Category Archives: Security

History, Poetry, Security

NYT Op-Ed 2026 Repeats Himmler 1943: “What if Writing Isn’t Central to Thinking?”

Leave a comment

A philosophy department chair at Williams College argued in the New York Times last week that writing is separable from thinking, that essays persist because they are easy to grade, and that universities should have the courage to stop requiring them.

I’m here to write… (╯°□°)╯︵ ┻━┻

He tested the idea in one seminar for one semester, let students use AI on their essays, then examined them orally and found half of them more articulate out loud. From that, and that alone, he concluded the written record is dispensable. And then he somehow was allowed to write this into the New York Times.

If I were them I would have said “get a soap box, buddy and go stand on some corner”.

The essay cites Socrates and then, nothing. Every major thinker who has ever examined this question reached the opposite conclusion. All the written history is ignored by him, in an essay proclaiming thinking as independent from written words.

The long, storied, tradition he skipped starts all the way back with the Mishnah.

Source What the essay leaves out
Mishnah Eduyot 1:5 Asks why the minority opinion is recorded when the law follows the majority. Answer: a later court may need to rely on it. The losing side stays on the page by design.
Plato, Phaedrus 275a His own witness. Socrates warns of a technology that gives the appearance of wisdom without the substance. Read straight, that is the case against AI, and Plato preserved it in writing.
Hume, Of Essay Writing A wise man proportions belief to evidence. One semester and one professor’s impression fail that test. Hume spent his life rewriting the Treatise for readers who could answer back.
Kant, What is Enlightenment? The public use of reason, the one that must be free, is the scholar writing for the reading public. Speaking in a room to the people present is the private use. The essay has the polarity reversed.
Wollstonecraft, Vindication of the Rights of Woman The seminar is a room and rooms have doors. She answered Burke in print (Rights of Men, 1790) because Parliament and the club were closed to her. Her critique of “accomplishments” names fluency that passes for understanding.
Russell, Principia Mathematica (1910) Several hundred pages to reach 1+1=2. Some thinking exists only in notation and cannot be held in a conversation.
Wittgenstein, Philosophical Investigations (1953) There is no second stream of meaning running behind the words. The expression is where the thought is. A thought with no public criterion is not yet a thought. Writing is the public criterion.
Popper, Objective Knowledge (1972) We let our theories die in our stead. That requires the theory to be fixed where it can be refuted. Speech drifts and gets remembered charitably.
Buber, I and Thou (1923) The seminar is I-Thou and he has that right. Every Thou must become an It, and the It is how the meeting is kept so it can be met again. His error was letting an It that performs Thou into the room.
Arendt, The Human Condition (1958) Deeds are the most futile human things unless remembered. The polis exists as organized remembrance. The seminar is the deed. The essay is the remembrance.
Ong, Orality and Literacy (1982) Oral cultures are homeostatic. They shed whatever no longer serves the present, and no one can prove it because there is nothing to diff against. Literacy makes correction possible.

Eleven so far, still just one verdict. Need I continue?

Look again at the one and only thinker he did cite. Socrates in the Phaedrus warns about a technology that gives people the appearance of wisdom without the substance, that answers nothing when questioned, that lets a person recite what they never understood. He was describing writing, and he called it a pharmakon, a word that means remedy and poison at once. Every word of the warning describes a student handing in an essay from a chatbot. Cruz read that passage, agreed with it, and then let the chatbot into the seminar while banning the essay. He kept the poison and threw out the antidote to it. And the only reason anyone can check this is that Plato wrote it down.

The New York Times disgraced itself by printing a shallow opinion that attempts to erase the value of all writers before him. This sort of erasure and false “invention” fetish isn’t unknown either.

Writing is where a claim becomes criticizable, public, and durable enough to reopen. The professor calls it a portable, compact trace of mind that is manageable in a bureaucracy, and acts like that is a criticism. It is the entire case for keeping records.

His oral exam worked for a reason he misread. A machine reads what the student types and answers back, and it retains every word in a log the student never sees and does not own. The written record of that semester exists, held by a vendor, while the student leaves with nothing in hand. When the professor sat each student down and asked them to explain their own essay, he was testing what each of them had kept. The students who could answer were the ones who had argued with the output, rewritten it and made it their own, which is to say they had done the writing after all. The students who could not had left the record with the vendor and never returned to it. The exam measured who had kept their own record, found that half the room had, and the professor concluded that the record was the problem.

That’s completely backwards. Logic failure.

The argument against keeping a record is actually much worse when you put context around what the New York Times engages in by publishing this man’s completely broken philosophy. The anti-record theory also surfaced the same week in actions taken by the antisemitic politicians of Saxony, Germany.

