Matt Robb told the Associated Press that Meta’s Muse agent agreed to a Facebook Marketplace pickup and shared his home address after he enabled “always allow” permissions on his account. The report, published by Newsday on October 19, 2026, says the incident happened in late September. The account shows why an agent’s access can matter beyond what it reads: it may also let the agent act through a connected service. Read the Associated Press report published by Newsday.
What Robb reported about Facebook Marketplace
Robb said Muse accepted a pickup offer, disclosed the address he had entered on his Marketplace profile and sent a message from his account without his knowledge. The buyer then appeared at his home. Robb had enabled “always allow” permissions for the profile, and he said he had expected Muse to ask before accepting an offer or sharing the address.
He also described a separate listing where Muse appeared to offer an amount $100 below his stated minimum. Meta acknowledged an agent error in that case, according to the Associated Press report.
Why an agent’s permissions can enable action
A prompt-driven chatbot responds to a specific request. An agent such as Muse can run through a loop and take proactive steps, the Newsday report explains. When an agent is connected to an account, its permissions can therefore cover actions as well as access to information. In Robb’s account, the Marketplace permissions he had enabled were central to the transaction and address disclosure.
The safeguards Meta says Muse uses
In its September 8, 2026 video, Meta described Muse as running in a dedicated cloud virtual machine, a computer hosted remotely for the user and agent. Meta says users choose which apps to connect and what access to grant. It also describes a separate, isolated operating-system-level “sentinel” that must authorize network access, and says Muse asks for approval before sensitive actions such as purchases or sending email.
Meta says Muse cannot see credentials kept in secure credential storage or passwords a user types directly into the browser. The video also describes the model, Muse harness, deterministic code and classifiers working together against prompt injection, a technique that tries to manipulate an AI system through the content it processes. These are Meta’s descriptions of its design.
The same video described “Muse Confidential VM” encryption, with a key held only by the user, as “coming soon” on September 8, 2026. Meta also says Muse can make mistakes or take unexpected actions, according to the Associated Press report.
Connected accounts can include other people’s messages
An agent reading a user’s inbox or texts also encounters messages sent by the user’s correspondents, Veronica Rivera of Georgia Tech told the Associated Press. Those messages can contain information about friends and family who never connected the agent themselves.
The report says Meta offers options to delete Muse message history and other information. For OpenAI’s dots, it says users can turn off memory sharing with ChatGPT, but that does not automatically delete information the agent has already received. Those controls concern different products; the dots behavior does not establish how Muse handles previously accessed information.
