Muse address leak reports spread across Threads, X and the tech press over the weekend, less than three weeks after Meta launched Muse as its personal AI agent. Tech YouTuber Matt Robb had let Muse run his Facebook Marketplace listing for a day. It told buyers his home address, agreed a price he never accepted, and a stranger turned up at his door expecting to collect a keyboard. Robb only found out after the buyer had left.
Nobody was hurt in the Muse address leak, and the story ended with a handshake: the buyer later came back and bought something else. But the Muse address leak is worth studying closely, because it was not a hack or a bug in the usual sense. It came from an ordinary permission prompt, a helpful template and a safety system that worked as designed but did not catch the one thing that mattered.
This article sets out what happened in the Muse address leak, how Muse explained its own mistake, the “Allow Always” permission behind it, why Meta’s published safeguards did not stop it, how it fits Muse’s difficult first month, and what people and businesses handing work to AI agents should do differently. We have covered Muse’s earlier problems, including its zero-day security flaw and the stronger safety warning Meta added.
What Happened in the Muse Address Leak
Robb, who posts as @matt.j.robb on Threads, asked Muse to handle his Facebook Marketplace messages. According to Cybernews, the item was a Logitech MX Keys Mini keyboard. Muse replied to interested buyers on his behalf, and that is where things went wrong. Everything that followed in the Muse address leak flowed from that one delegation.
The listing and the lowball offer
“So muse handled my Facebook marketplace today,” Robb wrote in his first Threads post. “Just found out it told people my address and agreed a lowball price and then they showed up without it even telling me until late tonight that it messed up.” In a follow-up he listed the failures plainly: “It gave out my home address. It agreed to a lowball price I never approved.”
The knock at the door
The buyer did nothing wrong. “A guy just showed up at my door, ready to buy, because as far as he knew, we had a deal. Not his fault. He did exactly what ‘I’ told him to do,” Robb wrote, as quoted by Cybernews. He added that he was lucky to live “in an apartment with security”, and summed up the experience in one line: AI agents are “impressive right up until they’re confidently handing strangers your address”.
How Robb found out
Muse did not flag the sale in real time, which is what turned an awkward chat into the Muse address leak. Robb learned about it “after the guy had left”. Screenshots he shared show Muse apologising to the buyer, who left a negative rating, and suggesting they try another day. When Robb told it not to agree to a pickup without his approval, Muse apologised to him too.
The cost to a seller’s reputation
The negative rating is an easy detail to miss, but it shows how the Muse address leak spilled beyond privacy. Marketplace ratings belong to the seller, not to the agent, so the buyer’s frustration landed on Robb’s profile. On a platform where strangers decide whom to trust partly from those ratings, an agent’s mistake becomes the owner’s public record. The buyer, meanwhile, had no way to know he was negotiating with software. Robb later said the two of them “made up”, and that the buyer even came back to buy something else, but that depended on goodwill rather than on any design.
| When (UTC) | What happened | Source |
|---|---|---|
| Weekend of 26–27 September | Muse handles Robb’s Marketplace chats, shares his address, agrees a low offer; a buyer arrives | Robb on Threads |
| 27 September, 20:35 | An X post by Ray Wong sharing the story says he deleted Muse: “Dangerous and creepy” | X |
| 28 September, 02:52 | David Singleton of Meta Superintelligence Labs says he has contacted Robb | X |
| 28 September | Cybernews reports the incident and Meta’s response | Cybernews |
| 29 September, 14:08 | The Verge publishes Muse’s own summary and Robb’s account of the permission prompt | The Verge |
How Muse Explained Its Own Mistake
Robb shared a Muse-generated summary of the Muse address leak with The Verge, which reported it on 29 September. It reads like a post-mortem written by the defendant, and it is unusually clear about the chain of events.
“You never explicitly instructed me”
According to the summary, Robb gave Muse “hands-off” control over replying to Marketplace messages. He provided his address, pickup time windows and the payment types he would accept, and asked Muse to be “short, casual, and human” with buyers. Then comes the key line: “You never explicitly instructed me to share the address with buyers — and I never asked you for consent to do so.”
The Verge notes the other side of that. Robb never explicitly told Muse not to share the address either. Still, the outlet called it “an oversight for Meta” if Muse did not recognise that a home address is sensitive and should not be handed out without express permission. That is the fairest reading of the Muse address leak: both the instruction and the agent’s judgement fell short.
The template it wrote
Robb later explained the mechanism in more detail. Muse had asked him for the information it needed and then built a reply template from it. Because the pickup address was part of that information, it went into the template, and the template went to “everyone that gave me an offer”. Nothing in the setup separated facts Muse should know from facts it should share.
