Is AI flooding the app stores?

In May 2026 Apple put a reason on a number for the first time. Its App Review team evaluated more than 9.1 million submissions in 2025, and the App Review section of its release opened with "As powerful AI development tools drive a surge in app submissions, Apple's App Review process has seamlessly scaled to handle the volume". Trackers had already seen it: new iOS apps rose in 2025 for the first time in years, then doubled year on year in the first half of 2026. Since then Apple has rewritten its spam rule and quietly changed its published review time.

We wanted to know whether this is a flood, where it shows up, and what it does to people shipping apps. So we put Apple's four transparency reports and five years of fraud releases next to Google's safety reports and AppBrain's monthly count of new Google Play apps. Then we looked past the phone stores, at the places where developers publish code: GitHub, PyPI, npm, the VS Code and Open VSX extension registries and Hugging Face. We pulled those counts ourselves from public APIs and archived copies of each registry's homepage. No store measures how many of its apps are built with AI, so most of this is about volume. Where a source says AI caused it, we say who said so. The methodology has the details.

Apple's App Store: the most submissions it has reported#

Apple has published an App Store transparency report every year since 2022. Each one counts how many submissions App Review looked at, and a submission isn't a new app: every update counts, and the same app can be submitted again after a rejection. So the number measures App Review's workload. In 2025 that workload was 9,100,620 submissions, up from 6,101,913 in 2022. Growth was 13% in each of 2023 and 2024 and 17% in 2025. That works out to about 175,000 submissions a week. In its fraud release on the 2022 numbers Apple said "over 100,000" a week.

The catalogue itself grew 10.8% in 2025, to 2,172,472 apps, against 4.9% in each of the two years before, even though Apple removed 166,899 apps during the year. Apple's 2025 release says the team rejected "over 1.2 million new apps and nearly 800,000 app updates", and that App Review helped "welcome over 306,000 new developers". It's also the only release in the series that gives a cause. The four before it don't mention AI tools.

To count new apps rather than submissions you need a tracker. Appfigures counts new apps on the App Store each year. Releases peaked at over a million in 2016, then fell to 424,000 in 2023, "the lowest point since 2012". In 2025 they reached 557,000 by early December. Appfigures lists AI tools that let people "vibe code" apps as one of three drivers, with apps that grow through TikTok and subscription apps. It adds: "It doesn't mean these apps are competitive on features or experience, but they are going into the App Store nevertheless."

2026 is bigger again. Sensor Tower counted 235,800 new App Store apps in the first quarter, 84% more than a year earlier, according to The Information. In July the New York Times reported its first-half estimate: new apps "doubled to about 560,000", close to its estimate for all of 2025. Appfigures, quoted by TechCrunch, measured first-quarter releases up 60% across both stores and 80% on iOS alone. The Information itself noted that it's hard to tell exactly how many of these apps were made with AI. Nobody publishes that number.

What Apple rejects and what it changed#

Every year Apple says how many submissions it rejected for copying other apps, spam or misleading users. That number was flat at about 155,000 in 2021 and 2022, then rose to 248,000 in 2023, 320,000 in 2024 and 371,000 in 2025. As a share of all submissions it rose from 2.5% to 4.1%. Apple says it now uses AI to "analyze app similarity" during review.

Spam isn't the main reason apps get rejected, though. In the 2025 report, 1,354,418 of the 2,093,244 rejections (65%) fall under the guidelines' "Performance" section, which covers app completeness, bugs and accurate metadata. Another 415,532 fall under "Design", which includes copycats, minimum functionality and spam. The overall rejection rate went down as volume went up, from 27.5% of submissions in 2022 to 23.0% in 2025. Apple doesn't say why.

Apple's rules and promises changed fast in 2026. In March, according to reports summarised by The Next Web, Apple blocked updates to the vibe-coding apps Replit and Vibecode and later pulled one called Anything, citing guideline 2.5.2, which bans apps that download code that changes what they do. An Apple spokesperson told The Information it wasn't targeting vibe coding as a category. The same reports describe developers waiting a week or more for review, against Apple's published 24 hours. In April and July Apple told reporters it reviews 90% of submissions within 48 hours; its own developer page kept saying 24 hours until early October.

Google Play: a tester rule, then a rebound#

Google Play's numbers have one policy break in the middle. Since 13 November 2023, new personal developer accounts have had to run a closed test before publishing: 20 testers for 14 days at first, 12 testers since December 2024. AppBrain, a third-party tracker that follows apps on Play (Google publishes no such count), counted an average of 64,600 new apps a month in 2022 and 40,400 in 2024, a fall of 37%.

Then launches climbed again. By our sum of AppBrain's monthly counts, the first nine months of 2026 brought 631,361 new apps, 63.5% more than the same months of 2025 and, at 70,200 a month, 9% above 2022's pace. The rise coincides with AI coding tools spreading, but also with Google lowering the tester requirement, and nobody has separated the two.

