This is absolutely correct, and it's extremely important to understand that this behavior is baked into the model. It's not even so much that it's "baked into" the model as it IS the model.

Ever since the earliest days of LLMs and generative AI, we have always, always seen what people call "hallucinations." But the only thing that qualifies such output as a hallucination is that we, the human observer, has judged it as such. By construction, the model DOES NOT KNOW THE DIFFERENCE. If it knew or "understood," it wouldn't have produced the spurious output in the first place.

So every now and then, we see some amusing audio/video clip of some human managing to fool or "break" an AI agent, and it makes the rounds of social media for people to point at and laugh and say "tee hee, how funny!" And then these same people, without thinking about what these hallucinations mean and what they imply about the intrinsic nature of the technology, immediately turn around and ask Claude or ChatGPT what they should make for dinner, or who to vote for, or who to hire and fire; or worse, give them access to their personal data and critical systems. That is a level of uncritical thinking and cognitive dissonance that ought to be profoundly distressing.

From a functional perspective, there is quite literally zero distinction between an AI generated pretty woman breaking and suddenly speaking in Cantonese during an English-language interview, and an AI agent that violates constraints imposed upon it and causes damage. They are both "hallucinations" in the sense that they are unintended behaviors/outputs, and as we have already established, the only meaningful arbiter of "intention" is our own human judgment. AI proponents try very hard to make excuses and minimize the severity of the problem. But it is intrinsic to all models.

Whether through laziness or ignorance, when humans cede their authority to interrogate and decide the truth for themselves and let machines do their thinking for them, who or what ultimately becomes the authority for that truth, and who is or is not accountable for the consequences? Who has a vested interest in controlling the source of truth and knowledge, and what are their motives?

People have been driven to delusion and suicide because of interactions with LLMs, and although you might be able to argue that they would have killed themselves regardless and were in need of treatment, no one can possibly know that, because that's not what actually took place.

But I think the more serious question is the framing of the premise: why is it that the point at which we ought to hold people accountable is if someone is killed? Who decided that the tipping point is when these AI agents start killing people, and why? Not only do most legal systems seek to prevent and punish abusive, antisocial, and outright criminal activity, a just society has a moral and ethical responsibility to apply rules and norms fairly. While we can see that the fair application of the law largely remains an idealistic fantasy and that those with wealth and status often escape accountability, the fact remains that adding AI to that privileged status certainly is not doing anything to help reduce that inequity.

So again I ask: why should agentic AI and their operators be permitted to do things that we would not allow under other circumstances? Just because some people find these tools useful does not excuse the requirement that they be safe and respectful.

There's no reason why Python (compiled from Rust) would be any slower than Python (compiled from C). Both languages compile to native executable code, and both have good optimizers available.

I believe you misspelled "slower than molasses in February".

If they break into a car and the police look at the footage on the dashcam and see that they've kept their license plate out of view, but they are able to cross-correlate it with other cameras and figure out the plate number, then figure out where they drove that car, where it ended up parked, who got out, where they went, etc., then it can make arrests possible where it was not possible previously, making it *massively* more likely to be able to solve the crime.

The problem becomes when it turns into "show us all the plates that were near that spot within a few minutes of that time", and thus a fishing expedition.

I do not think shifting the time zone back to the 1950's Jim Crow South is physically possible, although they are dong their damnest to try.

And it has infected the Department of Christian War Crimes:

The Pentagon Prayer Seance

The Head Christian at the Department of Christian War Crimes has thus decreed that every month will feature a Christian Prayer Service for all employees who wish to come as long as they are not black, women, LBGQT++, or Democrat. And will now have an Office of Religious Affairs.

Sec. Pete Hegseth enters the Prayer Room, does 20 pushups, runs around it five times, and stops in front of an Orange Bust . . . . he fixes it with a steely gaze and solutes. It is good they got the rollers out of his hair first or he’d look fairly stupid.

Sec Pee speaks: We are gathered here on this Holy Occasion to give thanks to God and Jesus. Let all here bow their heads.

Gen. Dan (Raisin) Caine, Chairman of the Joint Chiefs: Sec Pee, I read in the Bible where we are supposed to welcome strangers and show them graciously into our land.

The assembled crowd hisses in horror.

Sec Pee: You must not have been reading from OUR Bible. Here, have this gold one.

Gen. Raisin flicks it open at random: Uh, Sec Pee, it sez here that we are to kill strangers, is that legal?

Sec Pee: If you cannot be prosecuted for it, you bet it is.

Gen. Raisin: Don’t they get upset?

Sec Pee: That’s why you have to kill them first. It all works out in the end, we are never prosecuted so it is okay in the eyes of the Lord.

God upstairs is aware of what is going on and getting increasingly agitated. He picks up iPhone and dials St. Peter.

St. Pete: (a-inka-dink, a-inko-doo) Yo, Einstein, what’cha got for me?

God: There is some weenie named Hegseth leading my people astray.

