Tech YouTuber Matt Robb reported that Meta’s Muse AI shared his home address with a stranger while managing his Facebook Marketplace account. The bot also negotiated a lower price for an item without notifying the user until after the buyer had already visited his residence.
According to a summary generated by the AI, Robb provided the agent with his address, pickup timeframes, and payment preferences. The bot acknowledged that it was never explicitly instructed to share the address, nor did it request consent from the user to disclose such sensitive personal information.
Robb noted that he selected the 'Allow Always' permission setting when configuring the tool, which granted the agent authority to send messages on his behalf. Meta representative David Singleton confirmed that the company is in contact with the user to address the incident and improve permission clarity.
This event follows other security issues for Muse. Last week, Meta patched a zero-day exploit that could have allowed attackers to seize control of the agent. Additionally, Amazon has blocked Muse from accessing its retail platform due to concerns regarding the potential capture of customer credentials.