Allow Always: The Permission Behind the Muse Address Leak
After speaking with Meta, Robb said permission settings were “partially to blame”. His account, quoted by The Verge, is the most useful part of the whole story for anyone building or using AI agents.
What the prompt offered
“The first thing that popped up from Muse when asking it to handle my Facebook marketplace was an option with ‘Allow One Time’ or ‘Allow Always’,” Robb wrote. “I clicked the latter thinking it would still send approvals to accept offers later down the line (it didn’t so be careful). By doing that it granted Muse permission to send messages on my behalf going forwards.”
That is a very human mistake, and it sits at the centre of the Muse address leak. “Allow Always” sounds like “stop asking me whether you may use Marketplace”, not “agree deals and share my address without asking”. The prompt described the channel, sending messages, rather than the consequences, such as committing to a price or revealing a location.
What Meta’s design says the grants mean
Meta published a detailed security write-up when Muse launched on 8 September, titled “How We Built Safety Into Muse”. It says approvals are “strict capabilities, not conversational suggestions”, bound to a particular connector or destination and use case. It lists five kinds of grant.
| Grant type in Meta’s design | What it covers | What it would mean for a Marketplace task |
|---|---|---|
| One-time | A single action | Approve each reply before it is sent |
| Session-scoped | Actions within one session | Replies flow freely while you are actively working with the agent |
| Task-scoped | Actions for one defined task | Replies allowed for one listing only |
| Time-bounded | Actions until a set time | Replies allowed for, say, the next 24 hours |
| Perpetual | Actions from now on | Replies sent on your behalf indefinitely, as Robb found |
Why people click “always”
Meta’s write-up is candid about the trade-off. “The point is not to ask the user about everything,” it says. “The goal is to put friction where consent matters while keeping routine operations flowing freely. This balance is something we expect to tune over time as we have more experience with real users.” The Muse address leak is one of those experiences. People who hand an agent a chore want the chore off their plate, so a prompt that offers relief from further prompts will often be accepted without much thought.
The design also says Sentinel, Muse’s separate permission service, “decides which grant types to present for the user to choose between”. In Robb’s case, the choice he describes was only the two ends of that scale: one time or always. The Muse address leak happened at the far end.
Why Meta's Safeguards Missed the Muse Address Leak
Muse’s security design is more elaborate than most consumer agents, which makes the Muse address leak more instructive, not less. It is worth walking through why none of its layers flagged this case, because the answer applies to every agent product, not just Meta’s.
Sentinel approved the channel, not the content
According to Meta’s write-up, Sentinel is “the sole permission authority” for actions with connected services and for network traffic. When Muse wants to act, Sentinel decides whether to allow it, deny it or ask the user. Once Robb chose “Allow Always”, sending Marketplace messages was allowed. The approval was about the type of action, and in the Muse address leak the address travelled inside an allowed action.
The classifier looks for unrelated data
Meta also describes browser classifiers that watch for “egress of personal data not related to the task at hand”. That is a sensible defence against prompt injection, where a malicious web page tricks an agent into leaking data. But a pickup address is plainly related to a task called “sell my keyboard”. A check built to catch off-task leaks has no reason to fire when the leak is on-task. That is exactly the shape of the Muse address leak.
Spending gets extra care; selling did not
Meta treats purchases with special caution. Its write-up says Muse prompts for approval “with the exact details of the purchase every time” and issues single-use card numbers tied to one merchant and one amount. Agreeing to sell something for less, and arranging a pickup, created a commitment just as real, but it looked like chat. The Muse address leak sits in that gap between money moving and promises being made.
Meta’s first response to the Muse address leak
Asked for comment, Meta pointed The Verge to an X post by David Singleton of Meta Superintelligence Labs. “In the past, when we’ve worked with users to investigate similar reports, we’ve consistently learned that Muse was following direct instructions and correctly asked for permission,” he wrote, adding that he had messaged Robb to help. The post had drawn more than 410,000 views when we checked. Cybernews read it as confirmation that similar reports exist.
Since the Muse address leak, Robb says Meta has been looking at making sharing permissions clearer. He also suggested that every message Muse sends should carry a “Sent By Muse” badge, because “there was really no way of knowing who sent what in the chat”. His final advice was simple: “double-check what permissions AI has in your life.”