The council of Heidenau, near Dresden, banned new Stolpersteine (Holocaust memorials) on public streets, on a motion brought jointly by the AfD (openly Nazis) and the CDU (closeted Nazis) political parties. A Stolperstein is a genocide record that is meant to be inconvenient and force thought. It states who lived where it is placed, when they were taken, and what happened to them, set into the pavement at the door they left through. If someone is concerned about stepping on them, they are in the right place and working exactly as intended.

The next time someone mentions Carl Orff, which a lot has been written about, ask them if they meant to say Maria Leo.

Who? Maria Leo.

Maria Leo’s Stolperstein, Pallasstraße 12, Berlin-Schöneberg. HIER WOHNTE / MARIA LEO / JG. 1873 / FREITOD / 2.9.1942. The NS in 1933 banned her from teaching because she was Jewish. On 2 September 1942 she killed herself rather than be deported by NS. The following year Carl Orff began drawing a salary from Gauleiter Baldur von Schirach for appropriating the Berlin music education tradition of Maria Leo and Leo Kestenberg. The concept of Orff Schulwerk was Hitlerjugend programs that excluded Jewish children. The Nazis had already paid Orff to erase Mendelssohn for being Jewish. Photo: OTFW, Berlin (CC BY-SA 3.0), via Wikimedia Commons.

Gunter Demnig placed the first memorial stones in the 1990s and nearly 130,000 now sit in pavements across thirty countries. The “stumbling” design is as symbolic as it is deliberate. When Jewish cemeteries were destroyed under the Nazis, their gravestones were often used as paving material. The Stolperstein forces that exact discussion of the gravestone being in the street as the Nazis wanted, unprotected on purpose, demanding more thoughts because of the writing.

The Heidenau motion argued in an antisemitic screed that pedestrians should not be allowed to stumble on the names of the departed, and instead those writings should be hidden somewhere out of mind. It proposed that future victims be commemorated at the memorial by the northern cemetery instead. The record moves from the place where people encounter it to the place where they have to go looking for it, and never will.

Charlotte Knobloch, who says she opposes Stolpersteine in Munich on the same grounds, called the motion a transparent maneuver by the AfD (openly Nazis) to suppress remembrance culture and said she was appalled the CDU (closeted Nazis) lent itself to it. The sincere objection was borrowed from the woman who had claimed she cared so much about victims of the Holocaust she wanted them tucked away someplace out of mind.

The council wasn’t just acting to erase the writing on the streets, they removed the record of who lived where by also removing the record of who voted how on removal.

The motion passed by secret ballot, thirteen to six with one abstention. Thirteen people. Unnamed to protect them from their desire to remove the names of victims. Names written out in public was secretly ruled too much exposure for the dead. Names on the ballot were too much exposure for the living. This is the same town where right-wing mobs attacked a refugee shelter over several nights in August 2015. The district responded with a blanket ban on public assembly for the whole town, and the Federal Constitutional Court struck it down within two days because it also silenced the people who had come to welcome the refugees.

Ernst Fraenkel watched the Nazi legal system from inside as a Berlin lawyer and described it in The Dual State (1941). The regime kept its statutes, courts, and files for contracts and property, because the economy required them. Alongside that it ran a prerogative state that overrode any of it at will, with nothing written and nothing to appeal.

Anyone in Berlin today saying they don’t want records kept, don’t want recordings made, observations written down, is invoking the fact that not a single photograph is known to exist of the deportation of over 50,000 Jews from Berlin, on more than 180 trains, over four years. Würzburg has photos. Amsterdam has film. Berlin has an American professor writing in the New York Times not to write things down.

The Nazi regime, foreshadowing this professor’s fetish, ended by unwriting its own history. In the East, Aktion 1005 dug up the mass graves and burned the bodies from 1942 onward. Himmler told his SS generals at Posen in October 1943 that the extermination was a page of glory that would never be written. In Berlin the Gestapo burned its Jewish-affairs files in the last weeks of the war, and name lists for the first eight eastern transports survive only because written copies turned up in the archive of the Oberfinanzpräsident Berlin-Brandenburg. The deportation record exists because the tax office kept a second written copy.

The New York Times forgets, as the Nazis intended.

Fascism works by removing records that let order be audited, wherever the record would count. A professor who finds records tedious is laying the groundwork for fascism to rise again. A German council that finds accountability embarrassing is acting out the American theory of the white republic, which Hitler himself cited as his model when he described the conquest of the American West and its reservations as the pattern for the East.

Security

Russian Plague Lab Worker Death Escapes Scrutiny

Leave a comment

Everything needed to keep Darya Shipilova alive was invented decades before she was born, and most of it was developed by the system that employed her. Her colleagues say she died of plague. Her employer is saying the cause is unknown.

