Small improvements that compound into a more defensible device
As digital threats grow more sophisticated and physical, Samsung has quietly expanded the protective boundaries of its Galaxy devices with the first beta of One UI 9. Two additions to the Auto Blocker feature — a transparent record of blocked installations and a complete USB lockdown under maximum security — reflect a broader human instinct to make visible what was once invisible, and to close doors we didn't know were open. These are not dramatic reinventions, but the kind of careful, incremental hardening that defines mature stewardship of personal technology.
- Users running Auto Blocker had no way to see whether the feature was actually doing anything — the new Security Report ends that silence with a 7-day and monthly history of blocked app installation attempts.
- Maximum restrictions mode had a quiet gap: it blocked USB commands but not USB connections themselves, leaving a physical access vector exposed.
- One UI 9 beta 1 closes that gap entirely, preventing any USB connection from functioning when the highest security setting is active — a protection that briefly existed in 2024 before vanishing and has now returned.
- Samsung has been layering these safeguards steadily, having already added an auto-re-enable timer in One UI 8.5 so that protections can't be quietly switched off and forgotten.
- Both features are live for Galaxy S26 beta testers and are expected to reach stable release, extending these protections across Samsung's broader device ecosystem.
Samsung's first One UI 9 beta arrives for Galaxy S26 devices carrying two quiet but meaningful upgrades to Auto Blocker, the company's opt-in security layer that prevents app installations from outside official storefronts.
The first addition is a Security Report — a transparency tool that finally shows users what Auto Blocker has been doing in the background. A seven-day log displays individual blocked installation attempts, while a monthly view presents the same data graphically. For anyone who has wondered whether their device was silently deflecting threats or simply sitting idle, the answer is now a tap away. Android already offers a similar control buried in its settings, so Samsung's version is layered redundancy — useful to some, friction to others.
The second change carries more weight. One UI 8.5 could block commands sent over USB, but Maximum restrictions mode — the highest security tier — offered no additional USB protection beyond that. One UI 9 changes the calculus entirely: with Maximum restrictions active, USB connections are blocked outright. A cable plugged into the phone simply won't function. It's a meaningful defense against physical access attacks, and notably, the feature had appeared in Samsung's software in 2024 before quietly disappearing — it is now restored.
Samsung has been building toward this incrementally. The auto-re-enable timer added in One UI 8.5, which restores Auto Blocker 30 minutes after a user disables it, showed the same philosophy: small safeguards that compound. Neither the Security Report nor the USB lockdown is revolutionary on its own, but together they represent a device that is becoming harder to compromise — whether the threat arrives over a network or through a cable.
Samsung is tightening the screws on its Auto Blocker security feature with the first beta of One UI 9, rolling out to Galaxy S26 devices with two meaningful additions: a new Security Report that tracks what the system has blocked, and complete USB connection blocking when Maximum restrictions mode is active.
The Security Report is the more immediately useful of the two. When you enable Auto Blocker—which prevents installation of apps from sources outside Google Play Store and Samsung's Galaxy Store—the system now keeps a record of what it stopped. Users can view this history in two ways: a seven-day view showing individual blocked app installation attempts, or a monthly view presented graphically. It's a straightforward transparency feature. You can see at a glance whether Auto Blocker has been quietly shutting down suspicious installation attempts, or whether your device has been clean. Samsung positions this as a way to help users understand what threats the system is deflecting, though it's worth noting that Android itself already has a similar control buried in Settings under Special access, where you can allowlist specific apps to install from non-standard sources. Samsung's version adds another layer, which some will see as helpful redundancy and others as unnecessary friction.
The second change is more substantial. In One UI 8.5, Auto Blocker's standard mode blocks commands sent over USB connections—preventing a computer from issuing certain instructions to your phone through a cable. But Maximum restrictions mode, the highest security setting, offered no additional USB protection. That changes with One UI 9. Now, when Maximum restrictions is enabled, USB connections are blocked entirely. This is a notable hardening. It means that if someone gains physical access to your device and tries to connect it to a computer, the phone simply won't allow the connection to function. The feature actually existed in Samsung's software back in 2024, then disappeared from subsequent releases, and is now making a return.
Both features are live in the One UI 9 beta 1 that Samsung has seeded to Galaxy S26 owners. The company has been steadily improving Auto Blocker over the past year—One UI 8.5 added the ability for the feature to re-enable itself automatically after 30 minutes if a user turns it off, a small but meaningful safeguard against someone disabling protections and forgetting to turn them back on. If Samsung follows its usual pattern, these new additions should make their way into the stable One UI 9 release later this year, becoming standard on future Galaxy devices and available to existing phones through software updates.
For users who care about device security, particularly those in high-risk situations or simply paranoid about malware, these are welcome refinements. The Security Report gives visibility into what's actually happening behind the scenes. The USB blocking closes a potential attack vector for someone with physical access. Neither feature is revolutionary, but together they represent Samsung's incremental approach to hardening its platform—small improvements that compound over time into a more defensible device.
Citações Notáveis
Auto Blocker helps prevent the installation of malicious apps by restricting installations to authorized sources like Google Play Store and Galaxy Store— Samsung (via source)
A Conversa do Hearth Outra perspectiva sobre a história
Why does Samsung need its own app installation blocker when Android already has one built in?
It's partly redundancy, partly control. Samsung wants to make sure users on its devices get the security posture Samsung thinks they should have. The built-in Android setting is buried and requires individual allowlisting. Samsung's Auto Blocker is more aggressive and more visible by default.
And the USB blocking—is that really a threat most people need to worry about?
For most people, probably not. But if you're someone whose phone might be seized or accessed without permission, or if you work somewhere with real security concerns, it matters. It prevents forensic tools from connecting and extracting data.
Why did Samsung remove this USB blocking feature in 2024 and then bring it back?
That's the mystery no one's answered. Could have been a bug, could have been performance concerns, could have been user complaints. But they clearly decided it was worth bringing back.
Does the Security Report actually help users, or is it just noise?
It depends on the user. If you never see anything blocked, it's reassuring. If you see attempts regularly, it tells you something is trying to get onto your phone. Either way, it's information you didn't have before.
Will these features reach regular Galaxy phones, or just the S26?
They should reach all Galaxy phones through updates. Samsung typically rolls beta features into stable releases within a few months. This isn't experimental—it's just being tested first on the newest hardware.