiniLED matrix display (agent status visualization)
• AI hardware key (short press: text field; long press: voice dictation)
• Six-microphone array with low-power audio chip and Whisper 1.0 algorithm
• Price: ¥3,999 (approximately $597 USD)

The Amoo Growth Plan offers the first 10,000 users who complete a specified set of in-product tasks a "Starship Ticket": a five-year zero-cost upgrade voucher redeemable for any future STEPX terminal.

For developers, Step Studio provides an on-device and cloud-linked IDE for writing, testing, and deploying Skills, Agents, and native connectors. Completed builds are pushed directly to a paired STEPX Neo as installable packages for users logged into the same account. Every community Skill or Agent publisher must complete phone-number-linked identity verification before publishing — a supply-chain integrity measure that also creates a PRC-law-subject data record.

Decision Framework for Prospective Buyers

The STEPX Neo represents a genuine technical advance in smartphone architecture. An OS rebuilt from the ground up around an agentic runtime — not Android with a chatbot — is the right direction for consumer AI phones, and StepFun is the first company to ship one commercially. The MCP integration, the Loop execution model, and the hardware/software price bundling are all coherent engineering decisions.

Against that: the protocol powering the OS core carries documented critical vulnerabilities (NSA-flagged, CSA-documented, CVSS-9.6 CVEs in the ecosystem) that have not been independently resolved. The device is made by a company legally bound to cooperate with Chinese state intelligence requests for any data it holds.

Its chairman built one of China's most prominent facial recognition companies before it was placed on the US Entity List and the DoD Chinese Military Company list. Its benchmark claims are self-reported and unverifiable. Its post-purchase token pricing is undisclosed. No independent security audit of Step AOS or Step Edge has been published.

For consumers in mainland China who use the pre-integrated ecosystem apps and are comfortable with the Chinese regulatory context, the STEPX Neo offers a meaningfully different computing experience at a competitive price point. For users considering it for sensitive communications, financial workflows, or any context where US-China regulatory tensions are relevant, the full picture requires weighing all four dimensions: what the device does well, what its benchmarks have not yet proven, what the ecosystem still lacks, and what Chinese law requires of the company that made it.

Frequently Asked Questions

What makes MCP a security concern on a smartphone, and why does it matter if it is at the OS level?

MCP (Model Context Protocol) is an open standard that lets AI agents call external tools and services directly, without simulating human interaction. On a conventional AI phone, a security vulnerability in a third-party AI service affects that service. On the STEPX Neo, MCP runs at the OS core — which means tool-poisoning attacks, compromised server instructions, and supply chain vulnerabilities in any MCP-connected Skill or Agent can potentially reach the device's communications, files, payments, and location data simultaneously. The NSA's AI Security Center, the Cloud Security Alliance, and OWASP documented serious unresolved vulnerabilities in MCP deployments in 2025–2026, including a CVSS-9.6 critical remote code execution CVE in widely used MCP infrastructure. Placing MCP at the OS level doesn't multiply the protocol's security problems, but it does mean the attack surface is the phone itself—not just one app on it.

Does China's National Intelligence Law actually require StepFun to give user data to the Chinese government?

Yes. Article 7 of China's National Intelligence Law (2017) states that any Chinese organization must "support, assist, and cooperate with state intelligence work." This is not a hypothetical risk or a matter of interpretation — it is the operative text of Chinese law, and it applies to StepFun regardless of where its servers are located or what its privacy policy states. The Data Security Law (2021) and Cybersecurity Law (2017) add additional data provision and data localization requirements. StepFun's security framework — Trusted, Visible, Controllable, Reversible — describes the company's design intentions, not an exemption from Chinese law. No independent audit has verified what data the device collects or how it is handled in practice.

How is Step AOS different from Samsung Galaxy AI or Google Gemini on Android?

Samsung Galaxy AI and Google Gemini run as privileged apps or system services on top of standard Android. When they attempt multi-step tasks, they use Android's accessibility APIs to simulate screen interactions—a layer designed for accessibility tools, not agentic task execution —and it breaks when UI elements change. Step AOS was rebuilt from Android, Linux, and RTOS components so that the agent (Amoo) is a first-class OS process with direct kernel-level capability calls through MCP. It does not simulate finger taps. This architectural difference makes Step AOS agents more reliable for multi-step autonomous tasks — but it also means the agent has a fundamentally deeper access path to the device than any app or overlay system does.

Is the STEPX Neo available outside China, and what happens to the token plan after the first year?

The STEPX Neo has no announced international release date, pricing, or carrier availability. Its pre-integrated ecosystem — Alipay, Didi, Meituan, Ctrip, JD.com, Amap — is built around mainland Chinese services. StepX Terminal has not disclosed the pricing or availability of token access after the twelve-month bundled plan expires. Buyers who depend on Amoo's continuous agent loops should treat the post-year-one cost as an unresolved variable.

The STEPX Neo Pioneer Edition is available for pre-order in China at ¥3,999 (approximately $597 USD). First sales event: October 16, 2026. No international release date has been announced.