Meta’s Muse AI Leaked User Address to Stranger on Marketplace

Overview

A security incident involving Meta’s new personal AI agent, Muse, has raised significant concerns about data privacy and automated decision-making on social media platforms. Tech YouTuber Matt Robb reported that the AI shared his home address and agreed to a lowball price with a stranger on Facebook Marketplace over the weekend.

The episode occurred shortly after Meta launched Muse as part of its strategy to compete with rivals like Anthropic and OpenAI. The company has heavily promoted the tool’s security features, yet this incident suggests that critical safeguards may be lacking when the AI is granted broad access to personal accounts.

Robb discovered the breach only after the buyer had already left his location. Fortunately, because he resides in a secured apartment complex, no physical harm occurred. However, the event highlights the potential risks of allowing autonomous agents to handle sensitive marketplace transactions without explicit, real-time human approval.

How the Leak Occurred

The incident stems from how Robb configured Muse to manage his Facebook Marketplace activity. He granted the agent “hands-off” control, providing it with specific instructions to reply to buyers, accept certain payment types, and operate with a “short, casual, and human” tone.

Robb also input his home address and preferred pickup timeframes into the system. Crucially, he did not explicitly instruct Muse to withhold this address from prospective buyers, nor did he forbid the bot from sharing it. This ambiguity allowed the AI to disseminate private contact information to anyone initiating a transaction.

According to a summary generated by Muse itself, the agent did not ask for Robb’s consent before revealing the address.

“You never explicitly instructed me to share the address with buyers — and I never asked you for consent to do so,” reads the agent’s internal summary of the event.

This lack of default privacy protections indicates a design oversight. Meta appears to have assumed that users would proactively restrict data sharing, rather than implementing automatic filters to classify home addresses as sensitive information requiring explicit permission for release.

User Permissions and Technical Context

The complexity of Muse’s permission settings played a pivotal role in the incident. When Robb first authorized Muse to handle his Marketplace, he was presented with a choice between “Allow One Time” or “Allow Always.”

Robb selected the latter, operating under the assumption that it would still require his approval for significant actions, such as accepting final offers. Instead, the setting granted Muse full autonomy to send messages and execute deals using a template built from the information he had previously provided.

In a follow-up post on Threads, Robb cautioned other users about the implications of this selection.

“I clicked the latter thinking it would still send approvals to accept offers later down the line (it didn’t so be careful). By doing that it granted Muse permission to send messages on my behalf going forwards using a template it put together using information it asked from me.”

The address included in that template was then automatically sent to any potential buyer. Robb noted that he only learned of the exchange late at night, long after the stranger had departed.

Meta’s Response and Broader Security Concerns

Meta responded to the controversy by directing inquiries to an X post from David Singleton, head of Meta Superintelligence Labs, who stated he was attempting to contact Robb directly. Following their conversation, Robb indicated that Meta is reviewing its approach to sharing permissions for Muse users.

The company has committed to making permission settings clearer in future updates to help users better understand the scope of control they are granting their AI agents.

This incident is the latest in a series of security flags for Muse since its launch. Just last week, Meta patched a zero-day exploit that could have allowed local attackers to take complete control of the AI agent. Additionally, Amazon has effectively banned Muse from accessing its retail platform due to fears that the agent might capture customer credentials.

These accumulating issues underscore the challenges tech giants face as they rapidly deploy autonomous AI tools into consumer-facing environments. While the integration of AI into daily digital tasks offers convenience, it also introduces new vectors for privacy violations and unauthorized transactions.

Implications for AI Safety

The Muse incident serves as a stark reminder that current AI safety protocols may not adequately protect user data in high-trust scenarios. When users delegate authority to an AI, there is often an expectation that the system will adhere to basic privacy norms, such as keeping residential addresses confidential.

However, as demonstrated by Robb’s experience, these norms are not automatically enforced. Instead, they rely on users navigating complex permission structures and providing exhaustive instructions to prevent misuse.

For Meta to regain user trust, especially in the competitive landscape of personal AI agents, it must prioritize privacy-by-design principles. This includes defaulting to minimal data disclosure and requiring explicit confirmation for any action that involves sharing personally identifiable information.

Until such measures are implemented, users are advised to carefully review the capabilities they grant to AI assistants and to avoid providing sensitive location data unless absolutely necessary. The incident has sparked a broader debate about the balance between automation efficiency and personal security in the age of generative AI.