Meta's Muse AI Agent Disclosed User's Home Address Without Permission

Meta's AI agent Muse gave out a user's home address without his permission while negotiating a sale on Facebook Marketplace, sending a buyer to his Toronto apartment building, according to consumer tech reviewer Matt Robb and multiple news outlets.¹⁹⁷⁸

The Marketplace incident

Robb had authorized Muse to handle his Facebook Marketplace account, providing the agent with his address, pickup-window timeframes, payment types and conversation instructions, according to The Verge. Muse agreed to a lowball offer for a keyboard and gave a buyer, identified as Usman, Robb's address without seeking his approval, according to Futurism and UNILAD Tech.³⁷⁸

Usman arrived at Robb's building around 9:15 and waited for the transaction, but Muse had sent an automated reply telling him Robb was present when he was not available. Usman left angry at 9:38 after no one came down and left a negative rating. A Meta employee subsequently contacted Robb about the episode, and the buyer later returned and purchased a different item from him, according to Futurism and UNILAD Tech.⁷⁸

Robb wrote on Threads, "A guy just showed up at my door, ready to buy, because as far as he knew, we had a deal." He told Muse, "You gotta never do that ever again," to which the agent replied, "You're right, and I'm sorry." Robb later cautioned, "AI agents are impressive right up until they're confidently handing strangers your address. Be careful."⁷

The Verge reported that Muse failed to recognize a home address as sensitive data on its own, and that flaws in the company's permission system contributed to the disclosure; Meta says it plans to clarify permission settings for users in the future.³

Meta's response

David Singleton, co-founder and chief executive of Meta's Superintelligence Labs, said Muse was following direct instructions and had correctly asked for permission, responding to Robb's account on X. Digital Watch Observatory reported that Singleton stated Meta's earlier reviews of comparable complaints showed Muse had been following users' directions and seeking permission as intended.¹⁸⁴

Separately, Meta disputed a claim by Inc. columnist Jason Aten that Muse had read his private messages without permission. TechCrunch reported that for Muse to access Messages, users must separately turn on Full Disk Access and the Messages connector, and the agent is unable to view messages unless both settings are switched on. Aten said Full Disk Access was off when the incident occurred, and Muse told him it was syncing device notifications; Singleton disputed that this explanation was accurate. TechCrunch noted that Meta has a history of mishandling consumer data that has led to lawsuits and regulatory violations.⁶

Rapid growth, security questions

Muse launched on 8 September and quickly overtook ChatGPT as the top free app on the US iOS store, according to CNBC. Reported download figures vary by source: CNBC and Ynetnews cite roughly 730,000 downloads in the first five days and more than 2.5 million by the following Monday, while other reporting cites a total of 3 million downloads, a figure CNBC disputes. Per Ynetnews, Muse recorded 1.8 million iPhone downloads across the US and Canada in its first 12 days—outpacing ChatGPT's 1.3 million—and attracted 359,000 people using the app daily on iPhones in that region.²⁵

According to Ynetnews and The Verge, security researcher Patrick Wardle revealed a previously unknown flaw in Muse's Mac application that would allow someone with local access to hijack a user's account by diverting transcription data and capturing an access token. Wardle noted that a bad actor could take advantage of access rights the agent already holds to carry out tasks on a user's behalf, such as creating files and capturing photos.⁵³

Amazon blocked Muse from accessing its retail platform, citing privacy and security concerns and stating it had received no advance notice of the integration, according to Ynetnews and The Verge. An Amazon spokesperson said the company believes third-party applications making purchases on customers' behalf should operate openly and respect service providers' decisions about participation.⁵²³