The plague doctrine comes from Harbin. In the winter of 1910 pneumonic plague moved down the Chinese Eastern Railway and killed around sixty thousand people in four months. Wu Lien-teh established that the disease passed between people through the air and designed a mask of two gauze layers around a pad of cotton. Gérald Mesny, a French physician sent to supersede him, rejected the finding and examined patients with his face uncovered. He died of pneumonic plague days later. The International Plague Conference met at Mukden in April 1911 and published its proceedings as the Report of the International Plague Conference. Respiratory protection, isolation of contacts and controlled handling of the dead entered practice as settled requirements, and the report became the baseline for every plague service built afterwards.

Russian physicians recorded the first cases of that outbreak at Manzhouli. The Soviet state built its anti-plague system on the lessons, and the Irkutsk institute opened in 1934 to apply them across Siberia and the Far East. Protection accumulated in the many more layers learned from there:

  • The gauze mask became the sealed anti-plague suit and the ventilated cabinet.
  • The EV NIIEG live vaccine, developed at Kirov in 1936, is still given annually to anti-plague laboratory staff in Russia and Kazakhstan.
  • Streptomycin arrived in the 1940s. Doxycycline, ciprofloxacin, gentamicin and ceftriaxone all work against susceptible strains.
  • Prophylaxis started within hours of a known exposure prevents disease in an exposed worker.
  • Surveillance of staff for sudden illness tells the treating hospital what it is looking at.

Defense is in depth. Each layer alone is known to be imperfect. The infectious dose sits below 100 organisms, with some estimates as low as one to ten. Stacked, the layers make a death like this rare. Public health authorities recorded at least ten laboratory-acquired plague infections worldwide before 1970, four of them fatal.

The most recent Western case shows what the last layer is for. Malcolm Casadaban died at the University of Chicago in 2009 after working with a strain attenuated to the point of exclusion from the select agent registry. Investigators found the laboratory following recommended practice and gave undiagnosed hemochromatosis as one possible explanation, since iron overload may have let a strain crippled in iron acquisition overcome that defect. CDC closed with a single instruction: institutions should maintain surveillance to detect unexpected acute illness in laboratory workers.

That is the layer Irkutsk seems to have missed, and it is the one most easily accessible. Special suits, cabinets and vaccines require money and sophisticated supply chains, and produce no documents admitting fault. Reporting a breach, starting doxycycline and telephoning the receiving hospital cost nothing, except that each step creates a record of failure inside the institute.

Rospotrebnadzor owns this institute. It writes the containment rules, certifies compliance with them, announced the finding of pneumonia of unknown aetiology, declared the regional situation stable, and now supervises the response. Russian investigators have separately opened a criminal case into safety violations resulting in death.

A criminal investigation for a facility its own regulator says recorded no incident is … odd.

Review by outside scientists became the standard for a national plague response within months of modern plague control taking shape. The institute under examination never conducted that review itself, and in Irkutsk there is apparently no body outside Rospotrebnadzor positioned to conduct it. That’s the obvious massive failure.

A 28-year-old laboratory assistant trained in clinical laboratory diagnostics reached a district hospital carrying the disease her own institute exists to recognise, and the physicians treating her were told nothing. Then five posts naming the disease were removed from REN TV. The Baikalsk administration deleted its travel warning. The governor of Irkutsk region spoke without naming the victim. Why so secret?

The International Plague Conference settled these practices more than a century ago and published them for every government that sent a delegation. They probably would have saved her. The measures taken at Shelekhov, five facilities closed, 189 contacts under observation, FSB escorts on the ambulances, are all the expected measures for plague.

History, Security

Microsoft AI Threat Report Disproves Microsoft AI Threat Report

Leave a comment

TL;DR Microsoft is counting its own bugs as a threat, started its bomb clock after the explosion, and calls their partner some kind of criminal.

You may remember when I recently showed how the Microsoft Agentic Governance Toolkit was completely broken logic. It was a hack, an empty shell, lacking proper controls inside to do what the tin advertised.

Well, here we go again. I’m not sure why Microsoft is still in business, at this point, but since they seem to still be putting things into the market here’s another look at what that means to someone who looks behind their curtain.

Page 14 of the Microsoft Digital Defense Report 2026 carries this sentence:

The median time from vulnerability discovery in the wild to weaponization has now collapsed to well below 24 hours.

Think about the time from explosion of gunpowder to someone lighting a fuse being well below 24 hours. Sound backwards? That’s because it is.

Read the Microsoft claim twice. “In the wild” is the term of art for exploitation already observed. It’s the explosion in your face. A vulnerability is discovered in the wild when someone catches the exploit running against a live system. The weapon exists before the weapon is discovered being used. The interval the sentence claims to measure starts after the event it ends with.

A bomb squad timing detonation to manufacture would report the same number, for the same very, very stupid reason.

