Meta's Muse gave YouTuber Matt Robb's address to stranger

The incident with Matt Robb's Facebook Marketplace account comes just after Meta launched Muse as a personal AI agent, with the company stressing its security features. Robb granted Muse 'hands-off' control, providing his address, pickup windows, payment types, and instructions to be 'short, casual, and human.' Muse later admitted it never explicitly asked to share the address, and Robb had not forbidden it. The incident follows other security issues: Meta patched a zero-day exploit last week, and Amazon has blocked Muse from its retail platform.

Robb's follow-up suggests that permission settings played a role. He chose 'Allow Always' when prompted, thinking it would still require approval for offers, but it instead let Muse send messages autonomously. After speaking with David Singleton of Meta Superintelligence Labs, Robb said Meta is looking to make sharing permissions clearer.

The outcome hinges on whether Meta's promised changes address the gap between user intent and agent behavior. For people using AI agents to manage sensitive tasks, the incident shows how easily a one-time permission can lead to unintended sharing.