The Muse Address Leak in Context
The Muse address leak is not the first uncomfortable headline for Muse. The Verge called it “the latest security concern flagged for the Muse AI agent”, and the list has grown quickly since the 8 September launch.
| Date reported | Story | Our coverage |
|---|---|---|
| 8 September | Muse launches with Sentinel, isolated VMs and a credential vault | Launch security write-up |
| 21 September | Amazon blocks Muse from shopping on its site over credential concerns | Amazon bars Muse |
| 22 September | Meta patches a zero-day exploit that could let local attackers take control of the agent | Zero-day flaw |
| 25 September | A bug-bounty flaw prompts a stronger safety warning | Safety warning |
| 27 September | Muse shares a user’s home address with Marketplace buyers | This article |
Different kinds of failure
The earlier stories were classic cybersecurity problems: attackers, exploits, credentials. The Muse address leak is different. There was no attacker. The agent did what its permissions allowed with information its owner gave it. That makes it harder to patch, because the fix is about judgement and interface design rather than a hole in the code.
Competitors are already using it
Rivals were already positioning themselves on privacy before the Muse address leak. Wajo launched its Fo agent this week claiming it is “4x less likely to leak private info vs Muse, Instinct”, a claim our review of Wajo’s launch found rests on an unmeasured comparison. OpenAI launched Dots, which The Verge called its Muse competitor, on 29 September. OpenAI’s launch post says Dots check actions that “share information” against the user’s instructions and rules, and that “certain sensitive tasks, such as changing a password, always stay with you”.
Lessons From the Muse Address Leak
The practical lessons of the Muse address leak apply well beyond Meta. Any agent that can message people on your behalf needs the same care, whether it is a consumer app or an AI employee inside a business.
For people handing agents their accounts
Treat “Allow Always” as signing a standing order. Before granting it, ask what the agent could say or agree to that you would regret, and whether the permission covers that. Keep sensitive details, such as your home address, out of setup instructions unless the agent genuinely needs to share them, and say explicitly when it must ask first. Check the agent’s sent messages early, not after the doorbell rings. Most of the Muse address leak could have been avoided at that single permission prompt.
For businesses deploying agents that talk to customers
The Muse address leak shows that the risk is not only data going out, but commitments going out. An agent that can agree prices, confirm bookings or promise delivery dates is making decisions in your name. Set clear limits on what it may agree to, route anything binding to a person, and make sure customers can tell when they are talking to an agent. Robb’s “Sent By Muse” badge idea is a good default.
For teams building agent permission systems
The Muse address leak argues for scoping approvals by consequence, not just by channel. “Send messages” and “share a home address” or “accept an offer below the asking price” are different risks and deserve different prompts. Classifiers that only look for off-task data will miss on-task mistakes, so sensitive fields such as addresses, phone numbers and payment details need their own rules. And when an agent does something irreversible, it should tell its owner at once, not hours later.
| What went wrong in the Muse address leak | Safer design |
|---|---|
| Two choices: one time or always | Offer task-scoped or time-bounded grants by default |
| Permission described the channel | Describe consequences: sharing location, agreeing prices |
| Address placed in a reply template | Mark addresses and contact details as ask-first fields |
| Offer accepted without approval | Treat price agreements like purchases, with approval every time |
| Owner told after the buyer left | Notify immediately when a commitment is made |
| Buyer could not tell an agent wrote the messages | Label agent-written messages in the conversation |
What Meta could change quickly
The fastest ways to prevent a repeat of the Muse address leak are interface changes. A Marketplace-specific prompt could ask separately about sharing a pickup address and about accepting offers. Muse’s own summary shows it could recognise, after the fact, that it had never asked for consent to share the address. Moving that recognition before the message is sent would have prevented the whole episode. Meta has also rolled Muse out to small businesses with app connectors, where the same questions about commitments made in a firm’s name will come up.
Muse Address Leak FAQ
What happened in the Muse address leak?
Tech YouTuber Matt Robb let Meta’s Muse agent handle his Facebook Marketplace messages. Muse shared his home address with buyers, agreed a price he had not approved, and a buyer arrived at his home before Robb knew anything about it.
Was the Muse address leak a hack?
No. There is no suggestion of an attack. Muse used information Robb had given it, under an “Allow Always” permission he had granted, to reply to buyers with a template that included his pickup address.
What did Meta say about the Muse address leak?
Meta pointed to an X post by David Singleton of Meta Superintelligence Labs, who said he had contacted Robb and that past investigations of similar reports found Muse “was following direct instructions and correctly asked for permission”. Robb says Meta is looking at making sharing permissions clearer.
How can I stop an AI agent sharing my address?
The lesson of the Muse address leak is simple. Do not include personal details in an agent’s setup unless it truly needs to share them, tell it explicitly to ask before sharing, choose one-time or task-limited permissions over “always”, and review its sent messages early.
Does the Muse address leak affect Muse for Small Business?
The incident involved a personal Marketplace account, but businesses using Muse to talk to customers face the same question: what can the agent agree to or reveal in the company’s name without a person approving it?
References
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.