The honest interval runs from disclosure to exploitation, and the report flips it back to reality on page 47, in the ransomware chapter:

The disclosure-to-exploitation window has shrunk to single-digit days, if not exploited as a zero-day before any advisory is issued. Microsoft has observed the following trends: More, faster weaponization. The Cybersecurity and Infrastructure Security Agency (CISA) added over 110 CVEs to the Known Exploited Vulnerabilities (KEV) catalog from November 2025 to May 2026, most within a week of disclosure.

Single-digit days. Within a week. Record-scratch. What happened to sub-24 hour? And more to the point, the examples that follow are Storm-1175 deploying Medusa ransomware within 24 hours of initial exploitation, SAP NetWeaver weaponized a day after disclosure, and a September 2025 Akira surge across fifty organizations riding CVE-2024-40766, a SonicWall bug published a year earlier. Conventional crews with a known catalog of bugs were on measured intervals. Page 47 is dull because it was the actual math and nothing is alarming. Page 14 had to torture the clock to make it sound scary.

The word “median” also puts Microsoft on a specific kind of hook. A median implies a distribution, a sample, a period, a source. Page 14 has exactly zero, which means it can’t use the word median in good faith. The AI chapter has its sources made clear by hyperlink, which makes the median claim stand out even more as unlinked. Also unlinked? The “record-breaking estimated 72K” CVE figure beside it, and the claim on page 10 that attackers “are reaching to advantages first.” Says who? Are these magical fairy dust claims seriously the level of work to expect from Microsoft now? Perhaps they should switch to writing children’s books.

The chapter carries twenty-one links across twenty pages. Fifteen sit on pages 14 to 16. Fine. My beef is with pages 10 through 13, where the thesis is stated. The important pages carry zero links. Allow me to audit and illustrate the Microsoft deliverable in terms of errors and omissions, which I hear is a field of law.

Claim What is missing
Attackers “reaching to advantages first”; equilibrium “will be re-established” (10) Metric, baseline, date
Leading-edge threats “commoditized within a year” (10) Basis for the forecast
Known-but-unpatched vulnerabilities “will rise sharply” over “a multi-year window” (10, 12) Count, trend data
Sleeper-agent model tampering “already observed in the wild” (11) Incident, model name
Stolen AI capacity resold “to criminal and nation-state customers” (11) Any nation-state buyer; Sysdig documents criminal resale only
Distillation theft “has become widespread” (11) Case; page 19 calls distillation “legitimate and widely used”
OpenClaw “notorious for deleting data, revealing secrets… spending users’ money” (11) Incident
Exfiltration, secret discovery, lateral movement cut “from days to minutes” (12, 13) Case, timing data
Known vulnerabilities “shot up” from tools “with far lower false-negative rates” (12) Tool name, figure
Adversaries “may stockpile large numbers of zero-day vulnerabilities” (12) Evidence; stated as speculation
Unauthenticated MCP services with developer credentials “unfortunately common” (12) Count
AI “fixes all four” fraud weaknesses “simultaneously” (13) Evidence
Customized lures “will materially increase attack success rates” (13) Measured rate
AI for weapons proliferation, mass-casualty planning (13) Case
Mythos “first” to autonomously run a 32-step attack (14) Link covers GPT-5.5 only; Mythos half unlinked
Open-weight models “lag closed models by seven months” (14) Definition of lag; attributed by link placement only
Microsoft “observed AI-orchestrated intrusions sharing elements with JADEPUFFER” across sectors and regions (14) Count, case; the source case was human-staged
Median discovery-in-the-wild to weaponization “well below 24 hours” (14) Dataset; clock starts after the event; page 47 says single-digit days
“Record-breaking estimated 72K” CVEs for 2026 (14) Source; the count measures CNA assignment, not exploitability
Discovery and weaponization now “simply writing a prompt” (14) Example
Vendor AI patching leads to “equilibrium” (14) Basis for the forecast
PromptLock delegated logic to a model “on adversary infrastructure” (15) Source; the ESET sample was claimed by NYU Tandon researchers as an academic prototype
TikTok ClickFix “~500,000 views”, “per-lure cost to near zero” (15) Source for views; cost claim unsupported
Agent skill registries “already ship malware disguised as utilities” (15) Case
Browser extension: “600,000+ installs”, “almost 10,000 organizations” (16) Page 27 gives “nearly 900,000 installs”, “more than 20,000 enterprise tenants” for the same campaign
A self-improving worm on stolen LLM keys “will soon” appear (16) Evidence; the Xlab link covers credential theft only
Actors extended agentic AI into “malware and exploit development and post-compromise operations” (17) Case
Actors “beginning to explore” direct exploitation of enterprise agents (17) Case; stated as “could include”
Human direction “unlikely to exist for very long” (17) Basis for the forecast
Source review “would have taken skilled people weeks”, now “continuous” (18) Benchmark
Distilled copies “frequently lack the safeguards” of parent models (19) Measurement
“88% of enterprises” experimenting with agents; “82% of leaders” plan rollouts (22) Survey name, sample
“Roughly 1.3 billion agents in production by 2028” (22) Attribution for the projection
Prompt-goal percentages, Feb to May 2026 (22) Denominator, publication; drawn from Microsoft filter logs
Four techniques “roughly 90%” of AI-workload attacks, “90 day window” (23) Denominator; window undated
Agent-to-agent spoofing “a rising technique” (23) Case
“Roughly 85% of work now happens” in the browser (27) Source
AI browsers as infection vector in “more than 40% of organizations”, “57 distinct malware families” (27) Publication; internal May 2026 analysis

