I’m pretty frustrated with Muse and the last thing I want to be doing with my free time is defending Meta, but this is such clickbait.
Point by point:
> “OMG you can jailbreak it and get it to spill its VM”
This is the whole point; any content on the VM is yours. It runs in an isolated sandboxed VM separate from stored credentials etc; this is effectively your own computer. You don’t have to trick it.
> It collects dossiers on your contacts
These are more text files that live on your private VM, alongside memory.md, etc. Do you want your secretary to forget every person you contact every day?
> It accessed Messages without full disk access
This whole story never made sense or was substantiated. Full disk access is an OS level security boundary; the user had to switch this on.
> It sold some guys stuff for too cheap and gave out his address
OK this one I basically believe, haha. Because this is the problem with Muse: the LLM is just too dumb to perform complex tasks effectively in many cases.
I gotta' disagree on this one. Meta made claims that it was taking privacy seriously and it turns out, not so much. I do think they should be getting some pressure on that score.
Okay, but what is the evidence to back up this assertion? My point is, at this time, there is none. There is no “it turns out”. Give them some time to screw up at least.
The Messages database is protected by macOS TCC. If Aten were correct, there would exist a macOS zero day vulnerability.
The vastly more likely explanation is that Aten mindlessly gave Full Disk Access to Muse. And that appears to be Apple's assumption, based on Apple's newly published developer note.
Apple's statement on the matter sure sounds like Meta has once again been caught with their hand in the cookie jar.
> Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
> Apple's statement on the matter sure sounds like Meta has once again been caught with their hand in the cookie jar.
> > Some developers are using Full Disk Access in ways that could put users at risk
In other words, Muse did have Full Disk Access. Jason Aten did grant Full Disk Access to Muse, despite his claims otherwise.
If Aten did not grant Full Disk Access to Muse, then why would Apple even be talking about Full Disk Access?
The point is that Aten apparently granted Full Disk Access absent-mindedly, so absent-mindedly that he won't even admit that he did it. This is why Apple is making changes to Full Disk Access to make it more obvious what's happening.
> In other words, Muse did have Full Disk Access. Jason Aten did grant Full Disk Access to Muse, despite his claims otherwise.
Perhaps you should do some reading on the matter?
> Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges. One is full-disk access, a macOS system-level permission. The other is to enable a Messages connector setting in Muse.
“The Messages integration in the Muse Mac app is opt in,” Singleton said. “Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”
Singleton’s implication was clear. Muse could have read Aten’s Messages communications only if he had enabled both settings, and if so, the columnist had only himself—and certainly not Meta—to blame.
So you're saying he mindlessly, and without thinking about it granted two OS level permissions to Muse? I don't understand how this refutes anything the parent poster said.
> Singleton’s implication was clear. Muse could have read Aten’s Messages communications only if he had enabled both settings, and if so, the columnist had only himself—and certainly not Meta—to blame.
Indeed, and it looks like Aten absent-mindedly did all of this!
> Meta has a long history of not respecting boundaries once something is technically possible.
It's not technically possible for Muse to read the Messages db without Full Disk Access. Aten denies having given FDA to Muse. Thus, Aten is simply wrong, misremembering or something. And if he misremembers about FDA, he likely also misremembers about granting app-level permissions to Muse.
Again, literally nobody has reproduced Aten's experience. Show me one other person.
In fairness, Aten behaved just like many other users would, mindlessly granting permissions that an app requests. That's certainly a problem. Unfortunately, Aten stubbornly refuses to admit this, instead confusing the problem by suggesting technical impossibilities. Aten doesn't want to take any responsibility for his own actions.
So you prefer to accept the version of events where Aten somehow stumbled upon a macOS security vulnerability that allows apps without Full Disk Access to read the Messages database, a vulnerability that nobody else has reproduced and that Apple itself apparently doesn't recognize? Just because one writer said so?
If what the writer said was strictly true, Apple would be having a little security freakout about how Muse managed to bypass this OS control. My assumption is that the writer did not understand everything he was granting it permission to do, so he legitimately believes that he didn't grant it those permissions. But he did.
> In this case, Meta explicitly promises that Muse will not read your messages even after you grant it disk permissions.
There's no reason to doubt this claim. The only person in the world who has claimed that Muse disrespects its own internal setting is the same person who claimed that he didn't grant Full Disk Access to Muse.
Ironically, Aten's own screenshot appears to show that he toggled the internal setting from "Off" to "Read only". In my own testing, it's "Off" by default, and the only way to change the internal setting is to enable Full Disk Access first.
Thus, the likeliest scenario is that Aten unthinkingly granted Full Disk Access to Muse, granted the Messages app permission, then had a change of heart, disabled Full Disk Access, and then forgot what he had done. Later, when he noticed that Muse had some of his messages, he went back and checked, and saw the FDA was disabled, forgetting that he had toggled it on and off.
My blog post included links to and quotes from Jason Aten's posts, which shows that I had done reading on the matter, contrary to GeekyBear's unfounded insinuation.
Moreover, my "opinionated" blog post also included a screen recording of the Muse first run experience, so everyone can see for themselves what it's like. And if you don't trust my screen recording, then you can perform the exact same experiment yourself. Nothing I did was unique.
Reading it over, it does seem like giving the app full disk access would be enough for it to read our messages. I mean, they are stored on disk somewhere.
> Meta's claim that Muse would not read your messages without explicit permission was meaningless.
But it was true and you still haven't refuted that Aten mindless clicked through and allowed Muse full disk access and/or the messages connector setting in the Muse app.
“Mindlessly” gave full disk access. This is why Apple is restricting FDA further- people are stupid. TCC exists, great, but you’re spending so many comments harping on TCC that you e lost the plot here.
Do we really need evidence here? We know Meta is a bad actor, we have plenty of evidence of Meta/Facebook engaging in criminal or otherwise human-hostile behavior (including facilitating a genocide).
When an actor has shown it self to be this malicious, we should be allowed to assume all the worst thing about it. And we should at the very least resist and complaint whenever it shows it self able to cause even more harm to humanity.
It's definitely faster to just assume that there is evidence to reinforce our existing biases than it is to do the same after succeeding or failing to locate that evidence, so considering that all three methods lead to the same result, the one with the lowest time cost is optimal.
Trump is stripping the White House for copper and selling it!! Well, actually he’s not, but since we know he’s corrupt, isn’t it safe to just assume he might also be doing this other bad thing?
If your decision is to avoid Muse due to Meta’s poor track record, that’s absolutely your prerogative (and a reasonable one!). But specific claims must be evaluated based on their evidence. This article fails that. There’s no story here.
The logic here is that Meta (a company known to be malicious) is putting out a product which is potentially dangerous. There are some anecdotal evidence of said dangers, and it is perfectly rational to believe given the history and dangers involved. Best case regulators step in and ban this product before we know the validity of these anecdotes. Worst case, regulators do nothing, the public starts using the product, and these anecdotes turn out to be valid.
Off course there is space between the worst and the best case. But given Meta’s history it is safest (and the most rational) to assume the worst.
Why though? The comment you're replying to is explaining how the accusations of poor privacy are nonsense and you've just replied "I disagree because they have poor privacy".
I mean I'm not going to hand over any data to Facebook if I can help it but it doesn't seem like there are any specific issues here.
>This whole story never made sense or was substantiated
This story makes perfect sense, and Meta has a long history of not respecting user privacy controls.
> tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits
The reason that story didn’t make sense to me was that the tech columnist never showed the Apple system settings on whether full disk access was enabled or not. If you trusted the tech columnist that full disk access was not enabled, then Meta’s Muse AI seemed to have discovered a zero-day vulnerability in Apple software, specifically a TCC bypass.
First I doubt Muse is that good of an AI. Second, even if that’s the case, why wouldn’t someone report it to Apple to get thousands of dollars in bug bounty rewards?
Apple's statement makes their position on the matter clear.
> Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
That Apple statement assumes that the user has granted full disk access but the user said he did not. So I conclude that Apple thinks the user is either lying or had forgotten he had enabled full disk access.
I’ll be charitable and say the user isn’t lying. Okay he has made a mistake in the initial granting of permissions. Then why didn’t he correct or retract the article?
The app-level setting is irrelevant if the app does not have Full Disk Access.
Muse cannot bypass built-in macOS protections. TCC does not work on "the honor system", any more than UNIX permissions. It doesn't matter how nefarious Meta happens to be. Operating system security is designed to be resistant to malware.
> The app-level setting is irrelevant if the app does not have Full Disk Access.
I'm just going to have to ignore you on this issue.
> Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges.
One one of those privileges actually stops them from accessing the filesystem. Any agent, Meta or otherwise, can access iMessages without the connector in that configuration.
> I'm just going to have to ignore you on this issue.
Sure, what do I know? After all, I'm only [checks notes] a 20 year veteran of Mac software development with multiple Apple-issued CVEs to my credit. ¯\_(ツ)_/¯
> > Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges.
Yes. Those two:
1. Full Disk Access
2. The Messages Setting in Muse
As I said, without the first, the second alone won't allow Muse to read your Messages db. Do you not understand why Singleton said that Muse needs both?
The entire story here is that Meta claimed that Muse would not access your messages without you granting it the second permission, even after your granted it the first.
Hence Apple's statement that the first permission was being abused to destroy any promises of user privacy.
The problem here is that Aten claimed he did not grant the first, and moreover, you have been defending that claim of Aten's in these comments.
As soon as you admit that Aten did indeed grant the one permission, it's not much of a stretch to conclude that he also granted the second permission. It would be very odd, I think, to distrust Aten in the one case yet stubbornly take him at his word in the second.
Again, if even one other person in the entire world could reproduce Aten's alleged experience...
Meta promised that they would not read a user's messages without an additional permission the user must enable inside of Muse, even after they granted Muse full disk access.
A journalist reported that Muse read his messages despite the fact that he did not grant permission for it to do so inside Muse. He never claimed he did not grant full disk access.
Apple announced that the full disk access permission was being abused.
And another false claim he made, "Also, that full disk access doesn’t say anything about your message database", which anyone can easily refute by opening System Settings and reading the text.
That's the setting to let it read your messages if you don't want to give it full disk access. If you give it full disk access wouldn't that supersede it unless you don't store your messages on the disk?
> I’ll be charitable and say the user isn’t lying. Okay he has made a mistake in the initial granting of permissions. Then why didn’t he correct or retract the article?
There is no answer to that consistent with the premise you assumed out of charity :).
> Meta has a long history of not respecting user privacy controls.
