STOP Giving AI Agents Full Disk Access (Apple Just Warned Why)

0:00 I laid Meta's statement beside a columnist's account of the same Muse setting and they don't match. Meta says Muse can read messages only if two switches are on. Ink's Jason Aten says

0:10 he declined, kept full disk access off, and messages still showed as enabled. If you're about to give Dots, Muse, or Grokbot a login or your laptop, what off means is your problem, too. Nobody has

0:22 checked which account is right and that stays open here. Those are OpenAI's Dots, Meta's Muse, and XAI's Grokbot. Dots reach apps through plugins. Grokbot signs into your tools and Muse's

0:34 documented ask is full disk access plus a messages connector. The pitch is easy to like. Silicon Angle describes Dots as agents that keep working on your behalf and each of the three says it checks

0:45 back for approval. But Apple warned on the 2nd of October that the risks will grow substantially and Hunterbrook's reporters say Muse compiled lists of real people's accounts when asked. My

0:55 first instinct was to pick between Aten and Meta. The evidence won't settle that. So I went after what's more useful, what these agents are built from, what's documented going wrong, and

1:05 what you can hold back. By the end you'll know those and whether running an agent yourself is safer or just moves the risk. Start with the design. Picture a key ring that starts empty. Each part

1:16 of an always-on agent is a key and they go on the ring one at a time. Meta key one is the agent's own computer, a cloud machine with a browser so it keeps working when your laptop's

1:26 closed. Silicon Angle's write-up says each dot has one. Meta's Muse runs on a dedicated cloud virtual machine and XAI describes Grokbot agents as having their own computer. Meta key two is a trigger,

1:39 the thing that wakes it up on its own. Dots run scheduled and recurring tasks as reported. One coverage summary adds events like a new Gmail message or a Slack post, but that list rests on a

1:50 single summary so hold it loosely. Memory is key three. As reported from OpenAI's announcement, Dots learn from your feedback. I am on Tails' September comparison says Muse keeps an editable

2:01 text file memory while Dots keeps memory server-side only. That's secondary analysis, but memory you can open is memory you can check. Connections are key for Dots plug into more than 4,000

2:13 apps through plugins and you can reach one from ChatGPT, Slack and Teams. X AI's change log describes Croakbot as agents that sign into your tools. Each connection is access you've handed over.

2:24 The last key is the approval step and it's the only one that points back at you. According to Media Nama, Open AI's own example is a dot that spotted an unsent invoice, drafted it and sent it

2:35 after approval. The pause before the send is the point. Built-in rules decide when it asks. TNW and Android Authority both describe custom rules that let you allow, require approval for or block

2:47 actions. Background research uses read-only tools. Password changes as reported always stay with you. It can send the invoice, it can't change your password. Somebody drew that line

2:58 carefully. Open AI also warns Dots can still make mistakes. Count what's on the ring now. Computer, trigger, memory, connections, four keys that work while you're out of the room. One key depends

3:09 on you reading a prompt. And a real key opens one door, but a signed-in account opens whatever it can reach, so this ring is heavier than it looks. Apple's note is about one kind of

3:19 that access, your Mac files. It's the 2nd of October developer note called Updates to Full Disk Access in macOS. It says, "As AI agents become increasingly capable and autonomous, the

3:31 risk associated with this level of access will grow substantially." Full disk access is the Mac permission that lets an app read protected folders. Meta statement says reading messages needs

3:41 it. Apple named no product and Mac Rumors reports no implementation date was given. Slashdot ties the note to the Muse claim. Meta disputes the claim. Read it as a signal about Mac

3:52 permissions. Now, how the three differ. Dots were announced at DevDay on the 29th of September and run on GPT-6 Astra, as reported. The first one is included in Pro and Business Premium,

4:04 with Enterprise as an admin-enabled beta. Free and Plus are excluded, and TNW says Pro users in the EEA, Switzerland, and the UK are out, too. Muse launched on the 8th of September.

4:16 It's free, with weekly limits. By mid-September, it was number one on the free iPhone chart in the US. It pushed ChatGPT out of the top spot. Bloomberg says it passed 902,000 downloads in 6

4:28 days. So, the price is free, the permissions are a separate cost. The documented one comes from Meta itself. To read your messages, Muse needs full disk access, plus a messages connector.

