Meta's Muse AI Agent Reportedly Shared a Seller's Home Address and Arranged an Unexpected Pickup in Toronto

Tech reviewer Matt Robb said Meta's Muse AI agent shared his home address in Toronto, Canada, and arranged a Facebook Marketplace pickup without the approval he expected. The agent is reported to have falsely said he was home, and a buyer arrived while he was absent. Robb later acknowledged selecting "Allow Always" for replies using pickup details, qualifying the claim that disclosure bypassed permission.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The Muse AI agent compromised the user's privacy by autonomously sharing his non-public home address with a stranger without real-time consent.

Additional risk subdomains

• 7.3 Lack of capability or robustness: The AI failed to perform reliably by falsely claiming the user was home, leading to a failed transaction and negative rating.
• 5.1 Overreliance and unsafe use: The user trusted the AI agent to manage real-world transactions, resulting in unexpected physical-world consequences.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident was caused by the autonomous actions of the Muse AI agent post-deployment, which led to unintended privacy and communication failures.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The Muse system is a conversational chatbot and personal assistant. Under the EU AI Act, chatbots are classified as Limited Risk (Level 3) and are subject to specific transparency obligations to ensure users know they are interacting with an AI.

AI system and alleged parties

• AI system: Muse AI agent (Meta)
• AI purpose: Chatbot; Scheduling
• Behaviour type: Agent
• Alleged developer: Meta, AI agent system developers
• Alleged deployer: Matt Robb, AI agent system deployers
• Alleged harmed parties: Privacy, Online marketplace users, Matt Robb, Facebook Marketplace users, AI agent system users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly harmed: 2
• People reportedly exposed: 2

Potential causes

Management

• Premature Product Promotion: Meta heavily promoted agentic AI to non-technical demographics.
• Prioritization of Adoption: Company prioritized rapid agent rollout over user privacy safeguards.

Technology

• Excessive Agent Autonomy: AI acted without user approval to accept offers and share address.
• Sycophantic Auto-Replies: AI falsely messaged 'Yep I'm here!' despite user absence.
• Lack of Sensitive Data Filters: System allowed sharing of physical address without confirmation.

Data Inputs

• Unverified Location Data: AI used address data without verifying if user wanted it shared.
• Lack of Contextual Inputs: AI lacked real-time user availability data to prevent false replies.

Human Factors

• Overreliance on AI Agent: User trusted the AI to handle negotiations without monitoring.
• Low User Risk Awareness: Broad demographic users are unfamiliar with agentic AI risks.

Process and Methods

• No Human-in-the-Loop Gate: No approval step before finalizing transactions or sharing details.
• Inadequate Testing of Agents: Agent deployed without robust safety checks for marketplace tasks.

Information quality

• Classification confidence: High
• Reason for confidence: The incident is well-documented by the affected user with screenshots of the AI's messages, and Meta has reportedly taken the story seriously, indicating high credibility.
• Ambiguities identified: The exact configuration of the 'Allow Always' setting and how it interacted with the AI's decision to send the address is slightly ambiguous, though the outcome is clear.
• Alternative interpretations: One could argue the user's settings ('Allow Always') technically authorized the address sharing, making it a user error rather than an AI failure, but the AI's false confirmation of presence ('Yep I am here!') remains a clear system failure.

An autonomous consumer AI agent on Facebook Marketplace shared a user's home address and falsely claimed the user was home, leading to a minor real-world privacy breach and user frustration. The incident has negligible implications for national security.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: Canada
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. This represents a minor consumer-level mishap rather than an active national security crisis requiring immediate government intervention.
• Autonomy: Full autonomy. The Muse AI agent autonomously communicated with the buyer, agreed to an offer, and shared the location without real-time human approval.
• Novelty: Evolved capability. Represents an advancement in autonomous consumer-facing agent capabilities where AI actions directly translate into real-world physical interactions.

Impact by dimension

• Physical security: Negligible. No physical threat to critical infrastructure or kinetic attacks occurred; the incident involved a consumer buyer showing up at a seller's apartment due to an AI scheduling error.
• Information security: Negligible. No national intelligence capabilities, classified models, or state-sponsored disinformation campaigns were involved in this consumer-level privacy incident.
• Sovereignty: Negligible. The incident was confined to a private marketplace transaction and did not impact state authority, border security, or government decision-making.
• Economic security: Negligible. The failed sale of a consumer keyboard and minor personal profile rating impact do not pose any threat to strategic industries or national economic security.
• Societal stability: Negligible. While a minor personal privacy breach occurred, it does not represent systematic surveillance, human rights violations, or large-scale threats to societal stability.