> It accessed Messages without full disk access

>This whole story never made sense or was substantiated

This story makes perfect sense, and Meta has a long history of not respecting user privacy controls.

> tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits

https://arstechnica.com/security/2026/10/apple-changes-full-...

I gotta' disagree on this one. Meta made claims that it was taking privacy seriously and it turns out, not so much. I do think they should be getting some pressure on that score.

In. Jonna Stern’s interview with Zuckerberg he talked about the security, and how they delayed it to make sure they got it right. He then went on to say there was more to do and they weren’t totally isolated yet (I can’t remember his exact wording).

I felt like he was undermining his original point. They delayed to make it better, but didn’t delay long enough to do the actual right thing he mentioned they could potentially do in the future.

When it’s pulling in data from all over the phone or computer, it’s not just the user’s data. Some of my personal data (detailed contact info, emails, etc) can be pulled in and used by Muse if someone I know installs it, without my knowledge or consent. That needs to be taken seriously, and Meta has a history of abusing this concept (uploading fully address books to find friends)

It's the market for attention. Many of techdirt's writers are heavy Bluesky users so most of their articles cater towards other Bluesky users. Venting might be the most common longform on either website.

> the LLM is just too dumb to perform complex tasks effectively in many cases.

Muse Spark 1.3 is way better than anything else out there outside of the US labs except Deepseek Flash which comes close.

Nice! Starting my own crypto miner using Meta infra then.

Absolutely agree. So much feigned outrage in these articles (and HN comments) about the LLM models doing x.

Yesterday everyone was all worked up about OpenAI generating an image with a signature on it.

Caveat emptor. Don’t be an idiot. Grow up. Make informed decisions regarding your use of these products and take responsibility for those decisions.

> I’m pretty frustrated with Muse and the last thing I want to be doing with my free time is defending Meta

Then don't.

You just did the tech equivalent of "not to sound racist, but..."

What AI boosters don't realize is that we're not in the optimistic days of the 1990s anymore. We've seen that the prevailing tech business model is to offer convenience as a lure to lock in dependent users and extract value from them.

Unless these AI assistants are running on self-managed platforms independent of their developers, all I see is immense counterparty risk.

I see the value of the tool but I would never use it from Meta. Would need to be self hosted with a very structured framework and guardrails so that even my local model couldn't accidentally wire 50k to a Nigerian prince or whatever the latest email scam is.

I’m in the same boat. After witnessing context rot and inference collapse, I do not trust any LLM with mission critical work. Not Jev, not grok, not fable, not Opus.

>This is the future stuff we always wanted.

Speak for yourself. I hated the idea of agents ever since I first heard of it back in the 90s or 00s. For me, the most valuable feature of computers is predictability. I want tools, not agents. A computer should augment my own skills, not replace them.

The missing piece for connecting an agent to your credit card or other financials is financial liability.

If Meta/OpenAI/etc would guarantee they’d compensate you in full for anything that wasn’t supposed to happen —and had an established track record of doing so— it would make trusting agents to make financial choices easier

It's evident that agents still can't be trusted to transact on your behalf. Too many things can go wrong.

Sad to see such paranoia, agents can genuinely be an agent of good and positive change.

Last night I had ChatGPT go through an old email account and surface memories that I literally forgot. People who I have fond memories of. Yea I could have spent time querying gmail and digging but the agent did it in a way that really resonated. I don't care if Sama has my emails now. I do care about connecting with my past and enjoying the memories of a time long past.

Paranoid scolds of HN want the average person to be deprived of value like this for some reason.

I made an agent to derive and iterate on a stock trading strategy for me. What I did was give it a virtual bank account that models your typical brokerage account. So my agent reads the news, financials, markets, all the information it can gather to decide what stocks to buy/sell and manage its portfolio. Then what I do is just follow along with real money.

I could see shopping being the same way, let the agent shop for you or identify good deals on things you want but then push them to you to make the actual purchase. Like you, I'm certainly not going to let an agent make a real purchase for me unattended and I doubt any merchant is going to have much sympathy for "my AI bought this by mistake".

> allow it to do price comparsion and shopping without oversight

You can get it to do the price comparison part without having it do purchases.