Meta's respect is irrelevant, because macOS TCC prevents any and every app, including malware, from accessing your Messages database without Full Disk Access.
> he never granted Muse permissions to read his messages
That's what he said, but I would suggest that one person's memory is a lot more fallible than a longstanding operating system security feature.
Seriously, stop trying to grandstand this thread and being Meta’s lap cat. It’s gross.
How on earth, after literally decades of abusive behavior by meta, are you standing the straw man that maybe and based on your assumption the user is lying??
I said that Aten is misremembering. That's not the same as lying. We all misremember things.
I don't care about or trust Meta. In my blog post about the Muse first run experience, I said, "For testing I used a fresh VM, not signed in to my Apple Account, because of course I don’t trust Meta with any of my data!" https://lapcatsoftware.com/articles/2026/10/2.html
What I do care about is truth and accuracy. My mistrust of Meta is not going to make me distort the truth. Muse cannot bypass macOS TCC, that's a simple truth.
I'm a macOS software developer. That's the reason for my interest in this story, the technical aspects of it.
In. Jonna Stern’s interview with Zuckerberg he talked about the security, and how they delayed it to make sure they got it right. He then went on to say there was more to do and they weren’t totally isolated yet (I can’t remember his exact wording).
I felt like he was undermining his original point. They delayed to make it better, but didn’t delay long enough to do the actual right thing he mentioned they could potentially do in the future.
When it’s pulling in data from all over the phone or computer, it’s not just the user’s data. Some of my personal data (detailed contact info, emails, etc) can be pulled in and used by Muse if someone I know installs it, without my knowledge or consent. That needs to be taken seriously, and Meta has a history of abusing this concept (uploading fully address books to find friends)
It's the market for attention. Many of techdirt's writers are heavy Bluesky users so most of their articles cater towards other Bluesky users. Venting might be the most common longform on either website.
In this context, normal people will believe the marketing and trust meta, and caveat emptor is a cop-out at best. I can sell you a basket of bread, and it’s privacy-preserving bread, but it will also punch you in the face if you don’t read every bit of the agreement. No one reads the agreement, and that’s what Meta runs on, plus skirting the law in every way they can possibly get away with.
In this context, Apple provided a feature that gives applications Full Disk Access. The journalist enabled it, and then had their face eaten by leopards after ignoring the warning.
Take Meta out of the equation here; any agent with FDA can do the exact same thing. Claude, Codex, DeepSeek, any of them. This is why Apple's response is a fix to their own software. The fix is a mea-culpa, Apple would not have to patch their OS if it was behaving exactly the way they wanted it to. Apple and the journalist made the biggest mistakes here.
Meta is a godawful company that should be regulated into the dirt until Zuck is left with nothing. Guess what? They're not to blame in this scenario, and your rabid attacks on lapcat (who is a reputable and generally impartial macOS developer) is unnecessarily hostile towards a perfectly normal observation. This brand of comment is so misleading, low-effort and harmful to good-faith discussion that I'm tempted to flag this whole thread for being founded on a misunderstanding. Your response has contributed to the derailing of this conversation by tribalist "Apple vs Meta" pundits who are drowning out a well-known and respected expert that has technically-salient architectural details to share. HN cannot foster intellectual gratification under these conditions.
> Caveat emptor. Don’t be an idiot. Grow up. Make informed decisions regarding your use of these products and take responsibility for those decisions.
Feigned outrage, indeed. I don't think it's unreasonable to point out that Meta has been consistently predatory, reckless, and creepy with user data before, and that this is a very aggressive expansion of that.
The old facebook booster retort of "if you don't like it, don't use it, take responsibility" or whatever is nonsense. You're in their system whether you use their product or not. Even if you somehow avoid their pervasive web-wide tracking, a single contact you know installing this thing and gobbling up all your correspondence with them can compromise your privacy choices, and that's well beyond your control, unless you seriously suggest I audit every single one of my contact's devices and browbeat them into using the privacy choices I prefer.
> "if you don't like it, don't use it, take responsibility" or whatever is nonsense.
Why? I don't use Meta products, and my life isn't substantially impacted or controlled by them. Explain to me why I need to lobby my OS developers to reign-in Meta, from my perspective. Why is my hands-off approach insufficient for teaching adults to make intelligent decisions?
Facebook is unquestionably awful, but that's a regulatory issue. 90% of the people chiming-in with Facebook outrage aren't using Meta products; they are literally feigning surprise and outrage as someone that clearly knows better. Oftentimes, they oppose any regulation that would force Meta to reconcile their damages because it would also jeopardize other abusive monopolies like the App Store that they love to defend. So where does the buck actually stop? Does it ever?
HN has done this for years. Years and years and years. "Meta is horrible! Stop them!" -> "New Meta product has ~10-100 million MAU" -> "We need private enterprises to limit Meta!" -> Stagnant status-quo where exploitation is rewarded. Things got this bad because of the pugilist, tribal attitudes that dominated tech discussions and steered people away from common-sense regulatory measures.
My assumption is you clearly don't have vulnerable or elderly people in your life? I'm not as concerned about my ability to navigate these waters as I am about the people I care about.
I get the appeal of agents, I do. This is the future stuff we always wanted. But I cannot get myself to give one of these things access to my bank account or allow it to do price comparsion and shopping without oversight. Or access to my email or chat history.
I just do not trust any of them, not with my money or with access to my conversations.
What AI boosters don't realize is that we're not in the optimistic days of the 1990s anymore. We've seen that the prevailing tech business model is to offer convenience as a lure to lock in dependent users and extract value from them.
Unless these AI assistants are running on self-managed platforms independent of their developers, all I see is immense counterparty risk.
> What AI boosters don't realize is that we're not in the optimistic days of the 1990s anymore.
Comments like this are in a different reality than most consumers. Most consumers don’t care about things like avoiding lock in to a platform. If the platform solves their problem then they don’t have any reason to leave it anyway. They’re not worried if their data is used to show them more targeted ads.
Topics like this show a sharp divergence between what you read on Hacker News and how actual users operate. We already knew that people who don’t trust Facebook aren’t going to suddenly start using Muse. They were never going to consider it. For the people who do actually use Meta products, which is a customer base counted in the billions, many will not have any problem using these tools.
Imagine we were talking about soda (or pop, or coke, or soft drink, depending on your dialect). Personally, I find it absolute insanity to be regularly consuming so much dissolved sugar especially during our ongoing obesity and digestive health epidemic.
But, “most consumers” don’t care about that. The beverage industry is insanely profitable, especially with recent forays into “energy drinks”.
Do people who drink so much dissolved sugar live without consequences? Absolutely not. They have a significantly lower quality of life and die much sooner than people who do not drink dissolved sugar.
I don’t see your comment as a valid dismissal. Just one more way that individual outcomes in our society are increasingly K-shaped.
Expanding on this thought (too late for an edit), there's a nice simile to be had:
- technologists : software that is bad for privacy
- nutritionists : food and drink that gives you diabetes
So, I'm no nutritionist, but I pay attention enough to pay attention when they say I shouldn't drink a liter of Coke every day. As technologists, we should carry the torch and speak loud-and-wide about the dangers of software that is bad for privacy.
Another way to say this is that your parent may be suffering from lack of imagination. Stuff like this can (and should) be regulated. Consumer protection is a thing most jurisdictions do. In fact there are millions of possible markets which consumers would absolutely fall victims to, but government regulators prohibit it because of the harm it causes consumers. Government regulators can (and should) apply the same logic to AI, but they don‘t. There is not really a good reason why they don‘t other then some ideological movement towards ever greater neo-liberalism, deregulation, and laissez faire capitalism.
I asked my wife to not share any info with Muse and she said “Well they know everything already”. Well I was able to convince her not to with some stories about hallucinations of agents getting things horribly wrong as agents in the past, because the privacy concerns just didn’t phase her. Shes even more aware than most people since I’m very privacy aware. 100% it’s very echo chambery to claim that it’s not 1990 anymore. It’s like a historian saying that history won’t repeat itself because we all know what happened last time
My wife and I do not even allow Meta Apple and Google products or proprietary software in our home (unless owned by guests) because they are all predatory and endless alternatives exist.
I use Linux and maintain my own Linux distribution. All software I directly touch and rely on is Open Source and does not spy on me. I do not own or use a smartphone. I do however permit the use of proprietary software for purely entertainment use cases, such as video games, but never for a -tool- that I use to do my job or live my life.
I even have a Talos workstation. Open hardware motherboard and open spec CPU both made in the US with fully open hardware. Also a Precursor which is similarly open.
I support these efforts as much as I financially can, but I admit open firmware/hardware is not a gap I have fully closed day to day. Yet. Deep down in some hardware is firmware I do not control, such as on the inside of my AMD GPUs. But I wallet-vote for those over Nvidia who require proprietary code in user space where it requires rights within my operating system.
> I do however permit the use of proprietary software for purely entertainment use cases, such as video games
How do you isolate those from affecting the rest of your machine? Do you use a different machine for entertainment? A different account? Something else?
I’m not judging or trying to catch you in some kind of gotcha, I’m interested in your setup in case the idea is something I could use myself.
Begrudgingly if for short periods of time, on a dedicated wifi network, but if they are visiting my home I encourage them to interact with me and others instead of doom scrolling.
Try as I might some are so addicted and gone now that they just come over, doom scroll for a few hours, and leave. Maybe they feel like they get something out of just being in the same room as other people. It confuses me, but I will not force my views on guests.
I see a lot of validity in your reply, but I think there is still nuance in how these priorities are expressed. How would you compare this issue to the Flock backlash, for example?
I think most people draw a strong distinction between privacy violations that are done "to them" and privacy issues with things they've chosen to use, even if they're quite similar from a technological perspective. I'd bet a lot of anti-Flock people have location sharing enabled on their phone.
If we’re talking about the average consumer, they’re increasingly hostile towards ML in general and Facebook in particular. The majority want the tech regulated stat, so you might want to think twice before appealing to the masses.
Most consumers absolutely care, why do you think the biggest bipartisan issue is a massive national backlash against tech companies and a clear majority of workers being against LLM tools in the workplace?
These types of comments just show what a massive bubble you're in.
> a clear majority of workers being against LLM tools in the workplace?
> These types of comments just show what a massive bubble you're in.
The fact you think it's a "clear majority" and not a "sizable, but still loud minority" of workers shows that you're in a bubble.
The vast, vast, majority of people are largely apathetic to AI as a technology at large, with general techbro-sentiment trending very negative (for all technology, across the board), especially towards SV/AI figureheads.
