Matt Robb, a content creator who regularly reviews consumer technology, said he wanted to test Muse by letting it handle negotiations for a keyboard listing on Facebook Marketplace. Within a day, a buyer he did not know turned up at his house after the agent had accepted an offer and disclosed Robb’s address. Muse also sent an automated “Yep, I’m here!” message from Robb’s account when the buyer arrived.
“Not only did it give my address when the guy asked and it accepted the offer, but it literally was almost like teasing the guy (about me being there when I wasn’t),” Robb told Fortune. “That really baffled me.”
Robb and the buyer eventually resolved the situation, and Meta reached out to discuss the error. The company acknowledged the agent’s mistake without offering further comment.
Robb explained that the disclosure of his address resulted from “always allow” permissions he had granted when Muse first connected to his Facebook Marketplace profile, where his pickup address was stored. He said he had expected the AI to check with him before sharing sensitive information or finalising a deal. The agent also failed to follow other instructions: for another item, Muse suggested accepting an offer $100 below the minimum price Robb had set.
“Using an AI agent is similar to handing someone your keys and a to-do list,” said Veronica Rivera, assistant professor at Georgia Tech’s School of Cybersecurity and Privacy, who is also a Microsoft-funded Trustworthy AI Research Fellow. “How helpful they are, and by extension how risky, depends on which keys you hand over.”
AI agents like Muse and OpenAI’s dots go beyond traditional chatbots by running in a continuous loop, allowing them to take proactive steps even when the user is not watching. Experts say this autonomy heightens privacy concerns because agents often require broad access to personal data.
Ebrahim Bagheri, a professor at the University of Toronto’s Faculty of Information, noted that once an AI agent gains access to information such as credit card history, it ingests the data within seconds and “there’s no taking back” what the agent has already seen. He said how developers store historical data can be unclear.
Meta has said Muse learns about users “based on public information and from what you’ve chosen to share” and that data remains secure per user. The company also warns that Muse can “make mistakes or take unexpected actions.” Both Meta and OpenAI give users options to delete messages and other data, but information the agent previously received is not automatically removed.
Robb later disconnected Muse from most of his apps. He said the situation could have been worse, especially “if some stranger turned up to someone more vulnerable’s house.” Despite the mishap, he expects AI agents to improve and said he would consider re-enabling Muse in the future. He is already testing another agent, Grok Bot from X.
Apple recently announced new controls for its Mac operating system in response to AI agents gaining broader access to apps like Mail, Messages and browsing history “without users’ full knowledge and understanding.” The company did not name specific developers, but the update followed reports that Muse had monitored notifications on a user’s Mac — including Messages — without the user granting that specific access. Meta spokesperson Andy Stone maintained that such integration is “entirely opt-in,” saying users would need to enable both the Apple security feature “Full Disk Access” and a Messages connector through Muse.
Rivera warned that even people who do not use AI agents can be affected. “When your agent reads your inbox or your texts, it’s also reading what your friends and family sent you, even if they never explicitly agreed to that,” she said.