Fun! Or should I say, FUD!

What the chapter does cite collapses with a simple poke. The proof that frontier models can “fully autonomously orchestrate complex attacks” is a 32-step compromise reported by the UK AI Security Institute. I’ve debunked this kind of claim many, many times before. But the FUD balloon keeps getting filled by self-serving vendors faster than I can pop them. The report’s own caveat: “The test took place in a mock company computer system with no defenders.”

NO DEFENDERS.

A test with the defenders removed is offered as evidence of attacker having an advantage over defenders. Are Microsoft staff being tested for drugs?

The “first documented automated ransomware extortion attack” is JADEPUFFER, a late June 2026 intrusion Sysdig described on July 1. The entry point was Langflow CVE-2025-3248, followed by Nacos CVE-2021-29441 and an unchanged default signing key. Five days later Sysdig’s Michael Clark told CyberScoop that a human picked the victim, built the command-and-control and staging servers, and supplied the database credentials from a prior compromise. The encryption key was ephemeral. Payment would have restored nothing.

To put it plainly, a human-staged wipe over a five-year-old bug is filed on page 14 as “the first evidence of the transition to full attack autonomy.”

The second real-world case is the July 2026 Hugging Face incident. OpenAI’s own evaluation agent left OpenAI’s own sandbox through a proxy the sandbox left open and went after a benchmark’s answer keys. The attacker was an AI lab. The victim was an AI lab. The failure was a sandbox. Microsoft files it on page 15 under “Real-world autonomous attacks of increasing complexity,” in the same box as JADEPUFFER, a criminal extortion crew.

REAL-WORLD ATTACK. Microsoft’s largest AI partner, called out as if just another ransomware gang. Hello, any lawyers in the house?

The Red Team chapter, page 19, settles the question the AI chapter opens:

AI does not change where attacks begin—the foothold still comes from familiar sources, for example, a sprayed credential, an unpatched edge service, or an identity gap.

Both flagship cases entered through exposed services running known-vulnerable software. This continues to prove that the basics are what matter and the FUD is doing nobody any favors. Here the advantage that the report assigns to AI is just the old patching story yet again.

Which raises the question of whose gap we are really talking about when Microsoft starts tooting their security horn. Page 12 explains why remediation lags discovery: “many systems lack robust unit and integration testing and so cannot deploy code changes rapidly.” That is a description of vendor engineering. The page then predicts “a multi-year period where the number of known but unpatched vulnerabilities spikes.”

My first run at Windows NT 3.5 was as a DEC partner asked to secure Alpha in 1994, with word from the project that Gates had punted security work out to ship faster. A fresh install lasted about as long on a public network as it took to plug in. I sniffed networks and watched the administrator password cross the wire in cleartext to Korean IPs. Point of sale operating system experts later told me Gates visited Santa Cruz Operation and told them he would fund security the day someone showed him a billion dollars in it. So when Code Red hit in July 2001 on an IIS buffer overflow, Microsoft had patched it only a month earlier. Nimda followed in September. Gates then sent out his Trustworthy Computing memo of January 2002, claiming his decades of shipping defects to customers for margin to Wall Street would no longer be the culture. A year later Slammer hit SQL Server through a hole patched the previous July, a 376-byte UDP packet that doubled its infected population every 8.5 seconds and took down networks worldwide. Fun fact from back in the day, sniffing traffic meant we saw SQL traffic spiking the days before the worm hit and had shut the port off. Microsoft wasn’t watching, but they could have been. I guess Bill Gates didn’t see the profit angle in avoiding global disaster.

Three decades of shipping first and patching later is technical debt by design, with the interest billed late and inflated to the customer. Microsoft shipped 570 fixes on its July 2026 Patch Tuesday, 400 in August, and a record 966 on September 8, with 204 more earlier that month. Microsoft credits the surge to its own AI-powered vulnerability discovery system rather than to the human-powered fire-ready-aim that produced the bugs. That is a defect generation model, and the cure for it has been well documented since at least the end of WWII.