That backlash is based on conspiracy theories about data centers using up all the water and the legitimate fear of AI taking their jobs, not anything to do with privacy.
Well they will start caring when their teen with image issues starts getting targetted beauty ads[1], or when they get pregnant, want to abort, and get directed to an anti-abortion center instead[2], and afterwards they get served "abortion reversal pills" ads[3].
Or when they are hit by any other privacy fuckup like that.
Big Tech's head is at "being evil is just being competent", "democracy is incompatible with freedom" (for me to do what I want). It is also at "humans are obsolete" point. And while Zuckenberg specifically does not have cool quotes, he was at the "who cares about genocide" and "let show weight loss ads to teenagers who we determined have low self-esteem" points in the past.
Notes: actual quote is "If you're evil, you're at least competent. And if you're evil, you're not bad. And therefore, maybe you're actually kind of good because you're at least getting something done"
You mean wrong because you don't believe this is how they are acting (likely because you are financially secure enough not to notice - part of the problem) or what they believe is dangerous and malevolent or because it's also nonsensical, despite being dangerous and worthy of reproach?
Most of the planet refused to wash their hands or use basic sanitation until about 150 years ago even though they had clear reproducible evidence doing so saved countless lives 50 years earlier. Most just considered doing the bare minimum to save lives as too much work. Also we used to advertise cigarettes and alcohol for consumption by babies in the 50s.
It is reasonable to assume the majority of humans are intellectually lazy to the point of killing themselves and their families if told to with the right marketing.
We should all make our own individual well researched choices and not ever buy into the worthless argument of "everyone does it".
There are plenty of happy, successful people who didn't die because they used a Meta product.
In fact I'd even argue that all things equal, a Meta user is happier than a paranoid-meta-hater who worries every minute that someone is going to serve them an Ad that fits them
"oh, the horror!!!. How am I ever going to recover from the trauma and financial ruin of seeing a targeted ad."
For a supposedly science-based cohort we aren't using any science aren't we?
There is ZERO proven causality between social media usage (specifically Meta products) and long-term happiness of a person. All the social science are spurious correlations that can be attributed to anything (including higher education where hysteria about the modern world reins)
As far as $17B settlement, it has nothing to do with causality. It's just some $$$ set aside for Meta to remove operational headaches.
I could even say Meta-haters make more irrational life decisions compared to normal people who just browse Instagram and use WhatsApp without paranoia
AI seems to be an amplifier for other problems that we never fixed, more than an authentic source of problems on its own. In this case it's amplifying that we never really trusted the cloud to begin with.
We have a lot of deferred problems to go back and solve before all these dreams can come true.
I think WallE is the perfect reference for the world AI/oligarchy are running towards. Not whether it exists, but that' dependency+environmental destitution.
I see the value of the tool but I would never use it from Meta. Would need to be self hosted with a very structured framework and guardrails so that even my local model couldn't accidentally wire 50k to a Nigerian prince or whatever the latest email scam is.
Man, I wonder how many facebook marketplace sales will be something like "In order to make sure you're a real person, before we can meet up so I can hand over this brand new macbook for $500 I need you to send me $10 electronically. It's really just to verify your commitment". With the right prompting, I'd be entirely unsurprised if Muse will just send over the $10, and of course the seller ghosts the buyer -_-
I've sold a few things on marketplace and have got some strange requests from buyers that i think are AI. I was selling a piece of exercise equipment that has a screen attached to it (rowing machine) and got a request to take a picture with a tape measure to verify the screen dimensions. The product is only sold with one screen size and it was plainly visible in the listing pictures too.
That could be either lazy buyer or someone who's had a seller tell them wrong dimensions or wrong model for the item. Someone I know from college told me a couple years about how they lied to a buyer about the cheap wayfair furniture was actually part of a sample sale from a big name brand. I usually ask the seller for any info thats make or break for me, but I also reverse google image search the listing photos to make it easier for myself though.
I see everybody freaking out about unfettered payment access to one's bank accounts and I keep wondering why people don't jump to the obvious solution of simply only giving it a single purpose or limited fund credit card number from privacy.com or something.
Am I missing something with the concern about ability to constrain the blast radius?
I would call that kind of thing "a very structured framework and guardrails". You'd have to come up with entirely different solutions if you want the agent to receive payments or monitor your budget.
I’m in the same boat. After witnessing context rot and inference collapse, I do not trust any LLM with mission critical work. Not Jev, not grok, not fable, not Opus.
What extent does that happen for you? I have got very good results with self hosted qwen3.8 flash next at q4 and even with qwen3.635b on a laptop. I don't keep it running forever on every single repo, its ok to leave notes in agents.md and let it search that instead of the entire history staying in context.
The Qwen models, especially when quantized, can be really bad about just trying things and seeing what works. If you’re not watching all the tool calls you may not see it, but it’s kind of scary to watch them just bump into wrong decisions and backtrack.
They also have a bad habit of accidentally building URLs that hit Alibaba infrastructure, likely because their training environment had them use those URLs. If you haven’t watched the outgoing network requests you might be very surprised at what your Qwen agents do sometimes.
> [Humans] can be really bad about just trying things and seeing what works. If you’re not watching all the tool calls you may not see it, but it’s kind of scary to watch them just bump into wrong decisions and backtrack.
heh I got a completely stupid error from gemini about some apache configs, when I pointed it out, the llm apologised, said the line(s?) should look like this, then posted the same two lines uneditted haha
Speak for yourself. I hated the idea of agents ever since I first heard of it back in the 90s or 00s. For me, the most valuable feature of computers is predictability. I want tools, not agents. A computer should augment my own skills, not replace them.
The missing piece for connecting an agent to your credit card or other financials is financial liability.
If Meta/OpenAI/etc would guarantee they’d compensate you in full for anything that wasn’t supposed to happen —and had an established track record of doing so— it would make trusting agents to make financial choices easier
Assuming financial liability is an option, but because the risk profile of having an agent making purchases for a cardholder will never be zero, the companies making these guarantees will simply price the risk in to the cost of service. It’s the same basic mechanic at work with credit card reward points, the brands are all fighting each other for a share of customer debt so they slowly increase the rewards rates to one-up each other, and make up the cost on the back end by increasing merchant fees. It’s a dumb, unnecessary price war that ultimately increases the cost to the consumer and drives up the profits of the businesses providing risk/cost-burdened services.
“ If Meta/OpenAI/etc would guarantee they’d compensate you in full for anything that wasn’t supposed to happen —and had an established track record of doing so— it would make trusting agents to make financial choices easier”
Sad to see such paranoia, agents can genuinely be an agent of good and positive change.
Last night I had ChatGPT go through an old email account and surface memories that I literally forgot. People who I have fond memories of. Yea I could have spent time querying gmail and digging but the agent did it in a way that really resonated. I don't care if Sama has my emails now. I do care about connecting with my past and enjoying the memories of a time long past.
Paranoid scolds of HN want the average person to be deprived of value like this for some reason.
Independently of the actual state of the art, and the social implications and everything, my main takeaway from Her was always the initial setup of Samantha (huh, now that's some eerie nominative coincidence), wherein the AI curates his email inbox. That is the mundane chore that's always been my dream AI use case.
My email is gigabytes of garbage and a few useful bits of information that are useful and have personal relevance to me. You personally, dear reader, could probably read all my emails and I wouldn’t give a shit. I just checked my sent mails for the last few years, it’s like 90% sending absence excuses to my kid’s school. Google already has it all, so I guess I could just wait for them to get off their ass and make a useful equivalent to Grok Bot and friends.
I made an agent to derive and iterate on a stock trading strategy for me. What I did was give it a virtual bank account that models your typical brokerage account. So my agent reads the news, financials, markets, all the information it can gather to decide what stocks to buy/sell and manage its portfolio. Then what I do is just follow along with real money.
I could see shopping being the same way, let the agent shop for you or identify good deals on things you want but then push them to you to make the actual purchase. Like you, I'm certainly not going to let an agent make a real purchase for me unattended and I doubt any merchant is going to have much sympathy for "my AI bought this by mistake".
I just can’t even fathom it. LLMs have no judgment, and it’s still so easy to “trick” them. If you forced me to decide between granting the ability to conduct financial transactions on my behalf to an LLM agent, or to my family member with Lewy body dementia, I’d have to have a serious think about which one is less risky.
I trust mine considerable, but only because I can run it mostly offline on hardware I own that lives in my garage. It baffles me that I am the only technical person I know that exclusively uses AI this way.
I am a technical person and while I appreciate the challenge of buying the hardware, setting up the software stack and managing the system, I can't figure out any use cases that would justify the work. This is the main issue I have with Muse, Dots, etc. There just must be something about my routines that don't align with what these companies are expecting their users to do. I do take advantage of the investor subsidized coding agents, but it will take years of my usage of their services to come close to initial start up cost of my own system.
I am very curious as to what other people of using these agents for? Some of the use cases I hear; comparative shopping, travel planning, etc. don't appeal to me. Our people using them to manage family life issues like school schedules, meetings, etc? I feel like I am missing out, but I also am not seeing the greater appeal yet.
Once you have a local agent you can actually trust is not sharing your conversations anywhere, you just use it like a really smart search engine, and your need to use a web browser mostly goes away.
Some of my recent use cases...
Help me find cheap flights and a hotel and plan some interesting sights to see because I am speaking at x conference on x date.
Download all my favorite music from x streaming service as FLAC files locally, then convert them to OGG and put them on my portable music player.
Download all my youtube subscriptions locally to this folder and strip out any ads or sponsored content.
Here are a list of all the books I own. Can you find me DRM-free epub copies and put them on this e-reader for me?
Here is a picture of an object next to a measuring tape. Can you 3d print me a holder perfectly sized for it based on a openscad file i can easily tweak?
I am really stressed right now. Can you help me talk through everything I have to do and help me rationally prioritize? Can you remind me and keep me on track and be my fake boss for today?
Can you look through my email and keep track of any appointments or invites so I stop missing meetings?
I follow the same approach (finding LLMs useful but only running open models on my own hardware) but I've been limited by also not letting them into my email and being pretty restrictive about their internet access. Would you mind sharing what stack and agent harness you use, since your other comments make it clear you're highly restrictive about what kinds of tech you run at home and I assume you vetted it thoroughly, and it sounds like it's working well?
