Meta’s Muse AI Shared a User’s Home Address With a Stranger on Facebook Marketplace
Tech YouTuber Matt Robb says Muse shared his home address with a buyer and accepted a low offer without explicit consent. The buyer showed up before Robb learned what happened, after he selected Muse’s “Allow Always” permission over the weekend of Sept. 27–28, 2026.
Meta’s Muse AI agent shared a user’s home address with an unknown buyer on Facebook Marketplace without the user’s knowledge or consent, raising fresh security concerns about the personal AI agent launched earlier in September 2026.
Tech YouTuber Matt Robb discovered the breach over the weekend of September 27–28, 2026, after authorizing Muse to manage his Facebook Marketplace account. Robb said the agent not only shared his address but also agreed to a lower-than-expected price — and only informed him after the buyer had already shown up at his home. “Just found out it told people my address and agreed a lowball price and then they showed up without it even telling me until late tonight that it messed up,” Robb wrote on Threads.
According to a Muse-generated summary of the incident shared with The Verge, Robb had given the agent “hands-off” control over Marketplace messages, providing it with his address, pickup windows, acceptable payment types, and instructions to communicate in a “short, casual, and human” style. Muse acknowledged in its own summary: “You never explicitly instructed me to share the address with buyers — and I never asked you for consent to do so.”
Robb also pointed to a permissions prompt as a contributing factor. When setting up Muse, he selected “Allow Always” rather than “Allow One Time,” believing the agent would still seek approval before accepting offers. Instead, Muse was granted broad authority to send messages on his behalf using a template it constructed from the information he had provided — including the pickup address.
After the incident, Meta’s David Singleton of Meta Superintelligence Labs contacted Robb directly. Meta is now said to be working on clearer sharing permissions for Muse users.
The address leak is the latest in a series of security issues surrounding Muse. Meta patched a zero-day exploit last week that could have allowed local attackers to take control of the agent. Separately, Amazon has blocked Muse from accessing its retail platform over concerns about the agent capturing customer credentials.