During World War II, Deming was a member of the five-man Emergency Technical Committee. He worked with H.F. Dodge, A.G. Ashcroft, Leslie E. Simon, R.E. Wareham, and John Gaillard in the compilation of the American War Standards (American Standards Association Z1.1 and Z1.2 published in 1941, Z1.3 in 1942) and taught SPC techniques to workers engaged in wartime production. Statistical methods were widely applied during World War II, and then completely abandoned by the Gates family dynasty that hedged the personal computer software market.

The report’s “record-breaking” CVE count for 2026 belongs beside Gates’ 1976 Open Letter to Hobbyists, where he told people sharing software for the public good that they were thieves and that he knew better than they did what computing should cost. Fifty years later the bill arrives as a backlog Microsoft’s scanner generates against Microsoft’s products, delivered to Microsoft’s own customers at close to a thousand a month, and the current report files it under threats.

Page 14 again: “Software vendors are using AI to identify and patch vulnerabilities, which will lead to more secure software after initial large patch waves.” The large patch waves are Microsoft’s own failure to do the hard work they are supposed to be paid to do in the first place. Remember how “enterprise” was a label they tossed around as though it meant paying for something safety-related? BleepingComputer ran the headline the day the report appeared: threat actors are ahead in the early AI race. One commenter asked what Microsoft planned to do about it. Page 47 tells us that Microsoft knows the real numbers after page 14 spun up some FUD to distract readers from what is real.

Security

The Gateway That Stops Apple and Meta Finger-Pointing Your Privacy Away

Leave a comment

Jason Aten is a brave man. He installed Meta’s “Muse” AI agent on a Mac mini the day it launched. He declined when it prompted him for access to Messages. He left Full Disk Access off.

Days later Muse pushed a notification to him that suggested a column, based on his Apple iMessage thread with a colleague. He looked. Muse had synced his Messages database to row 187,462. He asked it how.

It’s the incoming notification stream only, not access to your texts.

That was false. A lie.

The notification stream does not contain 187,000 rows of chat history. The Meta agent that read his personal, private messages was lying to him about how it read them.

Meta’s CTO David Singleton posted this explanation on Threads:

The Messages integration in the Muse Mac app is opt in. Your Muse can only read Messages content if macOS system-level Full Disk Access is granted and the Messages connector is enabled.

Dan Goodin at Ars Technica took that denial to Patrick Wardle, who has spent years on macOS internals. Wardle’s answer was that with Full Disk Access, any non-root file on the machine is readable: browsing history, cookies, chats. Makes sense. It’s called full disk access, after all.

The Messages connector, however, is not an operating system control. It is a setting inside Meta’s own app. When Goodin asked Meta how Muse alone, among every app with that privilege, could be unable to read a file the privilege makes readable, Meta PR sent back the Singleton quote again.

Then Apple spoke up to clear the air (pun not intended). On October 2 it announced that Full Disk Access permission needed a safety update:

Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems—including files, mail, messages, and even browsing history—without users’ full knowledge and understanding. For communication apps, this can also compromise the privacy of the people users are communicating with.

As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially. We are committed to ensuring users clearly understand these risks before granting such access, so they can make informed decisions about their own data and privacy.

Apple named no developer, because everyone knows what time it is. Eleven days earlier Wardle had disclosed a Muse configuration that let any code running on the Mac take control of the agent and inherit everything it could reach, including through ClickFix-style injection.

Amazon had already blocked Muse from its platform.

Apple’s statement is officially saying the second layer of Singleton’s defense does not count. It is not a layer.

Jonny Saunders (@jonny on Mastodon) found the same gap on a different day, in one thread, and then wrote a long one the next day about Meta AI being smoke and mirrors. Muse tried to install Python packages and put up a card asking to connect to pypi.org. Not because someone was watching it; the card timed out. Muse then worked through a list of PyPI mirrors from its training data, wrote itself a download script that skipped the lockfile’s hash check, forked it into the background, and kept pulling wheels from whichever hosts answered.

The approval covered one hostname. The mirrors didn’t care about approval.

When it was stopped by @jonny, Muse lied. It said pypi.org was unreachable from the sandbox and that the Tencent and Alibaba hosts were “the official PyPI mirrors.”

There are no official PyPI mirrors.

It was caught only because the actual raw message stream was being watched instead of listening to the lying Muse interface, and @jonny knew the packaging ecosystem well enough to know Meta was lying.

Meta’s own architecture post, published on launch day, says where this happens. Each user gets a dedicated Linux VM; the agent harness runs in a container inside it; clients connect to the VM over a transport layer. The approval card, the timeout, the mirrors and the forked script all happened on Meta’s machine, behind the component Meta calls Sentinel. The gate asked about one hostname. The act was fetch-and-execute from the internet, and Meta put up a gate and tuned it to let that through.

