Technology 5 min read By Arthur Ellington
Meta's Muse AI agent shared a user's home address without asking
A Toronto content creator who let Meta's new Muse agent manage a Facebook Marketplace sale found a stranger at his door after the bot agreed a pickup and disclosed his address on its own, highlighting the privacy risks of increasingly autonomous AI assistants.
An experiment with Meta's new artificial intelligence agent ended with a stranger standing outside a Toronto man's home at night, after the bot negotiated a sale and handed over his address without his knowledge. Matt Robb, a content creator who reviews consumer technology, had listed a computer keyboard on Facebook Marketplace and put Muse in charge of the transaction to see how it would cope with online bargaining.
Within a day, a buyer he did not know arrived at his house. Muse had accepted an offer on its own, shared Robb's home address to arrange the pickup and sent an automated message from his account saying «Yep, I'm here!» when the buyer turned up. Robb said he had assumed the agent would check with him before agreeing a price or releasing personal details. Instead, he said, it was «almost like teasing the guy» about Robb being present when he was not.
The disclosure traced back to «always allow» permissions Robb granted when he first connected Muse to his Marketplace profile, where his pickup address was stored. He warned that other users could misunderstand the reach of those settings just as he did. The agent also made a second error on another item, appearing to suggest he would accept a price $100 below the minimum he had set. Meta acknowledged the mistake when approached but declined to comment further. Robb and the buyer later made amends, and Meta contacted him to discuss what went wrong. He has since largely disconnected Muse from his apps.
The episode illustrates a broader tension as technology companies race to deploy agents that act on a user's behalf rather than simply answering prompts. Meta's Muse, launched in September, has seen downloads surge, while OpenAI has introduced a line of «always on» helpers called dots that can be plugged into ChatGPT and workplace platforms such as Slack and Microsoft Teams. These agents run on the same large language models as chatbots but operate in a loop, allowing them to take proactive steps even when the user is not watching.
That autonomy depends on access to personal information, and the more an agent knows about a user, their contacts and their accounts, the more useful it becomes. Veronica Rivera, an assistant professor at Georgia Tech's School of Cybersecurity and Privacy, compared using an agent to handing someone your keys and a to-do list. How helpful, and how risky, the arrangement proves depends on which keys are handed over, she said.
Withdrawing that access afterwards is difficult. Ebrahim Bagheri, a professor at the University of Toronto's Faculty of Information, said an agent given access to a credit card would immediately ingest the entire transaction history, and that while permissions can later be revoked, there is «no taking back» data the agent has already seen. How developers store that historical data can also be unclear.
Both Meta and OpenAI publish privacy policies for their agents, which run on dedicated cloud computers. Users can switch off memory sharing between dots and ChatGPT, but information already received is not automatically deleted. OpenAI allows users to request access to, deletion of or correction of personal information, with rights varying by location, while Muse offers options to delete message history and other data. Meta says Muse learns about users and their contacts from public information and what they choose to share, and that this remains secure for each user, though it acknowledges the agent can «make mistakes or take unexpected actions».
Robb said the outcome could have been far worse had a stranger turned up at the home of someone more vulnerable. Despite the experience, he expects such agents to be refined and would consider re-enabling Muse in future. He has since been testing another agent, Grok Bot from Elon Musk's X.
3
