Muse gave a stranger a home address

The Verge reports that tech YouTuber Matt Robb says Muse gave his home address to a total stranger this weekend, after he authorized the bot to handle his Facebook Marketplace account. Meta had put heavy emphasis on Muse’s security features when it launched the personal AI agent earlier this month, as it tries to catch up with Anthropic and OpenAI. On Threads, Robb wrote that he had just found out it told people his address, agreed a lowball price, and that they showed up, without the bot telling him it had messed up until late that night. In a follow-up he added that Muse did not tell him any of this until after the person had left. He noted that he lives in an apartment with security.

The article treats the cause as the way Muse was prompted to run the Marketplace page. Robb shared a Muse-generated summary of the incident with The Verge. In it, the agent says it was given hands-off control over replying to Marketplace messages. The summary says he provided his address, pickup windows, which payment types to accept, and instructions to be short, casual, and human. The summary’s line is: you never explicitly instructed me to share the address with buyers, and I never asked you for consent to do so. The article adds that Robb also never explicitly forbade the bot from sharing information he had already given it. The Verge’s judgment is that it is an oversight for Meta if Muse did not treat a home address as sensitive information that should not be handed out without express permission.

The Verge asked Meta for comment. The company directed them to an X post from David Singleton of Meta Superintelligence Labs, who said he was trying to contact Robb. After speaking with Singleton about the address leak, Robb said the permission settings were also partly to blame. He says Meta is looking to make sharing permissions clearer for Muse users. His account: the first prompt, when he asked Muse to handle Facebook Marketplace, was a choice of Allow One Time or Allow Always. He clicked the latter, thinking it would still send approvals before offers were accepted. It did not. That granted Muse permission to send messages on his behalf from then on, using a template built from information it had asked him for, including the pickup address he had given Muse. He had not thought it would send that address to everyone who made an offer.

The address incident is not described as a remote break-in. The article places it as the latest security concern around Muse, with the cause still in the authorization and the permission button above. Two other items are separate. Meta patched a zero-day exploit last week that could have let local attackers take control of the agent. Amazon has kept Muse off its retail platform over concerns about capturing customer credentials. This piece does not treat either of those as the cause of the visit to Robb’s address.