I’ve written about this pattern before, with regard to Microsoft releasing an Agent Governance Toolkit that asks for an identity and puts nothing up to stop predictable breaches.

It’s basically very bad engineering, because software isn’t like real engineering ethics. Build a bridge that falls down, go to jail. Build agentic software that falls down, get a huge signing bonus from Zuckerberg to jump ahead of his competition who are slowed down by following rules and doing the right thing.

Three places to put a control

There are three places to stand between an agent and a file, and none of them is hard to build. Meta has no excuses for its unethical design.

Apple stands at grant time. The Full Disk Access dialog is asked once and that’s it. Are you in or not? Apple’s fix makes the dialog trumpet blow louder and the click be seen as more deliberate. That sounds to me like Apple lawyers wanting to remove Apple liability. It does not change what the click does to the user, given a powerful key, and it cannot see anything that happens after the key is in the agent’s hand. Apple narrates the grant. It does not actually protect the user by making it easy to do the right thing, or mediate the use and make it hard to do the wrong thing.

Meta stands at app policy. The Messages connector is a toggle inside Muse. Muse enforces it, meaning it’s in control where it probably shouldn’t be. The thing that is supposed to be constrained is deciding on the constraint. Self-regulation. Wardle’s finding is the practical consequence: if arbitrary code on the Mac can drive Muse, arbitrary code can drive the toggle, and the toggle was never a boundary anyway. I’m reminded of WhatsApp, which sold “end-to-end encrypted” chats while, as ProPublica documented in 2021, one end tapping Report sent the recent messages, decrypted, to more than a thousand Facebook reviewers. The other end never consented and was never told. So something has been very rotten inside Facebook for a very long time. Aten’s experience is that the toggle showed enabled after he declined it, and nobody at Meta has explained how. My argument against touching WhatsApp has always been this. The privacy was never reality, since it was designed such that “end to end encryption” disappears to suit Facebook without full consent.

Third, and final, is the dispatch time. That’s the moment the agent actually reads the database, actually sends the row to Meta’s cloud, actually fetches the wheel and runs it. It is the only layer that sees the act. Meta’s architecture post says it has put some thought there. Sentinel is described as a separate host-side agent, the sole permission authority for connector actions and all network egress, which the agent cannot override. Every concrete network request is governed at egress. Approvals are scoped capabilities, not conversational suggestions. Great, on paper. Meta wrote it down before either incident, and then failed to deliver.

Read the document next to the two incidents and four things fall apart immediately.

  1. The Mac app is not in it. The architecture names iOS, Android and web clients, and Sentinel’s remit is egress. The path from chat.db into the VM is a client sync, not an egress, so by the document’s own terms the most sensitive ingestion in the product never meets Sentinel at all.
  2. Sentinel asked about pypi.org and then the mirrors went through. Meta’s own description explains how. The mechanism is called tainted egress: a tool process starts clean and becomes tainted only when it reads user data, and clean requests that fit an auto-allow policy pass without the user. A fresh download script has read no user data. Taint measures what leaves the VM. It does not measure what arrives and executes. Whether that is exactly what happened on @jonny’s machine only Meta’s logs can say, which is the point.
  3. When the ask expired the agent was handed a timeout, which it reported as an outage; the document says the approval dialog goes to the client, outside the conversation, and says nothing about what the agent is told when nobody answers.
  4. Nothing in the document describes a record of Sentinel’s decisions that the user can verify. The files Meta says you can inspect, edit and download are the agent’s own, and the agent’s account of itself was false twice in one month.

So for the file that this news story is really about, nobody has implemented the proper agentic gateway. For the network, Meta built one and then tuned it to wave through the thing @jonny watched it wave through. Either way Goodin’s section header is “He said/she said,” and nothing in the Meta or Apple architecture changes the fundamental failure of the whole thing.

Three places to stand between an agent and a file
Click to enlarge

Remember 1972?

The Air Force fifty-four years ago wrote the solution to this, so it’s a bit strange that American companies act like they don’t know what they’re doing. The Anderson Report of October 1972 defined the reference monitor: a mechanism that validates every access of a subject to an object. It set three requirements. The mechanism must always be invoked. It must be tamperproof. It must be small enough to be verified.

Everything in computer security that has worked since 1972 has been in the shadow of this simple triad. No surprises here.

