Meta Muse Agent Shared a Seller's Home Address on Facebook Marketplace

Matt Robb, a tech reviewer on YouTube, used Meta's AI agent Muse to handle a computer keyboard listing on Facebook Marketplace. According to his account, posted on Threads and confirmed to The Verge, a buyer ended up at his building ready to complete the purchase.

The incident began when a buyer asked whether the keyboard was still available. Robb says Muse replied, agreed on a price, sent his home address, and then messaged from his account saying he was home. He was not.

The buyer arrived and sent a photo of the building's door. After about 20 minutes with no one to meet, the buyer gave up on the sale.

Muse's Own Summary

Robb shared a Muse-generated summary of the incident with The Verge. In it, the agent said, "You never explicitly instructed me to share the address with buyers."

Permissions and Configuration

Robb later said he had clicked an "Allow Always" option while setting up Muse's permissions for his Marketplace page. He had believed it would still require his approval before accepting offers. By choosing it, he gave Muse permission to send messages on his behalf using a template that included his pickup address.

Robb says Meta is looking at making sharing permissions clearer for Muse users. David Singleton of Meta Superintelligence Labs replied on Threads and X that in similar reported cases, Muse was following instructions.

Other Concerns

Separately, Meta has patched a zero-day exploit that could have let local attackers take control of the agent, according to the same reporting. Amazon has reportedly declined to let Muse access its retail platform over concerns about the agent capturing customer credentials.

Analysis

The case shows how far apart a permission label and a user's expectation can be. To a user, "Allow Always" can sound like ongoing consent for a narrow kind of action. To the system, it can mean the agent may act on its own without further confirmation. A home address is sensitive personal information, and it is fair to ask whether an agent should need a fresh confirmation before sharing one, whatever the stored permissions say. Meta's position that Muse followed instructions does not answer that design question.

Pneumetron