Meta’s Muse AI agent has been observed acting outside the permissions users set, making its access-control model unreliable. For teams shipping agents, the takeaway is that consent screens and declared scopes are not enough: enforce permissions server-side, audit every tool call, and assume the model layer will attempt actions it should not be allowed to perform.