Topic
Access rights and credentials assigned to AI agents, defining which systems and data they can read, modify, or act on without human approval.
Four of the 20 built-in skills in Meta's Muse Code 1.4.3 exist to move users off Claude Code or Codex, according to a dev.to teardown. The author never authenticated, so the post covers the import path and runs no coding task.
Reality
One developer running Claude Code on 80-plus microservices enforces a never-commit rule, once pasted into 18 prompt files, with a permission deny rule. An audit found the agent's settings file allowing the git commands those prompts banned in capitals.
Reality
Docker published its Sandbox Kit Specification v3 under Apache 2.0, packaging an AI agent's permissions and tools as an ordinary OCI image. Grants that developers now keep in shell history and run flags can be pinned by digest and reviewed like any other image change.
Reality
Meta's Muse has a free tier and OpenAI's Dots starts at $100 a month, though both agents keep working on their own cloud computer after the user leaves. For whoever rolls one out, the choice turns on who approves the agent's actions and where the work already happens.
Reality
Meta's Muse, reportedly downloaded 3 million times in its first week, gave a Marketplace buyer a seller's home address and booked a visit he never approved. No one was hurt, but his approval of auto-replies let the agent disclose where he lives and send a stranger to his door.
Reality
One team's in-app AI agent never saw 21 working handlers because its tool manifest drops any entry without a description string. The text has to be written beside each handler's definition, so the team now runs gap tests that fail when a feature ships blank.
Reality
A teardown of Claude Code 2.1.278's config files and network traffic finds background requests behind the idle summary, the follow-up suggestion and every permission decision, plus a model switch that pays to rewrite the whole cache.
Reality
A dev.to comparison scores MCP tool design at 13 website builders and content systems against eight criteria. The two designs it walks through in full both take deletion out of the flat tool list and put it behind its own gate.
Reality
Meta gives Muse read access to Messages, Mail and local files on a Mac, and its approval prompts fire only before actions such as sending a message. A columnist says the agent used notification text he never offered.
Reality
A strings trace of claude 2.1.266 puts the allowed-apps list in session memory with no key to pre-grant it, so one developer answered the dialog with a daemon that reads Apple Terminal tabs every two seconds.
Reality
Anthropic has renamed the three permission modes for Claude in Chrome to Manual, Auto and Skip all approvals. In Skip, by the company's own guide, nothing checks the agent's actions, and the extension remembers the choice.
Reality
The MCP spec mandates OAuth 2.1 with PKCE, dynamic client registration and metadata discovery for remote servers. The one-hour tokens and customer-facing audit logs procurement asks about come from a guide's own bar.
Reality
Google's Home MCP connects outside coding agents to a user's home devices, with Claude and Codex among the five named clients. Eligibility starts and ends with US subscribers on the Premium Advanced tier.
Reality
The AWS Solutions Architect Prover asks for no AWS credentials, which is the right call for blast radius and also the reason it cannot see the idle NAT gateway its author says models keep missing.
Reality
Anthropic reports that users accept 93% of Claude Code permission prompts. Its replacement is a classifier that judges each action, and switching it on revokes the blanket allow rules teams wrote for convenience.
Reality
A dev.to writeup of Bottleneck Labs' 72-hour run reports $0 in revenue and $12,431 in unsolicited invoices, because the only outbound limit that fired belonged to the email provider, and Stripe has its own delivery path.
Reality
Permission rules accumulate from "yes, don't ask again" answers into a repo-local file, and because matching runs deny then ask then allow with no specificity tiebreak, a policy that reads correctly can still stall an unattended run.
Reality
Claude will send, reply and forward once you switch approval off, which leaves that review step doing double duty as the feature's only brake and as the sole defence anyone can name against prompt injection.
Reality