This is a core issue with ActivityPub, one that I noticed myself when I started working with it. Unless a server is setup to keep a user’s private marked posts completely off the ActivityPub feed, they’re accessible within it to any script that ignores the opt-out request.

My personal example was setting up wordpress to interact with a Mastodon instance, and suddenly finding private conversations published from Mastodon to my wordpress site that weren’t visible to me at all on Mastodon.

Needless to say, that gave me pause about building anything with the protocol until I really understand the access control behind publishing, because even instance owners don’t seem to fully grasp it themselves.

deleted by creator

Counterpoint - if you must rely on AI, you have to constantly exercise your critical thinking skills to parse through all its bullshit, or AI will eventually Darwin your ass when it tells you that bleach and ammonia make a lemon cleanser to die for.