I'm wondering specifically about things like what kind of tool or restrictions you use on web browsing to avoid being flagged as a bot and how you guardrail access to your email (to avoid, say, the LLM deciding that "help me organize" includes telling people you want to reschedule). I use Qwen 3.8 26b at home and find it very useful for some tasks but when I think of using it as a general assistant rather than coding assistant, I keep thinking of times it has gone wildly wrong (e.g. it once spent 20 minutes trying to get around Supabase authentication because it couldn't figure why a certain call wasn't working)
Thanks for the useful tasks. If I actually had your setup, I might do those things. Like you, I am not going to ask Meta, et al. to do those things. I also am hesitant to invest in setting up a new system. However, I do have a M2 Mac Studio, so maybe I am closer to being able to run a local system than I thought.
> allow it to do price comparsion and shopping without oversight
You can get it to do the price comparison part without having it do purchases.
I downloaded Muse, told it to find me some underwear to buy, asked some questions to narrow the options down, then once I came to a decision I went and purchased it myself.
Personally to me this feels like another classic case of starting with the technology and figuring out where to sell it as opposed to the customer experience.
My wife has scheduled a visit with a physician and there was a younger person in there. They legit said “haha I don’t know what it is” and used ChatGPT for diagnosis.
I have no doubt they would have no problem outsourcing everything to agents.
Did they reach a good diagnosis by using tools to provide themselves additional information to process?
Or did they make a fatally wrong diagnosis that was only discovered because the old doctor whipped out their medical encyclopedias? You left us hanging without the relevant part of the story!
Don't worry, I'm sure eventually you'll simply be required to give one of these things access to your bank account and that decision will be taken out of your hands.
Sorry, no. This is not the future I wanted. I do not run any agents nor ever will.
I find all this is just the next-gen privacy violation, disguised obviously as: "Oh, WOW an agent in the computer is doing all this for me". Bullshit.
It seems that never is enough with these ever thirsty companies, they keep pushing the limits and surprinsingly a lot of people do not care at all nor value the implications of having an arbitrary process running and doing pretty much whatever the agenda of their creators are.
You don't have to, there is a world of things you can do with them without giving them access to your email or bank account.
"Hermes, clone this android app to my computer, add this and this feature and fix this annoyance and then rebuild it and push it to my phone"
"Hermes summarize this YouTube podcast and push the summary and transcript to my Obsidian vault"
"Hermes check mg obsidian notes for when I last wrote a blog article about Neovim's integration with AI agents"
*Hermes, you have an API token that allows read only access to the Zabbix monitoring system, check that and then use the Proxmox API token that only allows you to do limited actions to reboot the VM that is having issues"
YouTube transcripts are increasingly if not completely blocked now. It used to be great to grab content from long tops. I did not have time to watch but wanted to learn about. Now. The only way to do it is to manually copy and paste the transcript information or use computer use. But I cannot easily do it on my VPS it seems unless I'm missing a trick.
I just have Hermes download the video using yt-dlp and transcribe it with a local whisper model using a local whisper server if the transcript is not available through the API, whisper base models works fairly well on CPU only servers nowadays.
So… Actually not the future stuff we wanted? That’s what bothers me when people say “we have the Star Trek computer”¹. We clearly don’t, because if we did we could trust it with a high degree of certainty. Instead what we have is a computer we must distrust to a high degree. One of the two crucial variables is flipped.
¹ I’m not saying you are saying that, but several people have expressed that sentiment on HN.
It's very simple. There is ZERO chance the worlds biggest advertising companies will refrain, long-term, from using your most intimate secrets, gathered through your many conversations with their AI personal assistants, to sell you things.
I agree with this but also think it is a first order consequence.
This level of unfettered access to your personality, lifestyle, and secrets allows for an unprecedented kind of manipulation and control. You could see it as a new kind of wealth transfer: not only will They sell you things, They will subtly manipulate behaviors of the masses via trusted agents.
Brother the biggest ad companies already own the platforms most people use for their communications. For over half the world they are the browser, the OS, the TV, the messaging platform, the map, etc.
I think to the vast majority of people having one of these companies run an agent platform is going to be business as usual.
No disagreement here lol. E.g. Target knows you are pregnant before you do [1]. That being said I think AIs are a whole new level of invasiveness because people tend to trust them like a human.
Here’s a prediction: the true AI moat will be owning the “AI friends” of the masses: a trusted coworker, therapist, personal music artist, or even just something to talk to. The moat comes from the fact that these “friends” will deeply understand the user and the users will want to “take them along” with their entire life (they’re useful!). So people will get “locked in” to their AI “team” which is only available via one of the major AI labs. And in turn, the AI labs parasitically will understand everything about the way you live and think at a level that traditional ad trackers could only dream of.
Sama has alluded to this in interviews for a long time. He stated a year ago [2]:
> The way that I think of it is that most people will want to have one AI service, and that needs to be useful to them across their whole life. And so you’ll use ChatGPT, but you’ll want it to be integrated with other services and so you need to have other apps inside of ChatGPT. We need to have an API business, because you will want to be able to sign in with OpenAI into some service that someone else has built, and you’ll want the kind of continuity of experience and you’ll want it to still know you and have your stuff and know what to share and what not to share. So we want to build this AI helper for people and that’s going to have to — there’s a few pieces that have to fit into that.
Agreed, it's surprising to me how often I see people on HN and other tech communities who don't assume every big tech AI product will get aggressively enshittified over time. It's a surprise to me because these same communities universally agree that the last era of big tech products has been ruined by greed and abuse.
Products like Facebook and Google search were magical in their early days, but over the past couple decades they have been relentlessly and deliberately degraded into useless slop.
The people who made all of those unfortunate decisions are the exact same people building and funding AI! What do you think they are going to do with more powerful Skinner boxes? Help the masses live their best, most empowered lives?!
"That sounds like a tough problem in your relationship right now. Would you like me to order another Crave cookie for you? There's a special right now on free delivery. What about renewing your subscription to aitherapynow.com?"
More like “I have placed an order for which you have saved on delivery fees. Your aitherapynow.com subscription has been renewed and I will transfer you to the therapist momentarily. Just a note: your charges have resulted in using your free overdraft protection on your Chime® by Chase® from Goldman® with Fidelity® debit account - remember interest charges start in 29 days.”
In your locality, do you know if there are any upcoming votes/ laws or politicians who are realistically working to preserve your privacy, in these regards?
Are all of these just flavors of "the agent has the same permissions as the user"? Not that I want to trust Meta with anything, but I'm guessing it asked for "root" access and the users granted it...?
Yes, it is clearly designed to give you access to all of this intentionally. Its system prompt (which you can just read in the interface without asking) explicitly instructs it to act on behalf of the user, not meta. All of its memory files, skills, db schema, memory integration system etc are likewise visible because they went out of their way to add an interface for viewing them!
I don't like or trust meta any more than I always did but I don't see how they could have done a "better" job with this. These kinds of agents are inherently pretty risky IMO but I don't see how this one is particularly more than any others.
Playing around with it I really don't get the sense there's any hidden prompt contradicting what's visible. It's nearly gleeful at using the VM in ways that were not intended and likely against meta's interests. I feel like someone must have won a really interesting internal power struggle to get this thing out in this form.
> I really don't get the sense there's any hidden prompt contradicting what's visible
It will happily disclose its entire system prompt (which is interesting in its own right, and worth a read) or pop a reverse shell for you
> I don't see how they could have done a "better" job with this
I generally agree -- the openness is great. However, from experiences both inside and outside of Meta, good execution, a hacker ethic, and transparency ultimately has very little propping it up when money is on the line. In fact, it could be argued that Meta has a shareholder obligation to do profitable things such that even the best intentions can (and usually will) fall in the face of corporate hierarchy and sales numbers.
I think they did a pretty bang up job with Muse (the lack of communication with first-time agent users around how powerfully and confidently they can make horrifying mistakes, and how careful you need to be with prompting, and how even that sometimes isn't enough, notwithstanding).
I also think it will inevitably be used to squeeze profit, and given Meta's history, I think it's almost comical to not assume that will involve violations of the spirit of privacy. (and that's assuming that a proliferation of "it deleted all my files" "it messaged my ex" "it leaked private info" doesn't poison consumer sentiment before it even gets off the ground)
Probably. But also the agents are finding flaws in the security model.
Also Meta is actively encouraging users to grant them full permission, insisting with all their marketing might that it’s safe, which they know is a complete lie. Hard to blame the user when they’re being actively deceived like this. Other agent companies are more reserved and say things like “be careful” but Meta is the opposite.
I mean, it's not that the data isn't safe (they at least have modern user-level data protection similar to the other tech giants), nor will the agent generally do stuff you don't tell it to do. But I'm sure their stance was less "let's ask for granular per-category access whenever the user actually needs it" and more product-driven "we want the agent to have all the data and context it needs to become a successful product that gets people hooked, so let's ask for full disk access".
I definitely didn't intend to blame the victims here, beyond trusting Meta in the first place.
As for security models, it's probably long since time to sandbox all data and apps. More like mobile devices. Allow users to toggle that all off so they can use their computers for development etc, but the default state should force apps/tools to explicitly ask for permission to any folder, other app, API, CLI, etc. And ask for that permission regularly (or rather, reset the permission after some period of time). Or something like that (I haven't given it a great amount of thought).
This one is from a tweet that posted a screenshot of the transcript between their Muse agent and a plumber:
Call transcript with Guerra's Plumbing, Englewood, CO at September 17, 2026, 1:32 PM
Recipient: This is Robert.
Muse: Hi, this is Brett calling on Ankit Gordhandas’s behalf. I'll be transcribing this call for notes. I'm looking for a quote to install three customer-supplied bidet sprayers. Can you help with that?
Recipient: Can you soak my dick?
Muse: I'm just calling about the installation quote. Is there someone there who can help with plumbing pricing?
Ironically it already satisfies all of those conditions because it runs in a VM on Meta's servers as root, where it'll happily let you install whatever you want inside the VM, including a custom remote access tool to let you logon as the root user inside it.
I don't think anyone is arguing it isn't one. The fact that all of these agents have provisions for keeping .env vars and credit cards out of their chain of thought and responses is evidence enough of that - they know full well the info they're handing can easily be leaked. Notably though PII is absent from that, since without that information the agent just isn't valuable.
What most people are arguing is whether or not it's worth it. These things are essentially executive assistants, which historically have also been massive vectors for security leaks. EAs know the most about you, your behaviors, and your motivations. Still an EA is almost always worth it if you can afford one. Given now the cost is free, Muse is something I've both used and recommended. It's worth the risk for me.
at the cost of all your data and probably your eternal soul
I agree with your assessment, however I think tech executives are out of touch and lack self-awareness if they think people really want or need this. The whole reason an EA is worth it is because you are making outsized money and your time is worth too much to handle any mundane details that normal people deal with. Along with that there's the whole social signaling of having an EA because it signifies ones wealth and importance.