I downloaded Muse, told it to find me some underwear to buy, asked some questions to narrow the options down, then once I came to a decision I went and purchased it myself.

I trust mine considerable, but only because I can run it mostly offline on hardware I own that lives in my garage. It baffles me that I am the only technical person I know that exclusively uses AI this way.

Muse is basically OpenClaw, with all the pros and cons. Except I really don’t trust Meta to get any of this right.

Personally to me this feels like another classic case of starting with the technology and figuring out where to sell it as opposed to the customer experience.

It feels and seems too forced.

My wife has scheduled a visit with a physician and there was a younger person in there. They legit said “haha I don’t know what it is” and used ChatGPT for diagnosis.

I have no doubt they would have no problem outsourcing everything to agents.

Don't worry, I'm sure eventually you'll simply be required to give one of these things access to your bank account and that decision will be taken out of your hands.

Sorry, no. This is not the future I wanted. I do not run any agents nor ever will.

I find all this is just the next-gen privacy violation, disguised obviously as: "Oh, WOW an agent in the computer is doing all this for me". Bullshit.

It seems that never is enough with these ever thirsty companies, they keep pushing the limits and surprinsingly a lot of people do not care at all nor value the implications of having an arbitrary process running and doing pretty much whatever the agenda of their creators are.

Now add Meta to the mix and stir.

> This is the future stuff we always wanted.

> (…)

> I just do not trust any of them

So… Actually not the future stuff we wanted? That’s what bothers me when people say “we have the Star Trek computer”¹. We clearly don’t, because if we did we could trust it with a high degree of certainty. Instead what we have is a computer we must distrust to a high degree. One of the two crucial variables is flipped.

¹ I’m not saying you are saying that, but several people have expressed that sentiment on HN.

You don't have to, there is a world of things you can do with them without giving them access to your email or bank account.

"Hermes, clone this android app to my computer, add this and this feature and fix this annoyance and then rebuild it and push it to my phone"

"Hermes summarize this YouTube podcast and push the summary and transcript to my Obsidian vault"

"Hermes check mg obsidian notes for when I last wrote a blog article about Neovim's integration with AI agents"

*Hermes, you have an API token that allows read only access to the Zabbix monitoring system, check that and then use the Proxmox API token that only allows you to do limited actions to reboot the VM that is having issues"

Etc, etc,

Yeah, just waiting for the AI-enshittification when they give it to the growth hackers to drive VC returns at the expense of utility.

I agree with this but also think it is a first order consequence.

This level of unfettered access to your personality, lifestyle, and secrets allows for an unprecedented kind of manipulation and control. You could see it as a new kind of wealth transfer: not only will They sell you things, They will subtly manipulate behaviors of the masses via trusted agents.

Or to otherwise coerce you into whatever funnel that makes them money

In your locality, do you know if there are any upcoming votes/ laws or politicians who are realistically working to preserve your privacy, in these regards?

In mine, I don't.

That seems like an oversight/ opportunity.

"I've gone ahead and placed an order based on your Google doc Daily Diary "Bad Dragon" entry."

“to sell you things” -> to manipulate you

Let’s not forget Facebook caused a genocide

Yes, it is clearly designed to give you access to all of this intentionally. Its system prompt (which you can just read in the interface without asking) explicitly instructs it to act on behalf of the user, not meta. All of its memory files, skills, db schema, memory integration system etc are likewise visible because they went out of their way to add an interface for viewing them!

I don't like or trust meta any more than I always did but I don't see how they could have done a "better" job with this. These kinds of agents are inherently pretty risky IMO but I don't see how this one is particularly more than any others.

Playing around with it I really don't get the sense there's any hidden prompt contradicting what's visible. It's nearly gleeful at using the VM in ways that were not intended and likely against meta's interests. I feel like someone must have won a really interesting internal power struggle to get this thing out in this form.

Probably. But also the agents are finding flaws in the security model.

Also Meta is actively encouraging users to grant them full permission, insisting with all their marketing might that it’s safe, which they know is a complete lie. Hard to blame the user when they’re being actively deceived like this. Other agent companies are more reserved and say things like “be careful” but Meta is the opposite.

Yes, and we’ve told people this for two whole decades now only for them to shrug.