Google publishes how many apps it stopped from being published, but not how many were submitted. That number went from 1.43 million in 2022 to 2.36 million in 2024, then down to 1.75 million in 2025, when Google also banned 80,000 bad developer accounts, half the 2024 figure. Google says "developer verification, mandatory pre-review checks, and testing requirements" have been "significantly reducing the paths for bad actors to enter", and it added its latest generative AI models to the review process.

Google is also building a way around the store for apps nobody else needs. Since 13 October 2026, people in some markets can build an Android app in Google AI Studio and install it through Play on their own device, with no developer account. Google says these apps stay "separate from the public store catalog", so they won't show up in launch counts. And since 30 September 2026, apps must be registered to a verified developer under Android developer verification to install on certified Android devices in Brazil, Indonesia, Singapore and Thailand, with the rest of the world from 2027; Google says it registers eligible Play apps automatically.

More apps, not more downloads#

If new apps were meeting new demand, downloads would rise with them. In the first half of 2026, according to Sensor Tower's numbers in the New York Times, new App Store apps doubled and downloads grew 2%, to 17.6 billion. In 2025, downloads had grown 3%.

RevenueCat, which runs subscription billing for apps, sees the same split in money. Using Appfigures data, its State of Subscription Apps 2026 counts about 2,000 new subscription apps launched in January 2022 and more than 14,700 in January 2026, "likely driven by the AI app explosion". iOS now gets about 77% of those launches, up from 67% in 2023, and RevenueCat says the steepest acceleration began in early 2025, "coinciding with the rise of AI-assisted development tools, which appear to default to App Store-first". Yet across its panel, apps launched before 2020 earned 69% of subscription revenue in January 2026, and apps launched in 2025 or later earned 3%.

Beyond phones: GitHub, PyPI, npm and extensions#

The phone stores have a review queue, a fee and, on Play, a testing rule. The places where developers publish code have almost none of that, and they grew faster. To compare them we took the average number of new items per month in each year and set 2022 to 100. For the registries, the 2026 figure is January to September. We left npm out: its only consistent count is packages still live, which mixes floods with the purges that follow them.

All three of the big registries bent upward at about the same time. GitHub repositories, PyPI projects and VS Code extensions rose gently through 2024, then sharply from early 2025 and again in early 2026. On GitHub, the number of public, non-fork repositories created each month went from 2.64 million in January 2022 to 5.65 million in January 2026 and 11.6 million in September 2026. In the first nine months of 2026 people created 72.6 million, more than in all of 2025. In our count of agent-signed pull requests, a third of new public pull requests on GitHub now carry a coding agent's signature.

PyPI's homepage counter shows 719,368 projects on 1 January 2026 and 905,105 on 1 October, a net gain of 185,737 in nine months, more than in any full year before. Its own 2025 review counted "more than 130,000 new projects created" that year, before deletions; our net figure for 2025 is 122,378. VS Code's marketplace added 21,013 extensions that are still listed in 2025 and 35,726 from January to 23 October 2026. Extensions with AI terms in their names grew from 2.6% of new ones in the first half of 2024 to 11.6% in the first half of 2026, but that measures extensions about AI, not made with it, and most of the growth isn't AI-named. Open VSX, the registry that Cursor, Windsurf and other VS Code forks use, went from 8,547 extensions at the start of 2026 to 20,035 on 23 October.

Hugging Face shows the one wave we can tie to an AI tool directly, because the tool tags its output. Sites made with DeepSite, Hugging Face's AI website builder, are Spaces that carry a versioned deepsite tag (deepsite-v3, deepsite-v4): 181,974 of them, from 120,216 accounts. In October 2025, 71,472 of the 122,578 new public Spaces, 58%, were DeepSite sites. The wave faded within months, and by July 2026 almost no new DeepSite Spaces were appearing.

Steam, the main PC game store, grew too. SteamDB counted 21,406 game releases in 2025, 75% more than in 2022, and Kotaku reported 21,388 by 16 October 2026, about 66 a day. Steam asks developers to disclose AI use, and we covered what those disclosures show in vibe coding in games.

The worst floods were spam#

Registries have been flooded before, and the biggest floods weren't new software at all. They were automated spam: phishing pages, malware, and packages published only to farm crypto tokens. In March 2023, npm got more than 1.4 million package versions in a month, against about 800,000 normally, and returned "Service Unavailable" errors, Checkmarx told Help Net Security. PyPI suspended new sign-ups or new projects four times between May 2023 and March 2024. The first status notice said the volume of malicious users and projects had "outpaced our ability to respond to it in a timely fashion".

The biggest single wave came in November 2025, when Amazon Inspector reported over 150,000 npm packages tied to a tea.xyz token-farming campaign, "one of the largest package flooding incidents in open source registry history". It shows up in the OpenSSF malicious-packages data as one enormous year.

Microsoft started a public log of extensions it removes from the VS Code marketplace in February 2025. It lists 409 removals for the rest of 2025 and 1,868 from January to 23 October 2026: 1,075 for impersonation, 352 for malware, 296 as untrustworthy and 123 as spam. March 2026 alone had 319. That looks like a store reacting to volume, though the log can't tell us whether the impersonators used AI.