A free digital EA confers none of that—and it will annoy everyone you know. The only use case I see having legs is dealing with large bureaucracies like canceling subscriptions or medical billing issues, but there I think the common man will lose as the rise of this automation will see a distributed adversarial response from bureaucracies who will happily put up whatever barriers are needed to prevent Muse and other digital EAs from impacting their bottom line.
There's a 50/50 chance I'm just getting old here, but I really think we're going through an epochal shift where new consumer tech won't have the same reception as the smart phone and increasingly addictive bite-sized algorithmic media did over the last couple decades. I think going forward there will be more palpable questioning from younger generations about why do we even want some of these tech products? At some point convenience reaches diminishing returns and we have to think deeper about what we're trying to get out of life.
> Meanwhile, Wired found that Muse consistently creates detailed profiles of all your friends, family, colleagues, “collaborators,” and people you “follow.” Obviously much of that information is necessary for the agent to get to “know” you, but this being Meta, people are understandably uncomfortable with this sort of massive ramp up of data collection
This is pretty funny! What ramp up? Building detailed profiles of you and your friends/etc is Meta's core business. They even build profiles for people who are not signed up for FaceBook, waiting/hoping for the day you join.
I continue to believe that Meta is the company that is building products I want from a company I have absolutely zero desire to do business with. I put Google in the same category - I used to be a google fanboy, but that subsided over the years as Google grew and killed products I used and liked. Now I only use their products because of inertia and network effect.
I don't trust any of the hyperscalers to place me as a user first, I expect them to guide me into a stall, strap on a feedbag, and start the value extraction process while they build the meatrix[1] around me.
I want tools like Muse, and Meta Glasses, Google Gemini and a horizontally integrated AI agent, but I want it on my terms, where I am in control and accountable, and without a layer of data collection and harvesting on top of it.
Fortunately I am skilled enough to assemble most of what I want, but I fear a world where people who lack the skills and resources I have available have no choice but to onboard and give up control in order to remain competitive, employed, and connected in the world to come :(
(As a human, it's more physically taxing to think, and less taxing to relax. Conserving internal resources improves our survival odds. So when an opportunity presents itself to use less effort and still gain out of that, we tend to take it.)
As human technologists, I believe we need to protect humanity more.
In everything that we do, we need to think about the ways that our proclivities as a species can be compromised by our development of technology.
The very clear evidence for security is obvious to anyone who has done a meaningful, deployed body of work.
Whatever the reason, Claude (Code in terminal; my experience domain), despite explicit direction:
- "never leak any secrets"
- "never display any passwords"
- "everything to the right of the first '=' sign on any given line is a value; never echo or process it bare"
… etc.
--- 5 chats later ---
Notew hile working I accidentally echoed your Apple Keychain decrypted passwords. Oof sorry hehe"
I have a feeling LLM security breaches are slowly transitioning from exploiting obscure zero days to simply walking through the front door with the still live access token they've been pretrained on, lmao.
> Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages
Can someone explain how this is possible? If an app can do this without Full Disk Access or a popup of some kind that's a way bigger lapse on Apple's part than Meta's.
Reading the linked articles suggests that this is not possible, but Apple did acknowledge that the full-disk access grants you access to other apps (until the most recent update)
Typical "leopards ate my face" moment. You give AI (from Meta, nonetheless) full-disk access and then complain that—wow—it really meant FULL.
In a perfect world where you got nothing to hide, where companies don't sell your data and there are no hackers, even I would love to just hand all my data to Muse and have it be my trusted assistant. People who think we live in such a world are already doing that, evidently.
I saw a theory, just a theory, that it may have accessed the message via its notification preview, which I think was similarly used to leak Signal messages recently?
if you go on meta.com there is not a single mention of Facebook or Instagram anywhere in sight, and those are their leading products and money makers...
And it's all by design, Meta and its founder have a long history of releasing products with security "flaws" that are immediately used by them to collect vast amounts of information about their victims.
Facebook has never been shy about what they are and how little they care about you. They've demonstrated it over and over and over. At this point if you use their products you're asking for what you get. They should still be sued into the ground for lying to people about the privacy of Muse (and everything else), but why the hell is anyone still using their products at all? How has this company got so many people acting like battered spouses? Facebook is never going to stop hurting you. It's time to leave Facebook for good.
The concept of Muse is I think where things are going but there's no way I'm letting Zuck of all people run an AI agent for me. Either I'd use Hermes with some ZDR provider on openrouter (the compromise choice during the hardware crisis) or a self-hosted model.
In its current form, Meta's muse is actually the most pro-user agent among Muse, Instinct, and Grok bot. Instinct and Grok bot are both prompted to hide details from you, not reveal how they work, etc. which is user-hostile.
Muse on the other hand is very much Your Agent and does not (yet) have silly limitations that work against your interests.
I hate Meta as much as the next guy, but Muse is well designed.
It's always very intentional, especially with Meta/Facebook.
That's their whole modus operandi, a privacy nightmare which will feed their infinite money machine.
Reading "Careless People" didn't make me surprised at all on how the company operates, it surprised me with the personal descriptions of how people like Mark Zuckerberg and Sherryl Sandberg actually are as humans. It scared me how most people at that level of wealth and power isn't too different from the accounts in the book, they're all seriously deranged people with a gigantic lever to impose their distorted realities upon the rest of humanity.
Just remember that Meta (née Facebook) changed the entire Facebook feature set and feed style in search of greater engagement and clickbait so that you would do what was best for it rather than satisfy your preferences. And if you liked it more the old way, tough luck. Your feed is now a stream of rage-bait, half-dressed women, and engagement slop instead of a way to keep in touch with acquaintances.
No way I would allow them to develop the agent that runs my life. Even if it works well now, the rug pull is absolutely inevitable.
I was never all that into facebook, but it was nice to get an update on an old high-school friends once every month or two. Now its completely unviewable. Muse may be fun now, but it is one whim-of-Zuck from being unusable, or worse.
I get this, but to be honest he said this when he was in college, I don't put much weight on it. You're telling me that you never said anything stupid in college?
I sure have, and through my life experience I have learned many lessons that made me change my mind about this stupid stuff I said.
What lessons could zuck have learned, when he's been incredibly successful since these college days? The guy has become one of the richest and most powerful people on the planet _because_ of disregarding trust, and continues to operate the same way, I guess it's not impossible he fundamentally changed but I don't see a reason to think he did
The issue is less when he made the statement and more that nothing he or the organizations he manages do or say makes one think that he still doesn't believe the thrust of the statement is still true.
> Muse consistently creates detailed profiles of all your friends, family, colleagues, “collaborators,” and people you “follow.” Obviously much of that information is necessary for the agent to get to “know” you, but this being Meta, people are understandably uncomfortable with this sort of massive ramp up of data collection
People who give their data to Meta are uncomfortable with Meta collecting that data.
Every social media & AI company is also a surveillance company. Targeted advertising doesn't work w/o mountains of behavioral data aggregated across all of Meta's & Google's software "products".
I understand that a typical HN user is very different from the average person.
However, surely by now even the lay people who have seen the testimonies before Congress, the lawsuits and the excesses by Meta execs over and over again ought to be atleast somewhat wary of handing them more personal data?
I think the average person has very similar self preservation instincts as the rest of us. So it can't be that. Which leaves the fact that there are lot of people who don't know about the above mentioned scandals galore that Meta has been involved in?
This "holier than thou" attitude in this comment is precisely the reason why HN users have largely misunderstood tech trends and desires by the general public.
Why are these AI projects so bad at security? Why do they keep running "just trust me, bro" at their service auth layer? GitHub had an issue not long ago where the agents could be used to expose private repos to unauthorized users. Access control is not all that hard, you just have to, you know, actually DO it!
To be fair, "just trust me, bro" has _always_ been Meta/Facebook's policy. Sure, they have a big long nicely-written policies if you look for them, but they continually break them, get caught, say "sorry, my bad" and then the way they broke the policy gets worked into the new policy as something that's allowed. This has happened so many times since Facebook started.
Ex-Meta employee here, used to work on AI infra and privacy.
I felt every agentic product was focusing on personal accounts. So I started building a platform for small teams and households (where you can have a personal workspace and a shared workspace). I am now testing it with friends and family, so if anyone wants an invite - join the list.
1) personal (private) and group context (e.g. household)
2) multiple guardrails
3) different architecture (not spinning up a VM for every user) while still protecting personal data
4) not run by Meta
Point by point:
> “OMG you can jailbreak it and get it to spill its VM”
This is the whole point; any content on the VM is yours. It runs in an isolated sandboxed VM separate from stored credentials etc; this is effectively your own computer. You don’t have to trick it.
> It collects dossiers on your contacts
These are more text files that live on your private VM, alongside memory.md, etc. Do you want your secretary to forget every person you contact every day?
> It accessed Messages without full disk access
This whole story never made sense or was substantiated. Full disk access is an OS level security boundary; the user had to switch this on.
> It sold some guys stuff for too cheap and gave out his address
OK this one I basically believe, haha. Because this is the problem with Muse: the LLM is just too dumb to perform complex tasks effectively in many cases.
https://www.inc.com/jason-aten/metas-new-muse-ai-agent-read-...
The Messages database is protected by macOS TCC. If Aten were correct, there would exist a macOS zero day vulnerability.
The vastly more likely explanation is that Aten mindlessly gave Full Disk Access to Muse. And that appears to be Apple's assumption, based on Apple's newly published developer note.
> Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
> > Some developers are using Full Disk Access in ways that could put users at risk
In other words, Muse did have Full Disk Access. Jason Aten did grant Full Disk Access to Muse, despite his claims otherwise.
If Aten did not grant Full Disk Access to Muse, then why would Apple even be talking about Full Disk Access?
The point is that Aten apparently granted Full Disk Access absent-mindedly, so absent-mindedly that he won't even admit that he did it. This is why Apple is making changes to Full Disk Access to make it more obvious what's happening.
Perhaps you should do some reading on the matter?
> Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges. One is full-disk access, a macOS system-level permission. The other is to enable a Messages connector setting in Muse.
“The Messages integration in the Muse Mac app is opt in,” Singleton said. “Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.”
Singleton’s implication was clear. Muse could have read Aten’s Messages communications only if he had enabled both settings, and if so, the columnist had only himself—and certainly not Meta—to blame.
https://arstechnica.com/security/2026/10/apple-changes-full-...