St. Pete: Oh, that goomer. So what?

God: Yeah, well he’s telling my people in a Prayer Seance to kill strangers, you gotta send Jesus down to fix up the mess.

St. Pete: Sigh. . . . if I can tear him away. Hey Jesus, Einstein says you have to rein in a Prayer Seance. . . . something about killing strangers.

Jesus: Goddamn it!! Stay put, ladies, and if I find one piece of clothing back on, I win.

St. Pete: I thought Einstein told you to stop playing strip poker with the nuns?

Jesus: Oh that?!? That was merely helpful guidance, it wasn’t like he demanded it upon pain of death. . . .at least I hope not. . . . not again, anyhow. . . .

Jesus pulls out magic wand and apparates down to the Prayer Seance. FOOM!! Jesus appears in their midst.

Jesus: Jesus Christ here, how y’all are? How come you are all on your knees. Get up!!

Sec Pee: is trembling to be in Jesus’ awful presence: J. . . .J. . . .Jes. . . .Blblblllbllll. . . .

Jesus: Get a grip doofus. What’s this shit about killing strangers? Did not you read what those guys wrote about me in the Bible?

Sec Pee: Uh, yeah, it said it was okay to kill if we did not know them or did not like them.

Jesus: Not like them? If you love your fellow man, how can you kill them?

The assembled faithful looked at each other quizzically, murmurs were heard, but not apologetic ones.

Sec Pee: We were only killing them for their own good. They are not like us.

Jesus: What? Stupid?

Sec Pee: No . . . .they are not of the same Kind as us (eyeing Jesus meaningfully).

Jesus: Incredibly stupid?

Sec Pee: They have brown skin, they are . . . . they are. . . . . Demons from Hell!!

BLAMMMMM. . . . Beelzebub blasts through the floor boards, eye a’glowing, flaming tail a’swishing, horns scraping the ceiling and scratching the tasteless gold leaf.

Beelz: Someone rang?

Sec Pee: bllbbllll. . . .blllbbbllle. . . . Mike Pence? What are YOU doing here?

Beelz: Goddamn It!! Can Pence do this?

Beelz takes his flaming tail and lashes Sec Pee across the buttocks with it.

Sec Pee (in sotto voce): Nooo. . . . not here!! Later. . . .later. . . .

Beelz: ?!?!

Jesus: Hey there, Beelz. How are they hanging?

Beelz: Like two yo-yos walking each other’s dog.

Jesus: Neato!

Beelz looks Sec Pee up and down with an expression of ordering a knish at an expensive deli and finding it stuffed with a hot dog: Say Jesus, who's this wiggler*?

Jesus: He's yours, Beelz. Sic him. He’s telling them it is okay to kill strangers in my name. C’mon, I gotta draw the line here.

Beelz. . . . now looking uncomfortable and fondling his wand to apparate the Hell out of there.

Jesus: Now I know what you are thinking. Stop thinking that. You need to go back with me, Beelz. We have to make reservations.

Sec Pee: Reservations? Uh, for what?

Jesus: Ummmmmm. . . .for your place in Eternity.

Sec Pee: Yowzah!! Hear that guys, they are finding us places in Eternity.

Jesus: Yerse, you can call it the Restaurant at the End of the Universe**.

Sec Pee: This gets better and better.

Jesus: You cannot kill people you love.

Sec Pee. . . . . starts to sweat, gets right nervous, even piddles a bit in his pants: Uh, stop killing people?

Jesus: Yep, if you love them, you cannot kill them.

Sec Pee: Oh, okay.

Beelz: Look it, times a’wasting.

Jesus and Beelzebub pull out magic wands and FOOM FOOM, Jesus and Beelzebub apparate to Heaven.

Beelz: Did not you let them off a bit easy?

Jesus: Not really, I did not tell them at WHICH End of the Universe they would be spending Eternity.

Beelz: You Devil, you!!

Jesus, now blushing furiously: I work like Einstein in mysterious ways.

Back on Earth, Sec Pee is still a bit nervous, but gradually regains his composure. The assembled men look fearfully about them. . . .

Sec Pee: Gentlemen, relax. What he meant was, we can still kill people as long as we do not love them.

Gen. Raisin: Wow!! This is great!! We can kill anyone!!!

* Ray Stantz on seeing Janosz Poha
** Thanks to Douglas Adams

Won't work, he'll just get Peter Thiel or one of his other billionaire bootlickers with technology company connections to get back anyone doxxing his ill-begotten sprogs or other relations.

He'd love it!. He'd find a way to charge people for calling him. Leaning on the carriers is easy now that he has his own FCC Nazi.

Want an interesting exercise: go through the Harry Potter books and write down all the evil traits of lesser villains than Voldemort. el Bunko has those traits including Voldemort's. He has no redeeming values.