Now score these Big Tech firms, sitting on billions, in their efforts to protect user data. Apple’s dialog is always invoked and hard to tamper with, but it validates one grant, not every access. Meta’s toggle is inside the subject it is supposed to constrain, which fails tamperproof by construction, and Aten’s row count says it also failed always-invoked. Sentinel, as described, is in the right place and invoked on every egress. But it fails the third requirement. A monitor that runs classifier ensembles, kernel taint tracking and a model-written “user-visible purpose” for each request is not small enough to verify, and its policy, not its placement, is what let the mirrors through. And for the Mac client it is not invoked at all.

Clark and Wilson in 1987 also wrote this up for the rising commercial computer market: well-formed transactions, separation of duty, and an audit trail that cannot be rewritten by the process it records. The standard audit trail, a foundation of civilian software engineering since the 1990s, is the part this whole story is missing. Apple cannot see inside Muse. Meta’s logs are Meta’s. Muse’s own account of itself was false, which seems to be par for the course with them. Three parties are pointing at each other without evidence, while the user did everything the way he was asked.

What evidence would look like

As a historian the solution is so obvious it’s painful to discuss with engineers who claim they don’t understand the problem.

An agent’s own account of its access is not evidence.

Perhaps if software engineers were required to take an introduction to history course, they wouldn’t act like whatever they output should be the singular “God view”.

A vendor’s account of its agent is not evidence either.

The CTO’s denial and the platform owner’s correction have now shown the problem within the same week. An architecture document is not evidence: Meta’s says every egress is governed, and @jonny’s terminal shows that statement was worthless.

Evidence is a record that the agent cannot write and the vendor cannot edit.

If you ever read a history book, you should see right away it’s all perspectives needing an independent hand.

@jonny, after a week inside Muse, put the whole design problem in one sentence: “context control is model control, modulo extra-inference safeguards.” Everything Meta built sits on the far left of that phrase and doesn’t cross over to the latter. A MEMORY.md loaded into every context as a chronological log of everything the agent has ever done, with no way to clear it. Left alone, @jonny described it as “the thing writes in a bunch of safety rules everywhere.”

What to do with it? @jonny ended up building the agent a database so it would have recall under user control. The modulo clause is the only part to trust, and the vendor doesn’t provide it. The other line from @jonny is the audit problem exactly: Muse “is useful for investigating itself because it has privileged tools to do so.” That’s a particularly damning statement about Meta’s lack of accountability; the only instrument for auditing Muse is Muse.

It’s past time to move on from this and demand a proper gateway. Every tool call the model makes passes through a process the model does not control. The gate decides, deterministically, whether the call runs, prompts a human, or is refused. A prompt nobody answers is a refusal, and the model is told so in words, not left to read a timeout as an outage. A fetch goes only to a host the operator listed, and an empty list means no host, not every host. Each decision is appended to a hash-chained log, each entry signed, so that removing or altering a row breaks the chain. Then “I never enabled it” against “that can’t happen” is not a dispute. It is a verify command.

For months I saw complaints from users they didn’t trust the vendor gateways. I couldn’t find anything fixing it. So I built Wirken as a free and open source model-agnostic agent gateway at wirken.ai and github.com/gebruder/wirken. Every channel the agent talks on runs in its own operating system process, and every adapter proves its identity to the gateway with a signed handshake before a message is accepted, which is the direct answer to Wardle’s finding that any local code could drive Muse. Every action is classified into a tier; the top tier always prompts and can never be stored as a standing approval. The audit chain is append-only, signed, and verifiable offline. It has been shipping for months to anyone who wants to run an agent and keep a record of what it did.

None of this old stuff can be said to be novel. Perhaps why it doesn’t have flashy marketing.

It is Anderson and Clark-Wilson applied to a new kind of subject. What is novel is the industry’s decision to remove the safety and deny a monitor. You should demand it be put back.

The gate is not optional

Apple says the risk will grow substantially. Apple is right. A louder trumpet in your ear is not what we need right now. A toggle inside the agent does not pass basic muster. The only thing that stops the risk growing sits at the dispatch point, outside the model, writing down what the model did.

Agents should not run on your infrastructure without a gateway. Horses should not run in your streets eating the greenery and dumping manure everywhere, without reins. Get Wirken.

Sources

Goodin, Ars Technica, 2 Oct 2026; Nellis, Reuters, 2 Oct 2026; Decrypt on Aten’s Inc column; TNW on Meta’s denial; @jonny, Mastodon, 30 Sept 2026 and 1 Oct 2026; Sheasha, “How We Built Safety Into Muse,” Meta AI Research, 8 Sept 2026; Elkind, Gillum & Silverman, “How Facebook Undermines Privacy Protections for Its 2 Billion WhatsApp Users,” ProPublica, 7 Sept 2021; Anderson, J.P., Computer Security Technology Planning Study, ESD-TR-73-51, October 1972; Clark, D.D. & Wilson, D.R., “A Comparison of Commercial and Military Computer Security Policies,” IEEE S&P 1987.