The Muse 0-Day Isn’t About Muse. It’s About Your Agent’s Permissions

OAuth alone is not an agent authorization system. OAuth establishes delegated access to APIs and resources (useful and often necessary), but it does not authorize each tool action, bind that action to verified intent, or stop a hijacked agent from abusing permissions the user already granted.