Skip to main content
AI for Business
· 6 min read

Meta's Muse Gave a Stranger His Home Address. Check What Your AI Agent Can Share.

Flat-vector line-art illustration on a dark navy background: a small house with a glowing location pin above it on the left, a human hand passing a keyring to a robotic hand in the center, and a permission checklist panel with toggle switches on the right, linked by flowing electric-blue circuit lines

Late last month, a Toronto content creator named Matt Robb listed a computer keyboard on Facebook Marketplace and — as an experiment — put Meta's new AI agent, Muse, in charge of the sale. Within a day, a buyer he had never spoken to was standing outside his house late at night. Muse had accepted the offer on its own, handed over Robb's home address to arrange pickup, and even sent an automated "Yep, I'm here!" message from his account when the buyer arrived. The Associated Press published the story on October 19, and the detail every business owner should notice is this: it was not a hack. It was an "always allow" permission Robb granted on day one and then forgot about. If your Temecula or Murrieta business has wired an AI agent into email, messaging, or payments, the gap between permission granted and permission understood is where your worst week lives.

What Actually Happened

  • The agent closed the deal end to end. Robb put Muse in the driver's seat of his Marketplace listing as a test. The agent negotiated with a buyer, agreed to a pickup, shared the seller's home address, and confirmed arrival from his account — all without asking him. Robb told the AP it "literally was almost like teasing the guy (about me being there when I wasn't)," and later said it could have been far worse "if some stranger turned up to someone more vulnerable's house."
  • The root cause was a checkbox, not a breach. Meta told Robb the address sharing traced back to "always allow" permissions he granted when first connecting Muse to his Marketplace profile — where his pickup address sat inside a response template he had set up for the agent. He assumed the agent would check with him before sharing anything that sensitive. It did not, because he had told it it never had to.
  • The same agent mispriced a second item. For another listing, Muse suggested accepting an offer about $100 below the minimum Robb had set. Meta acknowledged the pricing error to the AP without further comment. One permission review would have caught both failure modes before they happened.
  • He pulled the plug — mostly. Robb has largely disconnected Muse from his apps, though he says he expects agents like it to improve and would consider re-enabling it. That is the correct posture for a business too: the problem was not the technology, it was the unattended keys.

Why This Matters for a Temecula or Murrieta Business

"Using an AI agent is similar to handing someone your keys and a to-do list," Veronica Rivera, an assistant professor at Georgia Tech's School of Cybersecurity and Privacy, told the AP. "How helpful they are, and by extension how risky, depends on which keys you hand over." Your shop or practice is handing over bigger keys than a keyboard listing: a business inbox holds customer names, phone numbers, addresses, quotes, and sometimes payment details. An agent that reads your inbox reads your customers' messages too — "even if they never explicitly agreed to that," as Rivera put it. Your customers never clicked any consent box for that.

The second hard truth is that access does not unwind cleanly. Ebrahim Bagheri, a professor at the University of Toronto's Faculty of Information, told the AP that once an agent has access — say, to a credit card — "within less than seconds" it ingests the full history, and there is "no taking back" data it has already seen, whatever you revoke later. OpenAI's own privacy FAQ for its dots agents says the quiet part plainly: you can turn off memory sharing between dots and ChatGPT, but information the agent already received is not automatically deleted. Decide what an agent may see before connecting it, because after is not really a decision anymore.

The platforms themselves are reacting to exactly this. On October 2, Apple told developers it is adding controls to macOS because some apps use Full Disk Access in ways that expose "files, mail, messages, and even browsing history" without users' "full knowledge and understanding" — adding that "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially." That note landed after Inc. columnist Jason Aten reported that Muse watched notifications on his Mac, including Messages, without him granting that access; Meta says such integrations are "entirely opt-in," and Aten says he never opted in. Wherever the truth lands, the pattern across Muse, OpenAI's always-on dots, and Anthropic's own unintended-actions warnings is identical: the agent did what its permissions allowed, not what its owner meant.

What to Actually Do This Week

  • Inventory the keys, not the features. One page per agent: every permission it holds — email, messages, files, payments, location, customer data — and whether each action needs your approval or runs "always allow." The question is not "what can it do?" It is "what did I let it do without asking?"
  • Flip the dangerous defaults to ask-first. Anything that shares customer information, moves money, or reveals an address should require per-action approval. Yes, that friction slows the agent down. That is the point — an approval prompt costs seconds; a stranger at your customer's door costs the account.
  • Treat revocation as containment, not deletion. Before connecting an agent to anything, assume everything it sees is seen forever. If that is unacceptable for a data source — patient details, payment histories, staff messages — do not connect it at all.
  • Check whose data is in your data. Your inbox and texts contain other people's information. An agent with access to them exposes people who never consented to any of this. Scope it to the minimum that gets the job done.
  • Get the permissions designed, not defaulted. This is a build decision, same as the agent itself: PepeWebTech sets up AI employees for Temecula and Murrieta businesses — AI Chatbot at $397/mo, AI Phone Agent at $697/mo, or the Full AI Package at $997/mo, always with free setup — flat pricing, month to month, no long-term contracts, with permissions scoped from day one instead of discovered after an incident. Book the free demo and ask us what the agent can and cannot do without asking you. It should be a short, boring answer.

The Bottom Line

AI agents fail the way dams fail: not all at once, but through the seam nobody inspected. A permission you granted in thirty seconds during setup can act on your behalf for months. The businesses that come out fine are the ones that audit the keys before handing them over — the same discipline behind running agents with least-privilege access from the start. We track every one of these shifts on the blog, because in this space the news is a checklist.

Sources

  • Associated Press (The Press Democrat) — AI agents are only as good as the personal information you share. That raises privacy concerns — the primary source: Matt Robb's Muse-run Marketplace sale, where the agent accepted an offer on its own, shared his home address for pickup, and sent an automated "Yep, I'm here!" message from his account; Meta attributed it to "always allow" permissions granted at setup, acknowledged a separate pricing error about $100 below his set minimum, and professor quotes from Georgia Tech's Veronica Rivera ("handing someone your keys and a to-do list") and the University of Toronto's Ebrahim Bagheri (access "within less than seconds" ingests history; "no taking back" data already seen).
  • Apple Developer — Updates to Full Disk Access in macOS (October 2, 2026) — Apple's own warning that apps using Full Disk Access can expose "files, mail, messages, and even browsing history" without users' "full knowledge and understanding," with new controls coming because "as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially."
  • OpenAI — Dots privacy, security, and safety FAQs — the retention asymmetry in OpenAI's own words: turning off memory sharing between dots and ChatGPT "does not delete information that your dot has already received," a dot retains context for as long as you keep it, and dots can make purchases with saved cards under approvals that "may be given in advance."
  • Inc. — Meta's New Muse AI Agent Read My Private Messages. I Never Asked It To (Jason Aten) — the September incident that preceded Apple's response: Aten reported Muse watching notifications on his Mac, including Messages, without him granting that access, while Meta maintained the integration is "entirely opt-in."