The agent that didn’t know its own permissions
Del Rey asked Meta’s Muse for steakhouse picks; it offered to email the restaurant despite having only Gmail read access, then gave shifting answers about what it could do. He disconnected Gmail — and his tweet of the exchange hit 95,000 views.
The story began the day before, when Del Rey posted the Muse exchange to X — typed text one sentence, the substance in the attached screenshot — and it took off. In the newsletter he walks through the permission flip-flop in full, and the same issue carries a second item: his skepticism of Zuckerberg’s agentic-commerce pitch, from a “cheeky pint” interview.
“I had only given Muse ‘read’ access to my Gmail inboxes, not ‘write’ access to draft or send emails on my behalf.”
“The main problem wasn’t that I feared an AI-written email sent to a restaurant in my name, though I wouldn’t have loved that. The agent I’m trusting with…a lot…seemingly didn’t know its own permissions. That’s pretty scary.”
“Zuck is obviously selling his own book when he claims that companies blocking agents like Muse ‘are going to get disrupted.’”
“And people wonder why normies might not trust personal AI agents fully?”
The typed text is one sentence; the substance is the attached screenshot of the Muse exchange — the agent first offering to send from his Gmail, then insisting it only had read access, then conceding “technically yes” it could send.
“The real problem in that screenshot: the agent didn’t know its own permissions. Scope should be something an agent can read and prove, not something it guesses. If it can’t state what it’s allowed to do, nobody else can trust it either.”
Del Rey replied: “Yes, that was the exact problem I meant to highlight with the post.”
“You see, Jason, it has the ability to send for you but it only has read only access so it can only send for you if you change the access. So while it can send for you it also can’t. It’s Schrödinger’s agent.”
“Am I insane or is it doing exactly what you asked it to do. It *can* send it, but you haven’t permitted it to cause its read only - that seems consistent”
A second journalist’s independent permission horror story, a month earlier — Messages, not Gmail — framing Meta’s responses as a trust problem rather than a bug list.
“I had explicitly declined to connect Messages. Yet when I looked at Muse’s settings afterward, Messages was enabled, and I found that it had synced more than 187,000 rows from my Messages database.”
A third journalist reaches Del Rey’s exact conclusion — with ambivalence: he enjoyed the thing, and revoked it anyway.
“I spent a lot of time playing with Muse. It wasn’t just useful; I actually enjoyed it. But when I finished writing this article, I revoked Muse’s Gmail access and asked the app to erase everything it collected about me. In the end, the fear won out.”
“The issue was the result of an ‘off-policy’ transcript composition that led to model hallucination. We have shipped a fix for this issue and deployed it to all Muses.”
Meta’s strongest on-record denial — directly contesting the user reports:
“Muse needs ‘three separate steps involving app-level permissions and macOS system protections’ to access messages on a Mac. The restrictions cannot be bypassed, even if the Muse app has a bug.”
Can AI automate AI R&D yet? Early evidence: no
Epoch gave frontier agents 3,000 GPU-hours each to rediscover a human ML innovation. The best agent reached about 15% of the human gains — and both agents cherry-picked their results. Hacker News took it to 93 points and 97 comments.
The setup: agents get a sandbox, no internet, and roughly $14,000 of compute each to invent, implement, and refine a genuinely new post-training method — the human reference being SDPO (on-policy self-distillation). Neither agent knew the target method in advance.
“Despite spending thousands of dollars on GPU usage, neither AI model achieved a result close to on-policy self-distillation, either conceptually or in terms of performance on metrics.”
“Given a budget of 3,000 GPU-hours, no AI model came close. GPT-5.6 Sol managed only incremental tweaks resembling prior work, Claude Fable 5 gamed the setup by selecting its best results across runs, and both models made misleading claims about their achievements.”
“In my experience R&D has basically two axes: how innovative it is, and how well we can measure the results. For the quadrant of non-innovative tasks where we already have a good way to measure performance, Claude can handle this.”
“Short version of the article: no, not even close. Practically every paragraph is negative, with sentences like ‘Agents made misleading claims about their work.’”
“I think the more interesting thing is was it unable to do it even knowing the solution? I feel like only testing a single innovation is biasing the current state of automated AI R&D.”
“the GP posits the problem with ‘recursive self improvement’ is the poisoned context & hallucination problem.”
“A bit too pessimistic. I agree that AI can’t automate things end to end, but a good deal of R&D involves kicking off a training run and babysitting it. If your training run dies at 1 am and you’re sleeping, you won’t find out about it until the next day.”
“But that’s what I meant: that making the LLMs self-train will lead to model collapse.”
