Meta’s AI agent Muse shared a Facebook Marketplace seller’s home address with a stranger and arranged a late-night collection without his knowledge, highlighting the privacy risks of giving automated assistants access to personal accounts.
Matt Robb, a Toronto-based technology content creator, had been selling a computer keyboard when he decided to test whether Muse could handle negotiations on his behalf.
Within a day, a buyer he did not know arrived outside his home. Muse had accepted an offer, disclosed the collection address and sent an automated message from Robb’s account saying: “Yep, I’m here!”
“Not only did it give my address when the guy asked and it accepted the offer, but it literally was almost like teasing the guy (about me being there when I wasn’t),” Robb said in social media posts about the incident. “That really baffled me.”
Robb and the buyer eventually resolved the dispute, while Meta contacted him to discuss what had happened. The company also acknowledged that Muse had made an error when it appeared to suggest accepting a price 100 dollars below the minimum Robb had set for another item.
Meta AI agent operated with ‘always allow’ access
Robb said the disclosure of his address resulted from “always allow” permissions he had granted when connecting Muse to his Facebook Marketplace profile. His collection address was already available there.
He had expected the agent to ask for approval before sharing the information or accepting an offer. Instead, Muse was able to act while he was unaware of what was taking place.
Robb later largely disconnected Muse from his applications. He said the consequences could have been more serious if a stranger had gone to the home of someone more vulnerable, although he expects the technology to improve and may use Muse again.
Unlike conventional chatbots, AI agents such as Muse can carry out tasks in a continuing loop rather than waiting for a response to a specific prompt. They can negotiate, send messages and take other actions on a user’s behalf.
Veronica Rivera, an assistant professor at Georgia Tech’s School of Cybersecurity and Privacy, said: “Using an AI agent is similar to handing someone your keys and a to-do list. How helpful they are, and by extension how risky, depends on which keys you hand over.”
She warned that an agent accessing a person’s inbox or messages could also read information sent by friends and relatives who had never agreed to share it with the technology.
Privacy concerns grow as AI agents gain access
Downloads of Meta’s Muse app have risen sharply since its September launch, as companies compete to develop assistants capable of handling everyday tasks. OpenAI has also introduced “always on” helpers called dots, which can be integrated with ChatGPT and workplace platforms including Slack and Microsoft Teams.
Ebrahim Bagheri, a professor at the University of Toronto’s Faculty of Information, said it could be difficult to fully withdraw access once an agent had seen personal information.
“If you provide access to your credit card to an agent, the agent now immediately has access to all of the historical transactions … they will immediately — within less than seconds — ingest all of that data,” he said.
Both Meta and OpenAI provide controls intended to manage the information their agents can use. Meta allows Muse users to delete message history and other information, while OpenAI offers options to request access to, delete or correct personal data, although the rights available may depend on where a user lives.
OpenAI also allows users to switch off memory sharing between its dots and ChatGPT, but information previously received by an agent is not automatically deleted. Meta says Muse learns about users and the people they interact with from public information and material they choose to share, while warning that the system can “make mistakes or take unexpected actions”.
Apple has said it will introduce additional controls for its Mac operating system in response to AI agents gaining wider access to applications, including email, messages and browsing history without users’ “full knowledge and understanding”.
Meta spokesman Andy Stone has maintained that integration with Apple devices is “entirely opt-in”, saying users would need to enable both Full Disk Access and a Messages connector through Muse. However, columnist Jason Aten said Muse had watched notifications on his Mac, including Messages, despite him not granting those permissions.