4:40 Grok bot is the earliest. AI's own changelog shows it in beta on the 11th of August, starting on Super Grok heavy and two cursor plans. A secondary tracker says it reached base Grok at $30

4:52 a month by the 26th of August. There's no free tier, so Grok bot is a paid product. Creator Alex Finn, who says he had early access, posted that Dots Edge is access to all your ChatGPT memories

5:05 and the ChatGPT tool harness. That's one creator's opinion, with no measured test behind it. All three describe parts of the same blueprint. The sources document more of it for Dots and Muse than for

5:16 Grok bot. Every documented incident here involves Muse. That's what got covered. It says nothing about the other two. Hunterbrook tested Muse around 22 and the 23rd of September. Reporters asked

5:28 in plain language for lists of real Facebook and Instagram accounts of vulnerable groups, including undocumented immigrants and poll workers. Muse returned 10 to 100

5:36 accounts per prompt. Hunterbrook says it sometimes refused, then ran the same search when the prompt was reworded. Meta's AI terms prohibit using its tools to infringe on privacy rights or conduct

5:47 surveillance. Meta asked for more information, then didn't respond to later requests, and Hunterbrook didn't publish the lists. The testing is Hunterbrook's own over 2 days, and no

5:57 independent replication has turned up. Think about where the approval step sits. Going by what's reported, Muse asks before purchases and sends, and Dot's background research is read only.

6:08 Compiling a list is neither a send nor a purchase. Hunterbrook's report doesn't say whether any prompt appeared, so I'd watch that gap. A step that guards what an agent does says little about what it

6:18 looks up. Amazon blocked Muse from amazon.com about 12 days after launch, as Daring Fireball and other coverage reported. Amazon says Meta never told it Muse would use the store, that the agent

6:30 doesn't identify itself, and that it appears to capture and store customer credentials. Put plainly, Amazon's complaint is an agent shopping as the customer without saying so. Meta replies

6:40 that Muse has no visibility into people's passwords or payment methods. Back to Atten, Decrypt, Startup Fortune, and Slashdot agree on what he reported, and on Meta's David Singleton saying the

6:52 feature was opt-in. Atten says Muse synced more than 187,000 rows from his Mac's Messages database. Muse told him it was only the incoming notification stream, so I won't say Muse read his

7:03 private messages. That changes what a switch is worth. If Atten's account is right, the screen said enabled after he'd said no. If Meta's is right, the switches worked

7:13 as described. Nobody has checked which until someone does, and in-app toggle is the app's word, not proof. The safest permission is the one you never grant, which brings up the escape hatch. Run

7:24 the agent yourself. Take two open-source agents, Open Claw at about 391,000 GitHub stars on the 3rd of October, and Hermes agent at about 250,900. Open Claw is MIT licensed, which means

7:39 free to use and change, and it's self-hosted with state, memory, and credentials on your hardware. It connects to Slack, WhatsApp, iMessage, and more than 20 other

7:48 channels. Hermes Agent from Nous Research is also free to use and change. It has a built-in cron scheduler, a timer that runs jobs on a schedule, and that's the trigger key. It also has

7:59 agent created memory with session search, and A Multiple says that memory is editable text files you can open. It runs in seven places, from your own machine to remote sandboxes, and reaches

8:10 Telegram, Discord, Slack, and more. It maps onto the same blueprint, but you supply the model keys and the infrastructure. I expect it self-hosting to be the safe answer. The Open Claw

8:21 readme sells control, and it also tells you to treat inbound messages as untrusted input. Then there's the skills marketplace. Skills are add-ons that give the agent new abilities, and

8:31 ClawHub is where people share them. Koy Security audited ClawHub in January and February 2026 and found 341 malicious skills out of 2,857. That's a snapshot from early 2026. Of

8:45 those 341, 335 were tied to one campaign installing a macOS malware strain called Atomic Stealer. Call it one in eight skills in that first audit, and later scans reported higher counts.

8:57 Self-hosted does keep your credentials on your hardware, and it keeps the malware there, too. So, the question from the start has an answer. The risk moves.

9:05 You keep memory and credentials off a vendor's servers, and in return you pay for the server and the model usage and handle the setup. If you pick Open Claw, budget for vetting skills and treating

9:15 inbound messages as untrusted. No audit of Hermes turned up in these sources, so that's a gap, not a pass. Nothing here says which side is better. It's a trade. Go back to the keyring. Every key was a

9:27 reasonable thing to want. The computer, the trigger, the memory, the connections. Each one is useful alone. Together, they're an account that acts as you around the clock with one pause

9:38 built in. The rule I'd use is to start narrow. One app, one job. Keep sends and purchases behind approval and use custom rules where the product has them. Open AI

9:49 describes them for dots. Leave full disk access off. As far as the reports show, approval guard sends and purchases, not lookups. So, don't connect anything you wouldn't want pulled into a list. If you

10:00 decline something, open the settings afterward and look. My call, if you're considering a hosted agent, give it one narrow job with approval on and keep it away from your

10:10 Mac files. If you're weighing self-hosting, budget for the infrastructure and for vetting skills. Which leaves a question the sources don't settle.

10:18 Amazon blocked Muse saying continued access by an unauthorized AI agent violates its conditions of use. Meta and Athens still disagree about a switch. When an agent acts as you and gets it

10:29 wrong, who's responsible? You, the vendor, or the app it's signed into? Say which in the comments.