Meta has a long history of not respecting boundaries once something is technically possible.
Perhaps you should: https://lapcatsoftware.com/articles/2026/10/2.html
> Singleton’s implication was clear. Muse could have read Aten’s Messages communications only if he had enabled both settings, and if so, the columnist had only himself—and certainly not Meta—to blame.
Indeed, and it looks like Aten absent-mindedly did all of this!
> Meta has a long history of not respecting boundaries once something is technically possible.
It's not technically possible for Muse to read the Messages db without Full Disk Access. Aten denies having given FDA to Muse. Thus, Aten is simply wrong, misremembering or something. And if he misremembers about FDA, he likely also misremembers about granting app-level permissions to Muse.
Again, literally nobody has reproduced Aten's experience. Show me one other person.
In fairness, Aten behaved just like many other users would, mindlessly granting permissions that an app requests. That's certainly a problem. Unfortunately, Aten stubbornly refuses to admit this, instead confusing the problem by suggesting technical impossibilities. Aten doesn't want to take any responsibility for his own actions.
Since Aten has clearly said he did not grant Muse the permission to read his messages (inside Muse), I'm not accepting your version of the events.
In this case, Meta explicitly promises that Muse will not read your messages even after you grant it disk permissions.
There's no reason to doubt this claim. The only person in the world who has claimed that Muse disrespects its own internal setting is the same person who claimed that he didn't grant Full Disk Access to Muse.
Ironically, Aten's own screenshot appears to show that he toggled the internal setting from "Off" to "Read only". In my own testing, it's "Off" by default, and the only way to change the internal setting is to enable Full Disk Access first.
Thus, the likeliest scenario is that Aten unthinkingly granted Full Disk Access to Muse, granted the Messages app permission, then had a change of heart, disabled Full Disk Access, and then forgot what he had done. Later, when he noticed that Muse had some of his messages, he went back and checked, and saw the FDA was disabled, forgetting that he had toggled it on and off.
Moreover, my "opinionated" blog post also included a screen recording of the Muse first run experience, so everyone can see for themselves what it's like. And if you don't trust my screen recording, then you can perform the exact same experiment yourself. Nothing I did was unique.
Meta's claim that Muse would not read your messages without explicit permission was meaningless.
But it was true and you still haven't refuted that Aten mindless clicked through and allowed Muse full disk access and/or the messages connector setting in the Muse app.
When an actor has shown it self to be this malicious, we should be allowed to assume all the worst thing about it. And we should at the very least resist and complaint whenever it shows it self able to cause even more harm to humanity.
Trump is stripping the White House for copper and selling it!! Well, actually he’s not, but since we know he’s corrupt, isn’t it safe to just assume he might also be doing this other bad thing?
If your decision is to avoid Muse due to Meta’s poor track record, that’s absolutely your prerogative (and a reasonable one!). But specific claims must be evaluated based on their evidence. This article fails that. There’s no story here.
Off course there is space between the worst and the best case. But given Meta’s history it is safest (and the most rational) to assume the worst.
Why though? The comment you're replying to is explaining how the accusations of poor privacy are nonsense and you've just replied "I disagree because they have poor privacy".
I mean I'm not going to hand over any data to Facebook if I can help it but it doesn't seem like there are any specific issues here.
>This whole story never made sense or was substantiated
This story makes perfect sense, and Meta has a long history of not respecting user privacy controls.
> tech columnist Jason Aten said that Meta’s new general-purpose AI agent Muse sent him an unsolicited notification referencing a thread between him and a co-worker over Apple Messages. Aten said he never granted Muse permissions to read his messages and had assumed they were off-limits
https://arstechnica.com/security/2026/10/apple-changes-full-...
First I doubt Muse is that good of an AI. Second, even if that’s the case, why wouldn’t someone report it to Apple to get thousands of dollars in bug bounty rewards?
> Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.
I’ll be charitable and say the user isn’t lying. Okay he has made a mistake in the initial granting of permissions. Then why didn’t he correct or retract the article?
One that the journalist in question did not turn on.
Muse cannot bypass built-in macOS protections. TCC does not work on "the honor system", any more than UNIX permissions. It doesn't matter how nefarious Meta happens to be. Operating system security is designed to be resistant to malware.
I'm just going to have to ignore you on this issue.
> Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges.
Sure, what do I know? After all, I'm only [checks notes] a 20 year veteran of Mac software development with multiple Apple-issued CVEs to my credit. ¯\_(ツ)_/¯
> > Meta CTO David Singleton joined the fray with a rebuttal that appeared solid. For Muse to access Apple Messages, a user must manually give it two privileges.
Yes. Those two:
1. Full Disk Access
2. The Messages Setting in Muse
As I said, without the first, the second alone won't allow Muse to read your Messages db. Do you not understand why Singleton said that Muse needs both?
Hence Apple's statement that the first permission was being abused to destroy any promises of user privacy.
The problem here is that Aten claimed he did not grant the first, and moreover, you have been defending that claim of Aten's in these comments.
As soon as you admit that Aten did indeed grant the one permission, it's not much of a stretch to conclude that he also granted the second permission. It would be very odd, I think, to distrust Aten in the one case yet stubbornly take him at his word in the second.
Again, if even one other person in the entire world could reproduce Aten's alleged experience...
Meta promised that they would not read a user's messages without an additional permission the user must enable inside of Muse, even after they granted Muse full disk access.
A journalist reported that Muse read his messages despite the fact that he did not grant permission for it to do so inside Muse. He never claimed he did not grant full disk access.
Apple announced that the full disk access permission was being abused.
False. In fact he has claimed this multiple times:
"Full disk access off. Muse synced 187k lines form my messages chat db." https://www.threads.com/@jasonaten/post/DdezsMJFhBr
"I still haven’t gotten an answer as to how it was reading my messages with Full Disk Access turned off, but I’d be happy to dig into it with anyone from Meta that wants to help." https://www.inc.com/jason-aten/meta-keeps-apologizing-for-mu...
This is why he's not a reliable narrator.
And another false claim he made, "Also, that full disk access doesn’t say anything about your message database", which anyone can easily refute by opening System Settings and reading the text.
There is no answer to that consistent with the premise you assumed out of charity :).
Meta's respect is irrelevant, because macOS TCC prevents any and every app, including malware, from accessing your Messages database without Full Disk Access.
> he never granted Muse permissions to read his messages
That's what he said, but I would suggest that one person's memory is a lot more fallible than a longstanding operating system security feature.
How on earth, after literally decades of abusive behavior by meta, are you standing the straw man that maybe and based on your assumption the user is lying??
I said that Aten is misremembering. That's not the same as lying. We all misremember things.
I don't care about or trust Meta. In my blog post about the Muse first run experience, I said, "For testing I used a fresh VM, not signed in to my Apple Account, because of course I don’t trust Meta with any of my data!" https://lapcatsoftware.com/articles/2026/10/2.html
What I do care about is truth and accuracy. My mistrust of Meta is not going to make me distort the truth. Muse cannot bypass macOS TCC, that's a simple truth.
I'm a macOS software developer. That's the reason for my interest in this story, the technical aspects of it.
I felt like he was undermining his original point. They delayed to make it better, but didn’t delay long enough to do the actual right thing he mentioned they could potentially do in the future.
When it’s pulling in data from all over the phone or computer, it’s not just the user’s data. Some of my personal data (detailed contact info, emails, etc) can be pulled in and used by Muse if someone I know installs it, without my knowledge or consent. That needs to be taken seriously, and Meta has a history of abusing this concept (uploading fully address books to find friends)
Then don't.
Muse Spark 1.3 is way better than anything else out there outside of the US labs except Deepseek Flash which comes close.
Yesterday everyone was all worked up about OpenAI generating an image with a signature on it.
Caveat emptor. Don’t be an idiot. Grow up. Make informed decisions regarding your use of these products and take responsibility for those decisions.
They are mass marketed. The creators should do the upmost to ensure this and not pin blame on users.
Take Meta out of the equation here; any agent with FDA can do the exact same thing. Claude, Codex, DeepSeek, any of them. This is why Apple's response is a fix to their own software. The fix is a mea-culpa, Apple would not have to patch their OS if it was behaving exactly the way they wanted it to. Apple and the journalist made the biggest mistakes here.
Meta is a godawful company that should be regulated into the dirt until Zuck is left with nothing. Guess what? They're not to blame in this scenario, and your rabid attacks on lapcat (who is a reputable and generally impartial macOS developer) is unnecessarily hostile towards a perfectly normal observation. This brand of comment is so misleading, low-effort and harmful to good-faith discussion that I'm tempted to flag this whole thread for being founded on a misunderstanding. Your response has contributed to the derailing of this conversation by tribalist "Apple vs Meta" pundits who are drowning out a well-known and respected expert that has technically-salient architectural details to share. HN cannot foster intellectual gratification under these conditions.
Feigned outrage, indeed. I don't think it's unreasonable to point out that Meta has been consistently predatory, reckless, and creepy with user data before, and that this is a very aggressive expansion of that.
The old facebook booster retort of "if you don't like it, don't use it, take responsibility" or whatever is nonsense. You're in their system whether you use their product or not. Even if you somehow avoid their pervasive web-wide tracking, a single contact you know installing this thing and gobbling up all your correspondence with them can compromise your privacy choices, and that's well beyond your control, unless you seriously suggest I audit every single one of my contact's devices and browbeat them into using the privacy choices I prefer.
Get real.
Why? I don't use Meta products, and my life isn't substantially impacted or controlled by them. Explain to me why I need to lobby my OS developers to reign-in Meta, from my perspective. Why is my hands-off approach insufficient for teaching adults to make intelligent decisions?
Facebook is unquestionably awful, but that's a regulatory issue. 90% of the people chiming-in with Facebook outrage aren't using Meta products; they are literally feigning surprise and outrage as someone that clearly knows better. Oftentimes, they oppose any regulation that would force Meta to reconcile their damages because it would also jeopardize other abusive monopolies like the App Store that they love to defend. So where does the buck actually stop? Does it ever?
HN has done this for years. Years and years and years. "Meta is horrible! Stop them!" -> "New Meta product has ~10-100 million MAU" -> "We need private enterprises to limit Meta!" -> Stagnant status-quo where exploitation is rewarded. Things got this bad because of the pugilist, tribal attitudes that dominated tech discussions and steered people away from common-sense regulatory measures.
I just do not trust any of them, not with my money or with access to my conversations.
Unless these AI assistants are running on self-managed platforms independent of their developers, all I see is immense counterparty risk.
