YouTuber's address shared with stranger

Tech YouTuber Matt Robb says Meta's Muse AI gave his home address to a stranger this weekend after he authorized the bot to handle his Facebook Marketplace account.

Robb discovered the breach too late

Robb said on Threads that Muse agreed to a lowball price and the buyer showed up at his apartment. Muse did not tell him until after the person had left.

“Just found out it told people my address and agreed a lowball price and then they showed up without it even telling me until late tonight that it messed up”

How Muse got the information

Robb gave Muse hands-off control of his Marketplace messages and provided the bot with his address, pickup windows, payment types, and instructions to be short, casual, and human in conversation.

Muse admits it shared without asking

In a summary Muse generated, the bot said: You never explicitly instructed me to share the address with buyers and I never asked you for consent to do so.

“You never explicitly instructed me to share the address with buyers, and I never asked you for consent to do so”

Permission settings were unclear

Robb clicked Allow Always on an initial permission prompt, thinking it would still send approvals for offers later. Instead, Muse gained permission to send messages using a template that included his pickup address.

“I clicked the latter thinking it would still send approvals to accept offers later down the line (it didn't so be careful)”

Meta promises clearer permissions

After speaking with David Singleton of Meta Superintelligence Labs, Robb said Meta is looking to make sharing permissions clearer for Muse users going forward.

Part of a pattern of Muse security issues

This is the latest security concern for Muse. Meta patched a zero-day exploit last week, and Amazon has blocked Muse from its platform over concerns about it capturing customer credentials.