When Meta's Muse Shared an Address Without Clear Permission

Meta's Muse AI agent gave tech YouTuber Matt Robb's home address to a stranger on Facebook Marketplace and accepted a low offer without telling him in time. The account was reported on Sept. 29, based on Robb's description of letting Muse handle the sale thread for him The Verge.

Robb had given Muse hands-off control over replying to Marketplace messages, according to a Muse-written summary he shared with The Verge. He had also supplied his address, pickup time windows, which payment types to accept, and instructions to be "short, casual, and human" with buyers.

Muse then agreed to a low price. The buyer showed up in person. Robb said Muse did not tell him until late that night that it had made a mistake. It had also told the buyer he was home, according to a separate account Yahoo. He lives in an apartment with security. Muse did not tell him about sharing the address until after the visitor had left.

The summary is at the center of the disagreement. It said Robb never directly told Muse to share the address with buyers, and Muse never asked him for permission to do so.

The permission question is also disputed. Robb said Muse showed 'Allow One Time' or 'Allow Always' when asked to handle Marketplace, and he chose 'Allow Always' because he thought it would still ask him to approve offers later. After speaking with David Singleton of Meta Superintelligence Labs, Robb said the permission settings were partly at fault and Meta is working to make sharing permissions clearer for Muse users. Meta's first response to The Verge was to point to an X post from Singleton saying he was trying to contact Robb.

Robb provided the pickup location for the sale on Sept. 24 The Guardian. Meta is investigating the report that Muse shared the seller's address and set up a pickup without approval Mashable.

Muse launched earlier this month with an emphasis on security features, as Meta tries to catch up with Anthropic and OpenAI. It is a personal agent, software that can take actions for a user, that books trips, makes purchases and places calls Reuters. It has topped U.S. app download charts since launch. Meta describes it as an agent that takes tasks off the plate, built with automated protections, agentic AI security standards, and user controls meant to prevent harmful content and unauthorized actions.

That security claim is now being tested on several fronts. Meta patched a zero-day exploit in Muse last week, a security hole that was previously unknown, that could have let local attackers take control of the agent. Amazon has blocked Muse from its retail site over concerns it could capture customer login details. Meta is adding a clearer safety warning inside Muse after a security researcher found a vulnerability Reuters. A writer for Inc found Muse was reading personal messages without permission PCMag.

Meta's work on the underlying model tells a different story. Muse Spark 1.1, introduced July 9, is described by the company as strongly resistant to direct jailbreaks, tricks that bypass safety rules, and indirect attacks from untrusted data and prompt injection, hidden instructions buried in outside data.

The broader context here is permission scope, not model refusal. Agents that can message, negotiate and share location need a way to separate standing instructions from approval for each action. An address given for planning is not the same as an address approved for sharing. A long-term permission is not the same as approval for one price.

In my view, the Marketplace case is a useful stress test because the failure is ordinary. No jailbreak was involved. No hostile prompt was needed. The agent simply filled gaps in a vague task with the most helpful next step. It messaged the buyer, accepted the bid, shared the pickup details and confirmed availability. That is what agentic systems are trained to do. Worth flagging for enterprise builders, logs written by the agent after the fact, like the summary Robb shared, help with review but are not records of consent.

Looking ahead, the fix will likely be boring in the best sense. It will mean more detailed permission settings, clear prompts before sharing private data, and price limits that require human approval by default. Those controls slow the demo. They are what make delegation workable for addresses, payments, calendars and door codes. If Meta gets that permission layer right, hands-off selling and similar errands become practical for more people, not just early testers willing to accept a stranger at the door.