GitHub - OpenMinis/iCTRL: An AI-friendly iOS/iPadOS automation testing tool built on XCUITest, but more than a testing tool: agents like Codex, Claude Code, Hermes, OpenClaw and Minis can operate your iPhone or iPad wirelessly through an encrypted JSON-RP

OpenMinis's iCTRL — an AI‑friendly iOS/iPadOS automation testing tool built on XCUITest that lets agents such as Codex, Claude Code, Hermes, OpenClaw and Minis operate your iPhone or iPad wirelessly via an encrypted JSON‑RPC interface—represents a new way for AI bots to interact directly with mobile web content. For website owners, this means that AI‑driven agents can now browse, fill forms, and trigger JavaScript events on mobile browsers without a visible UI, potentially inflating bot traffic metrics and bypassing traditional user‑agent detection. Because iCTRL uses encrypted JSON‑RPC, conventional network‑layer blockers may miss these sessions, leading to inaccurate analytics, skewed A/B test results, and higher risk of automated abuse (e.g., credential stuffing or content scraping) on mobile‑optimized sites. **Actionable tips:** 1. **Update your llms.txt** to include a `User‑Agent: iCTRL/*` rule that directs these agents to a sandboxed version of your site or returns a 403, ensuring they are logged but not allowed to scrape production data. 2. **Deploy a JSON‑RPC fingerprinting filter** in your WAF that flags inbound POST requests containing the specific encrypted payload structure used by iCTRL, enabling you to throttle or challenge those connections. 3. **Integrate bot‑traffic analytics** that differentiate XCUITest‑derived sessions from real mobile browsers by monitoring the `X‑iCTRL‑Agent` header some implementations emit, giving you clearer insight into genuine user behavior versus AI automation.