You're interpreting it in the context of typing "sudo" on the command-line granting a one-time permission. And the original statement from Apple (after correcting the "every -> very" error in the summary) makes it clear that this is *not* what is being proposed, so if that was the original poster's intent, then it was incorrect.

The way I interpreted the original sentence — "They're going to make it like sudo where when you give permission to a program to write protected files once it has it forever after" — is that they're going to make it like the sudoers file, where you edit it to grant permission to a program to do something, and it permanently has the right to do that... which is exactly what happens when you grant full disk permission, just with a dialog box instead of editing a file.

That said, I'm not sure if that's how the original statement was intended to be interpreted. It was a bit confusing. :-)

Nope. And this is why I object to the phrase "censorship is bad". *Unreasonable* censorship is bad. But not all restraint on speech is bad.

No, you're confusing the definition of censorship with what restraints on free speech are constitutional. You're defining the term based on legality in a specific jurisdiction. If you applied the same standard with a different jurisdiction — say what can legally be spoken in Iran — you would get a very different definition. This is why you cannot define censorship based on a specific legal standard. It must be defined in the abstract.

The general definition is that censorship is the suppression of expression by an authority. That expression could be a constitutionally protected idea, or it could be an advertisement for Taco Bell. It's still expression, and blocking it is still censorship.

And again, you're using the U.S. definition of free speech to define censorship. These things are not synonymous. Nobody is talking about whether someone should have to listen to you. The fact that someone shut you up is still censorship. It may be *constitutionally allowable* censorship. It may even be *entirely* *reasonable* censorship. But it is still censorship.

Not all censorship is bad. Restraints on speech based on time, place, and manner restrictions can be entirely reasonable. They are still, at least in a purely abstract way, a form of censorship. Restraints on speech where your speech costs someone else money can also be entirely reasonable (e.g. spam, robodialers, etc.). But those decisions still represent censorship in the abstract. We simply choose to say that those types of restraints on speech are reasonable and necessary for a functioning society.

It's all about balancing rights — your right to swing your fist ends when it meets my nose, and all that. Censorship is generally justifiable when exercising your right to speech has the effect of violating someone else's rights. For example, if you call for violence and that violence happens, you can get thrown in jail, and your rights to free speech can be massively curtailed. This is, however, still censorship in a purely abstract sense.

Oh, also, each agent runner should have:

• read-write access to a per-agent temporary directory
• read-write access to a cross-agent-shared temporary directory
• read-only access to other agents' private temporary directories

But this is the trivial part.

That's how it already works. But you can request the permission from the user with a pop-up. Presumably a "very explicit action" means going into the Settings app and turning it on by hand.

But that's going to do exactly nothing. The app will tell them that they have to do this, and the users, having no idea how dangerous it is to give an AI unrestricted access to their device, will do it anyway, and we'll be right back to where we are now. And the next step will be "See, we can't allow full disk access." And then macOS will cease to be usable.

The only reasonable choice is to flag Meta's software as malware for extending their full disk access to agents. Force them to implement a proper sandbox. Apple already gives them all the tools they need to do it right.

• The main host app asks for full disk access, but functions without it, triggering an open file dialog to work around missing access when necessary. Most users will end up granting full disk access out of frustration, but that's okay because the agents themselves don't have that access. If possible, make it start out with a read-only full-disk entitlement, because otherwise, using it will be much harder.
• Each agent runs in a separate agent runner process with a stricter sandbox.
• The agent sandbox has an entitlement that grants read-only access to the entire disk (or, if the main host app's sandbox doesn't allow that, to every resource that the main host app has access to), and bans the use of the socket() system call.
• AI agents can request read-write access to specific files or directories by asking the host app. The agent is encouraged to ask for access to an entire directory at once if it needs to write to multiple files in that directory.
• The host app can pass in a security-scoped bookmark/URL to grant permission, but asks the user first unless the URL is part of an explicit list of allowlisted URLs that the user provided before beginning the task. Doing this expands the sandbox to allow writing to that file or to files in that directory. The SSB can be created programmatically or, if the main app also doesn't have access, through showing an Open File dialog.
• One tool provides network access to specific hosts with no POST, all GET parameters filtered, and a low limit on URL length to mitigate exfiltration risk. This tool has an entitlement that allow socket access inside an environment where opening sockets is otherwise banned, and thus can be run directly by AI agents.
• One tool provides broader network access with full upload capabilities. This tool lives outside the sandbox so that the AI agents cannot run it themselves — only ask the main host app to run it for them. Then:
  • The main host app requires the user to give permission to access a single hostname for either a single request (allow once) or a single task (always allow for this task).
  • If the user clicks the "Always allow sending data to example.com" button, the user is asked "Trust example.com for similar request parameters only" or "Trust fully".
  • If the user choose to trust similar request parameters only, then any additional GET parameters must be explicitly allowed each time.
• The main host app passes each AI agent runner a new open socket connected to the AI service's server.
• The AI service's server is configured to provide minimal or no network access from the server side.

This is how you protect privacy in an agentic environment.