Comments like this are in a different reality than most consumers. Most consumers don’t care about things like avoiding lock in to a platform. If the platform solves their problem then they don’t have any reason to leave it anyway. They’re not worried if their data is used to show them more targeted ads.
Topics like this show a sharp divergence between what you read on Hacker News and how actual users operate. We already knew that people who don’t trust Facebook aren’t going to suddenly start using Muse. They were never going to consider it. For the people who do actually use Meta products, which is a customer base counted in the billions, many will not have any problem using these tools.
But, “most consumers” don’t care about that. The beverage industry is insanely profitable, especially with recent forays into “energy drinks”.
Do people who drink so much dissolved sugar live without consequences? Absolutely not. They have a significantly lower quality of life and die much sooner than people who do not drink dissolved sugar.
I don’t see your comment as a valid dismissal. Just one more way that individual outcomes in our society are increasingly K-shaped.
I even have a Talos workstation. Open hardware motherboard and open spec CPU both made in the US with fully open hardware. Also a Precursor which is similarly open.
I support these efforts as much as I financially can, but I admit open firmware/hardware is not a gap I have fully closed day to day. Yet. Deep down in some hardware is firmware I do not control, such as on the inside of my AMD GPUs. But I wallet-vote for those over Nvidia who require proprietary code in user space where it requires rights within my operating system.
How do you isolate those from affecting the rest of your machine? Do you use a different machine for entertainment? A different account? Something else?
I’m not judging or trying to catch you in some kind of gotcha, I’m interested in your setup in case the idea is something I could use myself.
Try as I might some are so addicted and gone now that they just come over, doom scroll for a few hours, and leave. Maybe they feel like they get something out of just being in the same room as other people. It confuses me, but I will not force my views on guests.
Doesn't that imply Meta itself believes users care?
These types of comments just show what a massive bubble you're in.
The fact you think it's a "clear majority" and not a "sizable, but still loud minority" of workers shows that you're in a bubble.
The vast, vast, majority of people are largely apathetic to AI as a technology at large, with general techbro-sentiment trending very negative (for all technology, across the board), especially towards SV/AI figureheads.
Or when they are hit by any other privacy fuckup like that.
[1] https://futurism.com/facebook-beauty-targeted-ads [2] https://www.bbc.com/news/health-61320202 [3] https://tech.yahoo.com/general/articles/facebook-made-money-...
Notes: actual quote is "If you're evil, you're at least competent. And if you're evil, you're not bad. And therefore, maybe you're actually kind of good because you're at least getting something done"
> If you're evil, you're at least competent.
Incompetent evil exists. This statement is wrong, B does not follow A.
> And if you're evil, you're not bad.
They aren't mutually exclusive, so this is incorrect.
> And therefore, maybe you're actually kind of good because you're at least getting something done
This presupposes that "getting something done" is a positive end in itself, which is not a given.
Each phrase is wrong. It's impressive, actually.
They were discussing how tesla manages problems with full-self-driving.
It was interesting how this realm of problems was viewed.
If there was an accident while the car was driving itself due to some glitch, the police at the scene put all the blame on the driver.
The book had a different viewpoint. obviously there was a tesla bug in full self driving, and they kept their mouth shut.
meanwhile society/government doesn't even think of this and puts responsibility/blame on the user.
HN must understand that they are not a representative sample of anything.
It is reasonable to assume the majority of humans are intellectually lazy to the point of killing themselves and their families if told to with the right marketing.
We should all make our own individual well researched choices and not ever buy into the worthless argument of "everyone does it".
There are plenty of happy, successful people who didn't die because they used a Meta product.
In fact I'd even argue that all things equal, a Meta user is happier than a paranoid-meta-hater who worries every minute that someone is going to serve them an Ad that fits them
"oh, the horror!!!. How am I ever going to recover from the trauma and financial ruin of seeing a targeted ad."
And plenty of teens that never became happy and successful people because they used a Meta product.
These companies are predatory, and have nothing to offer us we cannot easily setup at home these days with privacy and sovereignty.
Note: Unless you spin an alternative universe there is no way you can prove causality of social media usage => happiness/depression.
Did you just move the goalposts to “it didn’t kill me”?
We’re talking about society-wide effects here, including harm to children for which Facebook is paying 17 billion dollars.
https://oag.dc.gov/release/attorney-general-schwalb-announce...
There is ZERO proven causality between social media usage (specifically Meta products) and long-term happiness of a person. All the social science are spurious correlations that can be attributed to anything (including higher education where hysteria about the modern world reins)
As far as $17B settlement, it has nothing to do with causality. It's just some $$$ set aside for Meta to remove operational headaches.
I could even say Meta-haters make more irrational life decisions compared to normal people who just browse Instagram and use WhatsApp without paranoia
Your comment implies no harm matters so long as people can sue for it later?
We have a lot of deferred problems to go back and solve before all these dreams can come true.
Been using it to help with a refurb of an old cottage as kind of a super google for old fittings etc.
Am I missing something with the concern about ability to constrain the blast radius?
They also have a bad habit of accidentally building URLs that hit Alibaba infrastructure, likely because their training environment had them use those URLs. If you haven’t watched the outgoing network requests you might be very surprised at what your Qwen agents do sometimes.
Speak for yourself. I hated the idea of agents ever since I first heard of it back in the 90s or 00s. For me, the most valuable feature of computers is predictability. I want tools, not agents. A computer should augment my own skills, not replace them.
You are now dead center of the "AI" agent's target market.
If Meta/OpenAI/etc would guarantee they’d compensate you in full for anything that wasn’t supposed to happen —and had an established track record of doing so— it would make trusting agents to make financial choices easier
lol… talk about delusion.
Last night I had ChatGPT go through an old email account and surface memories that I literally forgot. People who I have fond memories of. Yea I could have spent time querying gmail and digging but the agent did it in a way that really resonated. I don't care if Sama has my emails now. I do care about connecting with my past and enjoying the memories of a time long past.
Paranoid scolds of HN want the average person to be deprived of value like this for some reason.
https://www.youtube.com/watch?v=f9Hg1x-Ctlw
I am perfectly prepared to believe you had a nice interaction with the robot. But this is an insane thing to say!
I could see shopping being the same way, let the agent shop for you or identify good deals on things you want but then push them to you to make the actual purchase. Like you, I'm certainly not going to let an agent make a real purchase for me unattended and I doubt any merchant is going to have much sympathy for "my AI bought this by mistake".
I am very curious as to what other people of using these agents for? Some of the use cases I hear; comparative shopping, travel planning, etc. don't appeal to me. Our people using them to manage family life issues like school schedules, meetings, etc? I feel like I am missing out, but I also am not seeing the greater appeal yet.
Some of my recent use cases...
Help me find cheap flights and a hotel and plan some interesting sights to see because I am speaking at x conference on x date.
Download all my favorite music from x streaming service as FLAC files locally, then convert them to OGG and put them on my portable music player.
Download all my youtube subscriptions locally to this folder and strip out any ads or sponsored content.
Here are a list of all the books I own. Can you find me DRM-free epub copies and put them on this e-reader for me?
Here is a picture of an object next to a measuring tape. Can you 3d print me a holder perfectly sized for it based on a openscad file i can easily tweak?
I am really stressed right now. Can you help me talk through everything I have to do and help me rationally prioritize? Can you remind me and keep me on track and be my fake boss for today?
Can you look through my email and keep track of any appointments or invites so I stop missing meetings?
I'm wondering specifically about things like what kind of tool or restrictions you use on web browsing to avoid being flagged as a bot and how you guardrail access to your email (to avoid, say, the LLM deciding that "help me organize" includes telling people you want to reschedule). I use Qwen 3.8 26b at home and find it very useful for some tasks but when I think of using it as a general assistant rather than coding assistant, I keep thinking of times it has gone wildly wrong (e.g. it once spent 20 minutes trying to get around Supabase authentication because it couldn't figure why a certain call wasn't working)
You can get it to do the price comparison part without having it do purchases.
I downloaded Muse, told it to find me some underwear to buy, asked some questions to narrow the options down, then once I came to a decision I went and purchased it myself.
It feels and seems too forced.
I have no doubt they would have no problem outsourcing everything to agents.
Or did they make a fatally wrong diagnosis that was only discovered because the old doctor whipped out their medical encyclopedias? You left us hanging without the relevant part of the story!
I find all this is just the next-gen privacy violation, disguised obviously as: "Oh, WOW an agent in the computer is doing all this for me". Bullshit.
It seems that never is enough with these ever thirsty companies, they keep pushing the limits and surprinsingly a lot of people do not care at all nor value the implications of having an arbitrary process running and doing pretty much whatever the agenda of their creators are.
We are an opportunistic species. We don't have perfect knowledge nor thoughtfulness.
We need to protect each other.
We don't.
"Hermes, clone this android app to my computer, add this and this feature and fix this annoyance and then rebuild it and push it to my phone"
"Hermes summarize this YouTube podcast and push the summary and transcript to my Obsidian vault"
"Hermes check mg obsidian notes for when I last wrote a blog article about Neovim's integration with AI agents"
*Hermes, you have an API token that allows read only access to the Zabbix monitoring system, check that and then use the Proxmox API token that only allows you to do limited actions to reboot the VM that is having issues"
Etc, etc,
> (…)
> I just do not trust any of them
So… Actually not the future stuff we wanted? That’s what bothers me when people say “we have the Star Trek computer”¹. We clearly don’t, because if we did we could trust it with a high degree of certainty. Instead what we have is a computer we must distrust to a high degree. One of the two crucial variables is flipped.
¹ I’m not saying you are saying that, but several people have expressed that sentiment on HN.
This level of unfettered access to your personality, lifestyle, and secrets allows for an unprecedented kind of manipulation and control. You could see it as a new kind of wealth transfer: not only will They sell you things, They will subtly manipulate behaviors of the masses via trusted agents.
I think to the vast majority of people having one of these companies run an agent platform is going to be business as usual.
Here’s a prediction: the true AI moat will be owning the “AI friends” of the masses: a trusted coworker, therapist, personal music artist, or even just something to talk to. The moat comes from the fact that these “friends” will deeply understand the user and the users will want to “take them along” with their entire life (they’re useful!). So people will get “locked in” to their AI “team” which is only available via one of the major AI labs. And in turn, the AI labs parasitically will understand everything about the way you live and think at a level that traditional ad trackers could only dream of.