What this means if you build with AI#

1. Plan for 48 hours of App Review, not 24. That's Apple's published target since early October 2026, and developers reported waits of a week or more in March. Leave slack before a launch date and test with TestFlight, which Apple also screens: it blocked more than 2.5 million TestFlight submissions in 2025.
2. Most rejections are about completeness, not spam. About two-thirds of Apple's 2025 rejections fall under "Performance". Before submitting, test on a real device, remove placeholder content, make every button work, and give reviewers a demo account if anything sits behind a sign-in.
3. Don't ship another flashlight. Guideline 4.3 now names saturated categories (dating, flashlight, sound effects, wallpaper, simple timers, fortune telling) and says Apple may remove such apps if they aren't improved or don't attract customers. Don't submit several copies of one app under different bundle IDs, and don't borrow another developer's icon, brand or name (4.1(c)).
4. Keep the reviewed build the real build. Apps that download code that changes their features break 2.5.2, which is how vibe-coding apps got stuck in March. Since October 2026, guideline 2.5.19 says an app that adds features after approval can be removed from the store, and its developer from the Developer Program. If your app sends personal data to an AI model, say so (5.1.2(i)).
5. On Google Play, start the closed test early. A new personal developer account needs a closed test with at least 12 testers opted in for 14 days in a row before it can apply for production. Recruit testers before the app is finished, and check in Play Console that your apps are registered for Android developer verification.
6. Shipping is the easy part now. New apps doubled while downloads grew 2%, and apps launched since 2025 earn 3% of subscription revenue. Budget for distribution, not just for the build.
7. Ask whether it needs a store at all. A tool for yourself or your team doesn't need review, testers or a store listing. Google now lets you install a personal AI Studio app on your own Android phone, and a web app at a link works on every phone with nothing to approve.
8. Publishing packages: publish less, and protect what you publish. Registries respond to floods by freezing sign-ups and purging in bulk. Don't push throwaway test packages, and turn on two-factor authentication and trusted publishing for the ones you keep.

That seventh point is why host0 exists: whatever your agent made, hosted at a link that's private until you share it, with no review queue and nothing to install.

Methodology#

Phone stores. Apple numbers come from its four App Store transparency reports (2022–2025, the PDFs, the 2025 HTML page and the supplemental files) and its yearly fraud-prevention releases from 2022 to 2026. We re-read every quoted sentence on Apple's pages on 23 October 2026. The review-time change is dated from Wayback Machine snapshots of developer.apple.com/distribute/app-review: the old wording is still there on 3 October 2026, the new one by 7 October. New-app counts for iOS come from Appfigures and Sensor Tower, as published by Appfigures or reported by the NYT, The Information and TechCrunch; Sensor Tower and Appfigures don't count the same thing as Apple's submissions. Google Play counts are AppBrain's monthly launches, read from its page on 23 October 2026 and summed by us into quarters and years. AppBrain revises recent months upward as it discovers apps (for example, January 2026 went from 47,703 to 56,283 between two archived copies), so August to October 2026 are low. Google's blocked-app numbers are from its yearly security blog posts.

Registries. GitHub: public, non-fork repositories by creation month from the search API (created: ranges, every month complete). PyPI: the project counter on pypi.org's homepage, read from monthly Wayback captures, so these are net additions (created minus deleted). VS Code: a full pull of the Marketplace query API (154,151 entries), counting extensions still listed by first publish date. Open VSX: its public API, first version per extension. Hugging Face: the creation dates in the community hub-stats dataset and its tags. npm: OSV's bulk export of malicious-package reports. Steam: SteamDB's release counts as reported by Steam Page Analyzer and Kotaku. All registry counts that use creation dates only include items still public on 23 October 2026, which understates older years.

Index. Average new items per month in each year, with 2022 = 100. 2026 means January to September. Hugging Face's base is April to December 2022, because its dates lump earlier repos together.

What we can't measure. None of these sources records whether an app or package was built with AI, except Hugging Face's DeepSite tag. Apple's release is the only primary source that attributes growth to AI tools. Appfigures and RevenueCat name AI as a likely driver. For everything else, volumes rose at the same time as AI coding tools spread, and other causes are possible: Google's tester rule was eased in December 2024, token-farming campaigns are automation rather than AI, and subscription apps were growing before 2025.

The data pack, with every number, its source and tier, the conflicts we resolved and the scripts, is in our research notes for this post.

Open questions#

• How much of the new supply is AI-built? No store or tracker measures it. Steam's disclosure covers AI content, mostly art, not code.
• Why did Apple's rejection rate fall from 27.5% to 23.0% while volume rose? Apple doesn't say, and its 2026 numbers won't be out until about May 2027.
• Is Google Play's late-2026 dip real? AppBrain's count fell from 88,871 in July to 52,953 in September. It could be backfill lag, the 30 September verification deadline, or a real slowdown.
• What emptied Hugging Face's new Spaces from July 2026? New Spaces of every type fell by more than half, and we found no announcement.
• Are agents publishing to PyPI? Net new projects tripled, but PyPI doesn't record which tool uploaded a package.
• How big is survivorship? We can't see how many repositories and extensions from 2022–24 were deleted as spam, so the early years may be bigger than they look.