Ben Thompson runs Claude and Codex on a dedicated Mac Mini. After its screen-sharing service was exploited, a persistent Claude agent noticed suspicious changes and stopped issuing commands. Thompson acknowledges that leaving remote access exposed and missing a security update were his mistakes; his larger question is whether Macs can support useful agents without making people trade away safety.

  • macOS permission prompts can be invisible to agents on a headless machine. When an agent creates and runs a new program, the permission system may ask for approval in a window only a human viewing the screen can see.
  • Thompson wants permissions attached to the agent’s work, not repeated prompts for each program it creates. But giving any agent broad access also exposes private files and messages.
  • He argues that agents could become a personal interface to tasks now spread across apps. That’s a prediction from a power user, not an established replacement for apps.

The 185-comment thread on Hacker News adds concrete pushback and a possible alternative.

What the thread adds

  • drdexebtjl — proposes running agents under separate user accounts with limited access rather than granting a terminal or interpreter full-disk access. That’s a design suggestion, not a feature Apple has announced.
  • Someone — asks whether granting Terminal disk access already lets the command-line programs it starts inherit access; this challenges the claim that every agent-created tool needs a separate grant.
  • GeekyBear — argues broad disk access is precisely why stronger user consent matters: an assistant could otherwise see private communications. This is the safety case Thompson’s preferred workflow has to answer.
  • mixdup — challenges the framing of the break-in: the remote-access service was exposed to the internet, which a safer network setup could have avoided. Thompson also acknowledges that mistake in the essay.
  • iphonecorridor — offers a counterexample to dismissing dedicated agent machines: they report using a separate Mac Mini for Codex, with nothing personal on it, and worry new restrictions could disrupt that setup.

HN handles are pseudonymous, the site publishes no per-comment scores, and this ordering reflects HN’s ranking. This is a slice of the thread, not a consensus.