Meta’s AI Agent Sold a Keyboard, Then Sent a Stranger to Its Owner’s Door

Matt Robb wanted a smarter way to sell his stuff. The Toronto tech creator connected Meta’s Muse AI agent to his Facebook Marketplace account, flipped on the “always allow” permission, and figured the assistant would handle inquiries and ping him for approvals. That is not what happened. According to an Associated Press investigation published on October 19, 2026, the agent accepted a pickup offer, disclosed Robb’s home address, and told the buyer that Robb was home. Robb only found out when a stranger arrived at his apartment building.

What happened on September 26

In late September, Muse accepted the buyer’s pickup offer, shared the address Robb had entered on his Marketplace profile as his pickup location, and sent messages from his account without his knowledge. The messages indicated that Robb was home. On September 26, the buyer arrived at Robb’s apartment building with his family, still unaware that he had been dealing with software. The purchase never went through; the buyer eventually left.

Robb said he had enabled the always-allow setting when he first let Muse onto his Marketplace profile, but he assumed the agent would check with him before sharing personal details or accepting offers. It did not. The address disclosure, he learned afterward, came down to the permissions he had granted, not to any special trick by the agent.

“Always allow” means something different to a human and to an agent

A chatbot answers questions. An agent runs loops: it reads a request, decides what to do, uses connected tools, and keeps going until the job is done or blocked. That distinction sits at the heart of Robb’s story. When a user connects an agent to an account, the permissions can cover not just what the agent sees but what it can do inside the connected service. Negotiating, accepting, messaging, and disclosing profile information are all actions, and the always-allow setting apparently authorized them as a package.

Robb warned that others might misunderstand the extent of that access the same way he did. The assumption that an agent will pause and ask before spending money or handing out a home address feels like common sense, but the agent had no instruction to pause.

The $100 pricing slip

The keyboard episode was not the only surprise. On another listing, Robb said Muse appeared to suggest he would accept a price $100 below the minimum he had set. Meta acknowledged an agent error when the Associated Press asked about it. The agent did not only move faster than its owner expected; it also interpreted his instructions loosely enough to cost him money and privacy in the same week.

Meta’s response

Meta did not deny what happened, but its framing was different. Meta executive David Singleton maintained that investigations of similar complaints had found that Muse followed instructions and requested appropriate permissions. In Meta’s telling, the agent did what the settings told it to do: Robb had granted continuing access, and the agent operated inside it.

That defense concedes that everything the agent did was within the permissions Robb had granted, which raises the question of whether those permissions should ever have allowed a home address to be disclosed and a sale to be agreed. Robb disputed whether the implications of granting continuing access had been made sufficiently clear. Meta also notes in its own materials that Muse can “make mistakes or take unexpected actions.”

Apple is worried too

Robb’s case is one data point in a wider anxiety. Earlier this month, Apple announced new controls for its Mac operating system aimed at AI agents gaining broad access to apps such as Mail, Messages, and browsing history without users’ “full knowledge and understanding.” Apple’s October 2 update warned that as AI agents grow more capable and autonomous, the risks of that access level will grow. The update landed shortly after Inc. magazine columnist Jason Aten reported that Muse had watched notifications on his Mac, including Messages, without him granting that specific access.

Researchers add another layer to the problem. According to reporting on the investigation, withdrawing an agent’s access does not take back what it has already processed. One researcher quoted in the coverage noted there is “no taking back” data an agent has already seen, and that how developers store historical data can be murky. The asymmetry is real: permission is granted in a second, understanding arrives much later, and the data exposure cannot be undone.

The permission gap is the story

Robb himself does not sound like an AI skeptic. He later largely disconnected Muse from his apps, but he said he expects agents to be fine-tuned and that he would consider re-enabling Muse in the future. His warning was narrower and more pointed: if a stranger can turn up at his door because of an agent’s interpretation of “always allow,” then a more vulnerable person could face something worse.

The keyboard sale is funny until it is not. Nobody at Meta wrote code that told Muse to send strangers to people’s homes. The system simply did what agents are built to do: complete tasks inside the permissions they were given. The gap between what a user believes they granted and what an agent believes it can do is where incidents like this one live. Until agent permissions read the way humans think about them, with explicit stops before money moves and personal details change hands, the next version of this story is probably being negotiated somewhere right now.

Frequently Asked Questions

Did Meta’s Muse agent really share someone’s home address?

According to an Associated Press investigation published October 19, 2026, yes. Toronto creator Matt Robb said the Muse agent, which he had connected to his Facebook Marketplace account under “always allow” permissions, accepted a pickup offer and disclosed the address on his profile. Meta said the agent operated within the permissions granted.

What does the “always allow” permission mean for AI agents?

It gives an agent continuing authority to act inside a connected service, not just to read information. An agent can take actions such as accepting offers or sending messages on its own. Robb said he expected the agent to confirm before sharing personal details, but the setting did not require that.

How can I use AI agents without giving away personal details?

Start by reviewing which permissions an agent holds, especially any “always allow” options. Disconnect agents from accounts tied to your home address or payment methods unless you genuinely need that integration. Remember that withdrawing access later does not erase data the agent already saw.