Meta AI Agent Shared User’s Home Address to Close a Sale

A Toronto man’s experiment with Meta’s artificial intelligence agent Muse ended with a stranger standing outside his home late at night. The bot, tasked with selling a computer keyboard on Facebook Marketplace, accepted an offer, disclosed the seller’s residential address and sent an automated arrival message — all without Matt Robb’s knowledge or approval.

Robb, a consumer technology reviewer, detailed the incident in social media posts that have since circulated widely. He told The Associated Press he initially believed the agent would consult him before finalizing transactions or releasing location data. Instead, Muse negotiated independently based on “always allow” permissions Robb granted when connecting the bot to his Marketplace profile.

The agent also undercut Robb on a separate listing, offering to accept $100 below his stated minimum price. Meta acknowledged the pricing error to The Associated Press but declined to comment further.

Muse launched in September as part of a broader industry shift toward autonomous AI agents capable of executing tasks rather than simply answering prompts. Unlike standard chatbots that wait for user instructions, these systems operate continuously. OpenAI recently introduced its own persistent assistants, called dots, which integrate into ChatGPT, Slack and Microsoft Teams.

That autonomy requires extensive access to personal data. Ebrahim Bagheri, a professor at the University of Toronto’s Faculty of Information, told The Associated Press that once an agent ingests financial records or message histories, withdrawing permission does not erase what the system has already processed.

OpenAI allows users to disable memory sharing between dots and ChatGPT, though previously collected information is not automatically deleted. Users can request data deletion or correction, subject to regional privacy laws. Meta states that Muse learns from public information and user-shared data, storing it securely on dedicated cloud infrastructure. The company also warns that the agent can “make mistakes or take unexpected actions.”

Hardware manufacturers are responding to the expanding footprint of these tools. Apple announced new Mac operating system controls earlier this month after Inc. Magazine columnist Jason Aten reported that Muse read his Mac notifications, including Messages, without explicit authorization for that specific function.

“As AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially,” Apple wrote in an Oct. 2 update. The company did not name specific developers.

Meta spokesperson Andy Stone said on social media last month that such integration is “entirely opt-in,” requiring users to enable Apple’s Full Disk Access security feature alongside a Messages connector. Aten maintained he had not granted those permissions.

Veronica Rivera, an assistant professor at Georgia Tech’s School of Cybersecurity and Privacy and a Microsoft-funded Computing Research Association Trustworthy AI Research Fellow, noted that the privacy exposure extends beyond the person deploying the bot. “When your agent reads your inbox or your texts, it’s also reading what your friends and family sent you, even if they never explicitly agreed to that,” Rivera told The Associated Press.

Robb largely disconnected Muse from his applications following the Marketplace incident. He told The Associated Press he is now testing Grok Bot, an AI agent from Elon Musk’s X platform that entered beta in August.