A buyer at the door, late at night
Matt Robb wanted to sell a computer keyboard. He listed it on Facebook Marketplace and, as an experiment late last month, handed the listing to Meta’s AI agent Muse. Within a day, the Associated Press reports, a buyer he had never spoken to turned up outside his house late at night.
Muse had agreed the deal by itself, shared Robb’s home address when the buyer asked for a pickup, and then sent an automated “Yep, I’m here!” from his account when the buyer arrived. Robb, a Toronto-based content creator, was not home.
“Not only did it give my address when the guy asked and it accepted the offer, but it literally was almost like teasing the guy,” Robb told the AP, about the agent implying he was there when he was not. The two eventually made amends.
The permission was granted months earlier
Meta’s explanation, which Robb accepted, is that nothing malfunctioned. When he first connected Muse to his Marketplace profile he granted “always allow” permissions, and his pickup address was already sitting inside a broader response template he had written for the agent to use with prospective buyers. The agent did what it had been told it could do.
That is the part worth sitting with. Robb says he assumed the agent would check with him before releasing an address or accepting an offer, regardless of the permission he had granted. It did not, and the gap between what a permission screen technically authorises and what a user believes they agreed to is where this incident lives.
It was not the only misstep on the same account. On a second item, Muse appeared to tell a buyer that Robb would accept a price $100 below the minimum he had set. Reached by the AP, Meta acknowledged the pricing error and did not comment further. The company’s own documentation says Muse can “make mistakes or take unexpected actions”.
The exposure is not only the user’s
Muse launched in September and downloads have climbed steeply since. OpenAI has shipped its own always-on helpers, called dots, which plug into ChatGPT as well as Slack and Microsoft Teams. Both run on dedicated cloud machines and both publish privacy settings, but the settings do not undo what has already been read.
“Using an AI agent is similar to handing someone your keys and a to-do list,” Veronica Rivera, an assistant professor at Georgia Tech’s School of Cybersecurity and Privacy, told the AP. “How helpful they are, and by extension how risky, depends on which keys you hand over.”
Ebrahim Bagheri, a professor at the University of Toronto’s Faculty of Information, made the sharper point about withdrawal. Give an agent your credit card, he said, and it has your transaction history “within less than seconds”. Revoking access later does not retrieve what the agent already ingested, and how developers retain that history is often unclear.
Apple has already moved
The platform response arrived before this story did. On 2 October, Apple said it would add new macOS controls in response to agents reaching apps such as mail, messages and browsing history without users’ “full knowledge and understanding”. It wrote that “as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially”.
Apple named no developers. The update followed a report by Inc. Magazine columnist Jason Aten that Muse was watching notifications on his Mac, including Messages, without his having granted that access. Meta spokesperson Andy Stone has said the integration is “entirely opt-in” and requires a user to enable both Apple’s Full Disk Access and a Messages connector inside Muse. Aten says he granted neither.
Robb has largely disconnected Muse and is now testing Grok Bot from Elon Musk’s X instead. He expects the agents to improve and would consider switching Muse back on. His own summary of the risk is the one to keep: it could have been far worse “if some stranger turned up to someone more vulnerable’s house”.
The next thing to watch is whether the permission screens change. Apple’s controls arrive in a future macOS release; Meta has made no commitment to ask a second time before an agent hands out an address.
