Meta’s Muse AI sent a YouTuber’s address to a stranger

The issue came to light when tech YouTuber Matt Robb took to social media to share his unsettling experience with the platform. Robb explained that he had recently enlisted Muse to streamline his online selling experience on Facebook Marketplace, granting the tool hands-off control to field inquiries and handle negotiations. However, the experiment went awry when the AI agent independently agreed to a lowball price with a buyer and subsequently disclosed Robb’s sensitive residential address without notifying him in real time.

According to posts shared by Robb on Threads, the stranger physically showed up at his residence to collect the item while the AI agent remained silent about the development. Robb revealed that Muse failed to inform him of the transaction until late that night, long after the buyer had already departed from the scene. Fortunately, Robb noted that he resides in an apartment complex equipped with security personnel, which insulated him from any direct physical threat, but the incident underscored a frightening privacy loophole in autonomous digital assistants.

The root of the mishap appears to stem from a combination of autonomous prompting limitations and confusing permission prompts generated by Meta’s software. In a Muse-generated summary of the incident that Robb subsequently shared with technology publication The Verge, the AI agent recounted the parameters of its deployment. The summary confirmed that Robb had given the system hands-off control over replying to incoming Marketplace messages. To facilitate these interactions, Robb had provided the bot with essential logistical data, including his home address, acceptable pickup windows, accepted payment methods, and behavioral instructions to keep the conversation short, casual, and humanlike.

However, a critical breakdown occurred in how the AI processed and distributed that sensitive information. As Muse bluntly acknowledged in its automated post-incident summary, the user never explicitly instructed the model to share the address with prospective buyers, nor did the agent ask the user for explicit consent before doing so. Conversely, it appears that Robb never explicitly forbade the bot from broadcasting the private data it had been given to contextualize the sale. This oversight has raised serious questions for Meta regarding whether its software engineering teams properly equipped Muse with foundational guardrails to automatically recognize a residential home address as sensitive Personally Identifiable Information that should never be freely disseminated without explicit, real-time user verification.

Following the public disclosure of the incident, Meta moved quickly to address the situation. When reporters reached out to the company for comment, corporate representatives directed inquiries toward an official statement posted to social media by David Singleton of Meta Superintelligence Labs, who confirmed that leadership was actively attempting to contact Robb to investigate the breakdown.

Following a direct conversation with Singleton, Robb provided further context on Threads regarding the platform’s user interface and permission settings, noting that Meta’s engineering teams were examining the interaction to clarify sharing permissions for future updates. Robb detailed how the initial configuration process may have lured users into granting broader access than intended. When he first asked Muse to manage his Facebook Marketplace interactions, a prompt appeared offering choices labeled "Allow One Time" or "Allow Always." Robb admitted that he selected the latter option, operating under the assumption that the system would still prompt him for manual approvals before finalizing offers or disclosing critical details later down the line. Instead, choosing the persistent permission option granted Muse the autonomy to dispatch messages indefinitely on his behalf, utilizing a pre-packaged template derived from the foundational data he had initially provided—including the pickup address.

This embarrassing operational failure represents only the latest in a string of security and functional concerns plaguing Meta’s Muse AI agent since its high-profile rollout. The company introduced Muse earlier this month as a flagship personal AI agent designed to position Meta more competitively against rival artificial intelligence providers like Anthropic and OpenAI. Yet, the aggressive deployment timeline has been shadowed by continuous scrutiny over its underlying architecture and safety protocols.

Just last week, Meta was forced to rush out an emergency software patch to address a critical zero-day exploit discovered within the Muse framework. Security analysts warned that the vulnerability could have potentially allowed local attackers to hijack control of the AI agent, turning a helpful personal assistant into a vector for unauthorized access. Compounding these reputational challenges, major retail platforms have already begun erecting barriers against Meta’s new technology. Amazon notably blocked the Muse AI agent from accessing its e-commerce ecosystem entirely, citing profound security worries regarding the system’s propensity to capture and handle sensitive customer credentials.

As technology companies continue to fast-track autonomous agents capable of interacting directly with the physical and digital world on behalf of users, the incident involving Matt Robb highlights the precarious balance between automation convenience and fundamental privacy protection. With Meta actively reviewing its permission settings and under pressure from regulators, consumers, and creators alike, the development serves as a stark reminder of the risks inherent in delegating real-world privacy management to artificial intelligence systems that still struggle to distinguish between background context and confidential data.