Comment by lapcat | Hacker News Reader

Comment by lapcat | Hacker News Reader

Parent Full thread

Please read and respect the HN guidelines: https://news.ycombinator.com/newsguidelines.html

I said that Aten is misremembering. That's not the same as lying. We all misremember things.

I don't care about or trust Meta. In my blog post about the Muse first run experience, I said, "For testing I used a fresh VM, not signed in to my Apple Account, because of course I don’t trust Meta with any of my data!" https://lapcatsoftware.com/articles/2026/10/2.html

What I do care about is truth and accuracy. My mistrust of Meta is not going to make me distort the truth. Muse cannot bypass macOS TCC, that's a simple truth.

I'm a macOS software developer. That's the reason for my interest in this story, the technical aspects of it.

Both of these could be possible – Aten telling the truth, Muse accessing private data without Full Disk Access. AI excels at problem-solving, it's conceivable that Muse simply found a path to the data. Just one example that came out recently: https://shirtpocket.com/blog/quick_security_update. It's so trivial that it becomes easily plausible. Every time a backup starts, a startup disk snapshot is mounted without access controls, Muse gets the mount notification and discovers it can access the data it was hoping for on the exposed volume. It doesn't even require knowledge of exploits, it's just a matter of looking around to see what it can find.

> AI excels at problem-solving, it's conceivable that Muse simply found a path to the data.

No. What you're missing here is that Muse for Mac is a native, compiled, code signed, notarized app, with specified entitlements. It can't simply rewrite its own executable code, so it can't do whatever it wants. You can even reverse engineer the app. Muse looks in ~/Library/Messages for the messages database; this is actually hard-coded in the executable file. Whatever ideas the remote LLM may come up with cannot automatically be translated into instructions that are executed by the Mac app. That's not how it works.

Reply on news.ycombinator.com