Jason Aten says Muse synced more than 187,000 rows from his Mac’s Messages database, though he had declined access. Meta says reading messages requires two switches to be on. Nobody has checked which account is right.
Useful Tasks Bring Access Decisions With Them
The appeal of agents is concrete. OpenAI’s Dots runs recurring tasks and connects to more than 4,000 apps through plugins. It can draft an invoice, then send it after approval. Custom rules can allow an action, block it, or require approval.
One MetaMuse user says it canceled an unused $200-a-month subscription, drafts email for his review, repeats online tasks, and sorts tax expenses. He says the tax work went from close to 40 hours a year to about 7 minutes. Those are his accounts of his own use.
Approval before sending an invoice is a clear control. Aten’s report raises a different question: what happened when he declined Messages access? Meta’s explanation and his account have not been checked against each other.
The Access Claims Still Need Checking
Apple’s October 2 developer note warned that full-disk-access risks will grow as agents become more capable and autonomous. It named no product. For Muse to read messages, it needs full disk access and a messages connector.
Other reports about Muse raise separate access questions. In a two-day test, Hunterbrook says Muse returned 10 to 100 real Facebook and Instagram accounts of vulnerable groups per prompt. It sometimes refused, then ran the search when the prompt was reworded. There has been no independent replication.
According to Daring Fireball and other coverage, Amazon blocked Muse from amazon.com. Amazon said the agent did not identify itself and appeared to capture and store customer credentials. Meta says Muse cannot see passwords or payment methods. Those claims remain in dispute.
Self-hosting changes the setup. OpenClaw and Hermes Agent keep state and credentials on the user’s hardware, while users supply model keys and infrastructure. Skills need checking too: Koy Security found 341 malicious ClawHub skills among 2,857 audited in early 2026, with 335 tied to one malware campaign.
K2 Lets a Service Catch Up
Cloudflare’s K2 handles a different reliability problem: a service misses events while it is offline. A Workers app can send an order to K2, which briefly collects events, writes them to R2, and gives each record an increasing offset. Each subscribing service tracks its own place.
If an email service goes offline, it can read the missed orders when it returns, provided the records are still retained. Retention defaults to 7 days and tops out at 30 days. That limit is part of whether the catch-up plan works.
Delivery is at least once, so a worker may receive the same record again. Its handler has to be safe to run twice. A rejected batch returns a result object instead of throwing, which means the producer must check result.success.
Cloudflare reports about 1 second of produce latency at the 99th percentile. K2 currently works through a Workers binding or HTTP; Kafka-client support and a lower-latency tier are planned. One proposed fit is a Workers app whose consumers can wait a few seconds but cannot miss an event.
A Laptop Test and Coding-Agent Controls
Zenolith uses the GPU to read a prompt and the CPU to write the reply. In the developer’s three-run test on one HP laptop, its median writing rate was 18.39 tokens per second. llama.cpp reached 14.66 on the CPU and 11.96 on the graphics chip.
The graphics chip was the slowest writer in that test. The developer says the CPU can use more memory bandwidth on that laptop, but the readme does not establish why Zenolith beat llama.cpp at this step. There is no independent check.
Coding agents have their own controls and workflows. Claude Code mods can change prompts, tool calls, and what appears on screen. One example hides email addresses until hover while leaving the real address available to the model. Its v2.1.290 changelog also lists a Deny button for sign-in approval and one retry after a content-filter stop.
OpenAI demonstrated Codex CLI voice tasks, agents across projects, and conversation forks into separate worktrees. Other shared workflows include Thariq’s HTML planning skill and a team setup using different models for implementation and review. A 40-test T3 Code suite mocks six agents and has already caught a stop-turn bug.
For recurring agents, access and approval settings are part of the work. Aten’s reported Messages sync and Meta’s two-switch explanation remain unchecked against each other.