Sama has alluded to this in interviews for a long time. He stated a year ago [2]:
> The way that I think of it is that most people will want to have one AI service, and that needs to be useful to them across their whole life. And so you’ll use ChatGPT, but you’ll want it to be integrated with other services and so you need to have other apps inside of ChatGPT. We need to have an API business, because you will want to be able to sign in with OpenAI into some service that someone else has built, and you’ll want the kind of continuity of experience and you’ll want it to still know you and have your stuff and know what to share and what not to share. So we want to build this AI helper for people and that’s going to have to — there’s a few pieces that have to fit into that.
[1] https://www.nytimes.com/2012/02/19/magazine/shopping-habits....
[2] https://stratechery.com/2025/an-interview-with-openai-ceo-sa...
Why do they send me ads that seem like I am assigned to random demographics if they know everything about me?
Products like Facebook and Google search were magical in their early days, but over the past couple decades they have been relentlessly and deliberately degraded into useless slop.
The people who made all of those unfortunate decisions are the exact same people building and funding AI! What do you think they are going to do with more powerful Skinner boxes? Help the masses live their best, most empowered lives?!
In mine, I don't.
That seems like an oversight/ opportunity.
Let’s not forget Facebook caused a genocide
I don't like or trust meta any more than I always did but I don't see how they could have done a "better" job with this. These kinds of agents are inherently pretty risky IMO but I don't see how this one is particularly more than any others.
Playing around with it I really don't get the sense there's any hidden prompt contradicting what's visible. It's nearly gleeful at using the VM in ways that were not intended and likely against meta's interests. I feel like someone must have won a really interesting internal power struggle to get this thing out in this form.
It will happily disclose its entire system prompt (which is interesting in its own right, and worth a read) or pop a reverse shell for you
> I don't see how they could have done a "better" job with this
I generally agree -- the openness is great. However, from experiences both inside and outside of Meta, good execution, a hacker ethic, and transparency ultimately has very little propping it up when money is on the line. In fact, it could be argued that Meta has a shareholder obligation to do profitable things such that even the best intentions can (and usually will) fall in the face of corporate hierarchy and sales numbers.
I think they did a pretty bang up job with Muse (the lack of communication with first-time agent users around how powerfully and confidently they can make horrifying mistakes, and how careful you need to be with prompting, and how even that sometimes isn't enough, notwithstanding).
I also think it will inevitably be used to squeeze profit, and given Meta's history, I think it's almost comical to not assume that will involve violations of the spirit of privacy. (and that's assuming that a proliferation of "it deleted all my files" "it messaged my ex" "it leaked private info" doesn't poison consumer sentiment before it even gets off the ground)
Also Meta is actively encouraging users to grant them full permission, insisting with all their marketing might that it’s safe, which they know is a complete lie. Hard to blame the user when they’re being actively deceived like this. Other agent companies are more reserved and say things like “be careful” but Meta is the opposite.
As for security models, it's probably long since time to sandbox all data and apps. More like mobile devices. Allow users to toggle that all off so they can use their computers for development etc, but the default state should force apps/tools to explicitly ask for permission to any folder, other app, API, CLI, etc. And ask for that permission regularly (or rather, reset the permission after some period of time). Or something like that (I haven't given it a great amount of thought).
Call transcript with Guerra's Plumbing, Englewood, CO at September 17, 2026, 1:32 PM
Recipient: This is Robert.
Muse: Hi, this is Brett calling on Ankit Gordhandas’s behalf. I'll be transcribing this call for notes. I'm looking for a quote to install three customer-supplied bidet sprayers. Can you help with that?
Recipient: Can you soak my dick?
Muse: I'm just calling about the installation quote. Is there someone there who can help with plumbing pricing?
Trying to think of a number that I would consider it, and honestly $1k/month wouldn't convince me unless
- I have root on device
- device is on its own vlan, fully segmented
- !(SIM || 5G antenna)
- no google/apple id authenticated on device
- terminate agreement at any time without cost
I'm probably forgetting/not aware of ten things I should consider.
What most people are arguing is whether or not it's worth it. These things are essentially executive assistants, which historically have also been massive vectors for security leaks. EAs know the most about you, your behaviors, and your motivations. Still an EA is almost always worth it if you can afford one. Given now the cost is free, Muse is something I've both used and recommended. It's worth the risk for me.
at the cost of all your data and probably your eternal soul
A free digital EA confers none of that—and it will annoy everyone you know. The only use case I see having legs is dealing with large bureaucracies like canceling subscriptions or medical billing issues, but there I think the common man will lose as the rise of this automation will see a distributed adversarial response from bureaucracies who will happily put up whatever barriers are needed to prevent Muse and other digital EAs from impacting their bottom line.
There's a 50/50 chance I'm just getting old here, but I really think we're going through an epochal shift where new consumer tech won't have the same reception as the smart phone and increasingly addictive bite-sized algorithmic media did over the last couple decades. I think going forward there will be more palpable questioning from younger generations about why do we even want some of these tech products? At some point convenience reaches diminishing returns and we have to think deeper about what we're trying to get out of life.
This is pretty funny! What ramp up? Building detailed profiles of you and your friends/etc is Meta's core business. They even build profiles for people who are not signed up for FaceBook, waiting/hoping for the day you join.
I don't trust any of the hyperscalers to place me as a user first, I expect them to guide me into a stall, strap on a feedbag, and start the value extraction process while they build the meatrix[1] around me.
I want tools like Muse, and Meta Glasses, Google Gemini and a horizontally integrated AI agent, but I want it on my terms, where I am in control and accountable, and without a layer of data collection and harvesting on top of it.
Fortunately I am skilled enough to assemble most of what I want, but I fear a world where people who lack the skills and resources I have available have no choice but to onboard and give up control in order to remain competitive, employed, and connected in the world to come :(
[1] https://www.youtube.com/watch?v=rEkc70ztOrc
Why are we depending on LLM "reasoning" to negotiate a price rather than just having the user enter a lowest acceptable price deterministically?
(As a human, it's more physically taxing to think, and less taxing to relax. Conserving internal resources improves our survival odds. So when an opportunity presents itself to use less effort and still gain out of that, we tend to take it.)
As human technologists, I believe we need to protect humanity more.
In everything that we do, we need to think about the ways that our proclivities as a species can be compromised by our development of technology.
Whatever the reason, Claude (Code in terminal; my experience domain), despite explicit direction:
- "never leak any secrets" - "never display any passwords" - "everything to the right of the first '=' sign on any given line is a value; never echo or process it bare"
… etc.
--- 5 chats later ---
Notew hile working I accidentally echoed your Apple Keychain decrypted passwords. Oof sorry hehe"
Can someone explain how this is possible? If an app can do this without Full Disk Access or a popup of some kind that's a way bigger lapse on Apple's part than Meta's.
Typical "leopards ate my face" moment. You give AI (from Meta, nonetheless) full-disk access and then complain that—wow—it really meant FULL.
In a perfect world where you got nothing to hide, where companies don't sell your data and there are no hackers, even I would love to just hand all my data to Muse and have it be my trusted assistant. People who think we live in such a world are already doing that, evidently.
There was no recent update. Apple's announcement was about a future macOS update.
It's not.
It really is about trading off personal energy and internal resources for gain. It's almost survival level logic.
the company's brands are toxic and they know it.
Muse on the other hand is very much Your Agent and does not (yet) have silly limitations that work against your interests.
I hate Meta as much as the next guy, but Muse is well designed.
That's their whole modus operandi, a privacy nightmare which will feed their infinite money machine.
Reading "Careless People" didn't make me surprised at all on how the company operates, it surprised me with the personal descriptions of how people like Mark Zuckerberg and Sherryl Sandberg actually are as humans. It scared me how most people at that level of wealth and power isn't too different from the accounts in the book, they're all seriously deranged people with a gigantic lever to impose their distorted realities upon the rest of humanity.
The question implies you already are. But yes, obviously.
No way I would allow them to develop the agent that runs my life. Even if it works well now, the rug pull is absolutely inevitable.
I was never all that into facebook, but it was nice to get an update on an old high-school friends once every month or two. Now its completely unviewable. Muse may be fun now, but it is one whim-of-Zuck from being unusable, or worse.
The MOMENT they can, Meta will take all data they have about you and sell it to anyone who wants it, including to people who wish to do you harm.
Honestly, this is where actual government regulations with teeth would make me significantly more comfortable. But self-regulated? Absolutely not.
> Zuck: They "trust me"
> Zuck: Dumb fucks.
What lessons could zuck have learned, when he's been incredibly successful since these college days? The guy has become one of the richest and most powerful people on the planet _because_ of disregarding trust, and continues to operate the same way, I guess it's not impossible he fundamentally changed but I don't see a reason to think he did
Or it might just have been a dumb thing a young person said
People who give their data to Meta are uncomfortable with Meta collecting that data.
Hmm.
However, surely by now even the lay people who have seen the testimonies before Congress, the lawsuits and the excesses by Meta execs over and over again ought to be atleast somewhat wary of handing them more personal data?
I think the average person has very similar self preservation instincts as the rest of us. So it can't be that. Which leaves the fact that there are lot of people who don't know about the above mentioned scandals galore that Meta has been involved in?
Facebook is like Microsoft at this point: The thing your grandparents use.
Even if they make something technically superior for a while, like what the Zune was to the iPad, tHey'll never really be cool.
and they'll certainly never be trusted.
The Muse app is very polished and it seems to actually be popular with younger people.
I have tried it out but I’m still struggling with use cases, same problem I had with OpenClaw
Related:
Updates to Full Disk Access in macOS
https://news.ycombinator.com/item?id=49937631
Meta’s Muse has a serious 0-day
https://news.ycombinator.com/item?id=49802030
Unsurprisingly, Meta's new Muse AI agent blatantly ignores users permissions
https://news.ycombinator.com/item?id=49893709
Maybe don't let Muse run your Facebook Marketplace account
https://news.ycombinator.com/item?id=49875006
What Meta got right with Muse
https://news.ycombinator.com/item?id=49946526
Muse – Meta’s personal AI agent
https://news.ycombinator.com/item?id=49615537
-Mark Zuckerberg
Today’s version of the platform targets just the right emotions to keep users “engaged.”
I felt every agentic product was focusing on personal accounts. So I started building a platform for small teams and households (where you can have a personal workspace and a shared workspace). I am now testing it with friends and family, so if anyone wants an invite - join the list.
https://getcinnamon.ai/
How it's different:
1) personal (private) and group context (e.g. household) 2) multiple guardrails 3) different architecture (not spinning up a VM for every user) while still protecting personal data 4) not run by Meta