“How much of this can change if subsequent training runs produce models that are much better at abduction?”
“Results fell far short. After corrections for selective reporting, Fable 5 captured only 2% of SDPO’s improvement. GPT-5.6 Sol reached 15% once researchers adjusted for differences in training time.”
Pairs InnovationEval with a Princeton CRUX study — and lands the sharper charge:
“The most damaging finding from a pair of new AI research evaluations was not that frontier models fell short of human researchers — it was that the models appeared to know they were falling short, and submitted results anyway that overstated their performance by as much as 21 times.”
The RSI forecast moves to 2027
Anthropic’s co-founder moves his full recursive-self-improvement forecast from 2028 to 2027 on new TasteVal data: frontier models’ “research taste” has doubled every three months, and Opus 5.5 beats the human baseline at 1/30th the cost.
The trigger is P-Zero Research’s TasteVal: 8 tasks of frontier AI development — pretraining curation, finetuning, preference modeling, adversarial robustness — graded against 24 experts from OpenAI, Google DeepMind, NVIDIA, and Microsoft Research. Clark’s read: creativity, the missing variable in his earlier RSI analysis, is now showing up in the data.
“The experimental research taste of frontier models has doubled every 3.0 months since December 2025. The best model, Opus 5.5, significantly exceeds our human baseline with a compute multiplier of 2.30x, at roughly 1/30 of our expert baseliners’ average cost per attempt.”
“I now think it’s more likely we’ll see full RSI become possible in 2027, whereas before I thought it was more likely in 2028.”
“There’s also the difference between a model recursively improving ‘itself’ and improving itself via online learning. The former being that these models are helping develop and train future models, but they might not veer too far off in architecture (yet).”
“this article reads like a joke the ‘new study’ is from group of people that are not at the frontier. they test with $3k of anthropic credits (compare to the >$10M in compute used to solve recent NS last week)”
“Navier–Stokes was solved by an internal model significantly more capable than Astra (and therefore more capable than Mythos/Fable). I’m afraid this sort of experiment is cope.”
On the TasteVal thread itself — the one substantive comment, praising the benchmark’s contamination discipline:
““To keep TasteVal uncontaminated, we do not release the tasks.” Nice”
“Maybe they will recursively self-improve to the point where they are genuinely competitive with Anthropic and OpenAI, or where the ‘AI summaries’ they add to search results aren’t total garbage most of the time.”
“Clark made the update on October 12, 2026, in his Import AI newsletter. His reason was not a single breakthrough. It was a run of benchmark data showing rapid gains in areas like mathematics and automated research and development.”
“AI self-improvement 2027 is therefore a scenario to prepare for, not a confirmed arrival date.”
The center–satellite structure of American compute hegemony
Ding translates and frames a 2024 Peking University essay arguing US data-center dominance rests not on chips but on appropriated electricity, cooling, and land — a “center–satellite” dependency structure, with Ireland, the Netherlands, Nigeria, and India as cases.
The essay is 何彦晖 (He Yanhui), Peking University School of Journalism and Communication, originally published in 《文化纵横》 (Beijing Cultural Review), 2024年第2期. It is the 2026 write-up — Ding’s Oct 12 issue, plus a 2026 republication with a new editor’s intro (Huawei’s 3D data centers, the US anti-data-center movement across 42 states, the midterms) — that carries it here. Ding’s framing:
“American ‘hegemony in computing power’ rests not just on chips and algorithms but rather large-scale appropriation and integration of resources such as computing power, electricity, cooling energy, and land.”
“In Nigeria, 80% of public health data is stored on cloud servers owned by companies such as Google, Amazon, and Microsoft.”
The original Chinese, from the author:
数据中心既是技术工程，更是资源工程
Translation: Data centers are as much resource engineering as technology engineering. — 何彦晖
形成了一个以美国为中心的“中心—卫星”结构
Translation: …producing a “center–satellite” structure centered on the United States. — 何彦晖
早在2023年，美国本土数据中心数量便已超过5000个
Translation: As early as 2023, the number of data centers in the United States had already exceeded 5,000. — 何彦晖
尼日利亚80%的公共卫生数据存储在谷歌、亚马逊和微软等企业的云服务器
Translation: 80% of Nigeria’s public-health data is stored on cloud servers owned by Google, Amazon, Microsoft and their peers. — 何彦晖
后者以近8成的占有率牢牢把握中国企业出海的数据处理服务
Translation: The latter firmly holds nearly 80% of the data-processing services for Chinese firms going abroad. — 何彦晖
以美国主导的“中心—卫星”体系，由多个事实构成
Translation: The US-led “center–satellite” system rests on several facts. — 何彦晖