I agree with your assessment, however I think tech executives are out of touch and lack self-awareness if they think people really want or need this. The whole reason an EA is worth it is because you are making outsized money and your time is worth too much to handle any mundane details that normal people deal with. Along with that there's the whole social signaling of having an EA because it signifies ones wealth and importance.

A free digital EA confers none of that—and it will annoy everyone you know. The only use case I see having legs is dealing with large bureaucracies like canceling subscriptions or medical billing issues, but there I think the common man will lose as the rise of this automation will see a distributed adversarial response from bureaucracies who will happily put up whatever barriers are needed to prevent Muse and other digital EAs from impacting their bottom line.

There's a 50/50 chance I'm just getting old here, but I really think we're going through an epochal shift where new consumer tech won't have the same reception as the smart phone and increasingly addictive bite-sized algorithmic media did over the last couple decades. I think going forward there will be more palpable questioning from younger generations about why do we even want some of these tech products? At some point convenience reaches diminishing returns and we have to think deeper about what we're trying to get out of life.

Ironically it already satisfies all of those conditions because it runs in a VM on Meta's servers as root, where it'll happily let you install whatever you want inside the VM, including a custom remote access tool to let you logon as the root user inside it.

I have a feeling LLM security breaches are slowly transitioning from exploiting obscure zero days to simply walking through the front door with the still live access token they've been pretrained on, lmao.

Because we are human.

(As a human, it's more physically taxing to think, and less taxing to relax. Conserving internal resources improves our survival odds. So when an opportunity presents itself to use less effort and still gain out of that, we tend to take it.)

As human technologists, I believe we need to protect humanity more.

In everything that we do, we need to think about the ways that our proclivities as a species can be compromised by our development of technology.

That would require thinking, and thinking is the thing everybody seems to want to outsource to LLMs.

It involves cognitive effort to set a good lowest acceptable price. We don't want that, we want to reduce this effort that's what the tools are for

Because a lowest acceptable price probably depends on doing research and making a decision.

This person gets it.

It really is about trading off personal energy and internal resources for gain. It's almost survival level logic.

Reading the linked articles suggests that this is not possible, but Apple did acknowledge that the full-disk access grants you access to other apps (until the most recent update)

Typical "leopards ate my face" moment. You give AI (from Meta, nonetheless) full-disk access and then complain that—wow—it really meant FULL.

In a perfect world where you got nothing to hide, where companies don't sell your data and there are no hackers, even I would love to just hand all my data to Muse and have it be my trusted assistant. People who think we live in such a world are already doing that, evidently.

I saw a theory, just a theory, that it may have accessed the message via its notification preview, which I think was similarly used to leak Signal messages recently?

> Can someone explain how this is possible?

It's not.

if you go on meta.com there is not a single mention of Facebook or Instagram anywhere in sight, and those are their leading products and money makers...

the company's brands are toxic and they know it.

It's always very intentional, especially with Meta/Facebook.

That's their whole modus operandi, a privacy nightmare which will feed their infinite money machine.

Reading "Careless People" didn't make me surprised at all on how the company operates, it surprised me with the personal descriptions of how people like Mark Zuckerberg and Sherryl Sandberg actually are as humans. It scared me how most people at that level of wealth and power isn't too different from the accounts in the book, they're all seriously deranged people with a gigantic lever to impose their distorted realities upon the rest of humanity.

It’s 100% intentional, go look back at what they did with the Facebook app.

Yes, just like Dropbox is a fork of FTP+SVN.

I get this, but to be honest he said this when he was in college, I don't put much weight on it. You're telling me that you never said anything stupid in college?

been mostly using WhatsApp, should i be worried?

Muse is a decent model at a VERY low price

The Muse app is very polished and it seems to actually be popular with younger people.

I have tried it out but I’m still struggling with use cases, same problem I had with OpenClaw

I think a lot of normal people do perceive Meta as a shady and bad brand -- why do you assume otherwise?

A lot of people don’t care about their data being shared

This "holier than thou" attitude in this comment is precisely the reason why HN users have largely misunderstood tech trends and desires by the general public.

They didn’t though. No trust involved. Hormones and emotions.

Today’s version of the platform targets just the right emotions to keep users “engaged.”

I forgot about downvotes! OK I will need to do a proper Show HN at some point.