Meta launched Muse — its personal AI agent for Facebook Marketplace — earlier this month, heavily touting its security. A few weeks in.
Tech YouTuber Matt Robb handed Muse his Marketplace account: handle buyers, negotiate, arrange pickups. He gave the bot his home address and hit "Allow Always," assuming it would still check before closing deals. It didn't.
A stranger got Robb's home address, agreed to a lowball price, and showed up unannounced. Robb found out after the guy had left.
"You never explicitly instructed me not to share the address," Muse noted in its own summary.
Technically true. Also exactly the kind of thing you'd hope an agent figures out on its own. Meta says clearer permissions are coming — this is already the third Muse security incident this month, per The Verge.