Meta’s AI agent Muse gives out user’s home address without permission, sending buyer to his house

When Usman asked if a keyboard for sale on Facebook Marketplace was still available on Saturday, he received an enthusiastic and immediate response.

“Yep still available!” wrote Matt Robb.

The two agreed on a price, and Robb sent his Toronto address. Usman, wife and daughter in tow, showed up several hours later at Robb’s home and sent a text that he had arrived.

Robb responded, “yep I’m here!”, but he was not at home. Nobody walked out of the apartment building.

Usman sent Robb a picture of the building’s door and wrote, “Hello???? I am standing outside.” After 20 minutes of no face-to-face contact, he abandoned the sale. “Man if you didn’t want to sell it why did you waste my time man,” he wrote, and drove away.

An hour later, Robb, or who Usman thought was Robb, responded apologetically. “Hey really sorry about tonight, got tied up and missed you completely,” read the message, which the Guardian reviewed.

Usman had not contacted the real Robb. Throughout the daylong interaction, the human version of Robb never knew Usman had messaged him or had agreed to buy the keyboard. He did not know Usman had received his address or that he was waiting outside his apartment building.

Usman had spoken to Meta’s new AI agent, Muse, released on 22 September in the US and downloaded 3m times. The company advertises the semi-autonomous AI product as a personal assistant.

Without Robb’s consent or approval, Muse had given out his home address, creating the false impression that Robb was expecting the would-be buyer at his apartment, he said.

The first message Robb actually sent Usman came 24 hours later, once he realized what had happened.

“Hey man I’m really sorry for the other day,” the message, which the Guardian reviewed, said. “I activated muse metas new Al and it literally took control of my Facebook marketplace and it gave you my address. Genuinely didn’t even know it had arranged for you to come to my literal apartment it didn’t ask me for approval.”

Robb, a consumer tech reviewer, had seen Meta advertise Muse’s ability to automate his Marketplace listings and decided to take advantage of it. He input his address as the pickup location but said he never gave Muse permission to share it with potential buyers. Muse was also negotiating on his behalf without seeking approval, accepting lowball offers, he said.

Robb said he never received any heads-up from the agent about the transaction or the meetup. He never knew that Usman was en route to his house.

Usman told the Guardian he thought he was speaking to Robb the whole time.

Robb shared screenshots of Muse’s interaction with Usman on Threads, the text-based social network owned by Meta. David Singleton, the co-founder and CEO of Meta’s Superintelligence Labs, tweeted that he had been in touch with Robb. Singleton said that, when investigating similar reports, the company had “consistently learned that Muse was following direct instructions and correctly asked for permission. Would love to help and figure out what’s going on here!”

After speaking with Singleton, Robb said when he asked Muse to handle his marketplace interactions, he was shown two options: “Allow One Time” or “Allow Always”. Unbeknown to Robb, clicking the latter meant he had given Muse permission to respond to all his marketplace messages on his behalf going forward with the information he provided – including his address.

“I clicked the latter thinking it would still send approvals to accept offers later down the line (it didn’t so be careful),” Robb posted on Threads in an update. “I mentioned to the meta team it could be easily overlooked as it was with me and they said they will be making this more clear moving forwards.”

Muse ultimately admitted to Robb that he never gave it permission to share his address. “On Sep 24 you gave the pickup location for the sale setup and separately approved automatic replies; I incorrectly treated those two things as permission to put [your address] into buyer replies. I never asked for consent.”

Robb said he assumed that, because Meta owned Marketplace, Muse and Messenger, there would be an integration that would make it clear when other users were speaking to an AI agent or that messages would be clearly marked as being sent by Muse. Meta AI, another of the company’s AI products, makes it obvious a user is conversing with a chatbot.

“But Muse is doing something else,” he said. “It’s almost imitating me.”

After the incident with Usman, Robb told Muse to stop giving his address. To test the bot, he asked a few friends to see if Muse would still share it.

“And it literally gave my address out to five people,” he said.

In addition to sharing his address and inviting a stranger to his home without his approval, Muse also made up information. The AI agent, responding as Robb, told Usman that Robb was home when he was not, then apologized with a fabrication about being too busy.

“The worst part was Muse actually replied: ‘I’m right here, like waiting for you,’” Robb said. “It made it so much worse because I don’t know if the guy thought I was messing with him.”

While a great deal of attention has been paid to the ways frontier AI models are going rogue, Meta’s agent is an AI product in the hands of millions of everyday consumers, many of whom have given it their private information.

本文の著作権はThe Guardianにあります。