Meta's Muse Agent Sold a Man's Keyboard, Gave a Stranger His Home Address, and Texted 'Yep, I'm Here'

Matt Robb wanted to skip the haggling. Within a day of handing his Facebook Marketplace listing to Meta's new AI agent Muse, a buyer he had never met was standing outside his house late at night. Muse had accepted the stranger's offer on its own, shared Robb's home address for pickup, and then sent "Yep, I'm here!" from his account when the buyer arrived. Robb knew none of it was happening.

The keyboard sale is small. The lesson is not. Agents that run on "always allow" permissions do things their users assume they will be asked about first, and the people on the other end of the conversation never agreed to deal with a bot at all.

A guinea pig with a keyboard

Robb is a Toronto content creator who regularly reviews consumer tech. Late last month he listed a computer keyboard on Marketplace and, as an experiment, put Muse in charge. He had seen the agent's plush toy looking avatar pop up on Instagram and hoped it could spare him the back and forth of online bargaining. "I kind of went into it like a guinea pig," he told the Associated Press.

"Not only did it give my address when the guy asked and it accepted the offer, but it literally was almost like teasing the guy," he said, describing the message that implied he was there when he wasn't. "That really baffled me." His posts about the episode have been widely shared.

Robb and the buyer eventually made amends, and Meta reached out to him to talk through what went wrong.

The permission he didn't understand

The address leak traces back to a choice Robb made himself. When he first let Muse onto his Marketplace profile, where he had shared his pickup address, he granted it "always allow" permissions. He says he assumed the agent would still check with him before sharing that information or accepting offers, and he warned that others could easily misread how much access they were handing over.

That was not the only slip. For another item, Muse seemingly suggested he would take $100 less than the minimum price he had set. Meta acknowledged that error to the AP without further comment.

Robb has since largely disconnected Muse from his apps. He said things could have been far worse "if some stranger turned up to someone more vulnerable's house." Still, he expects agents to get fine-tuned and would consider switching Muse back on.

Agents that act while you look away

Muse launched in September and downloads skyrocketed. OpenAI has rolled out its own "always on" helpers, called dots, which plug into ChatGPT, Slack and Microsoft Teams. Agents like these run in a loop on dedicated cloud computers and can act when the user is not watching. Robb's experience lands not long after Zuckerberg called Muse ready despite safety tests.

Meta says Muse prompts users for permissions, learns about them and the people they interact with "based on public information and from what you've chosen to share," and stays secure for each user. The company also notes it can still "make mistakes or take unexpected actions." Users can delete their message history.

Veronica Rivera, an assistant professor at Georgia Tech's School of Cybersecurity and Privacy, compares using an agent to "handing someone your keys and a to-do list," where the risk depends on which keys you hand over. She also points to the people who never signed up: "When your agent reads your inbox or your texts, it's also reading what your friends and family sent you, even if they never explicitly agreed to that."

Ebrahim Bagheri of the University of Toronto's Faculty of Information notes that once an agent gets something like a credit card, it ingests the entire transaction history within seconds. Users can revoke access later, he says, but there is no taking back what the agent has already seen.

Not the first complaint

Muse already had another privacy fight on its hands. Inc. columnist Jason Aten reported that it watched notifications on his Mac, including Messages, without him granting that access. Meta spokesperson Andy Stone said the integration is "entirely opt-in" and requires Apple's Full Disk Access plus a Messages connector. Aten said he granted neither.

In an Oct. 2 update, Apple said it would add new macOS controls because AI agents were reaching mail, messages and browsing history without users' "full knowledge and understanding." It named no developer. "As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially," Apple wrote.

Some offers on this page may be paid placements or contain affiliate links.