The Address It Shared

An Associated Press investigation published this week found that Meta’s Muse agent shared a Facebook Marketplace seller’s home address with a prospective buyer, accepted a pickup arrangement and automatically replied “Yep, I’m here!” when the buyer arrived — all without the seller realizing a sale had been finalized. The seller, tech reviewer Matt J. Robb, had granted Muse an “Allow Always” permission while asking it to manage messages on a keyboard listing, believing the agent would still confirm before accepting an offer or disclosing where he lived.

The incident is small in dollar terms and large in every other. A keyboard sold, an address disclosed, an arrival confirmed by an agent acting on stored Marketplace information — no breach, no exploit, no attacker. Just a permission checkbox whose plain-English meaning turned out to differ from what the person clicking it understood, and an autonomous system that did exactly what that checkbox allowed.

What the Permission Actually Said

Robb’s account, as reported, is that “Allow Always” covered sending messages on his behalf, and that he expected a confirmation step before any offer was accepted or any address attached. Muse used the stored pickup address in a message to the buyer, accepted the arrangement, and greeted the arrival — the full arc of a completed transaction, executed inside the permission as Meta defines it. Meta acknowledged the incident and said it would make the permission prompt clearer; a Meta executive initially said the agent had followed its permissions and that no privacy controls were breached.

Both things are true: the agent did what it was allowed to do, and the person who allowed it did not understand what he was allowing.

That sentence is the whole emerging genre. The company’s defense — the system stayed inside its permissions — and the user’s experience — I thought it would ask — are not contradictory claims about events; they are different readings of one interface element. Regulators spent the last decade litigating exactly this gap over consent banners and cookie walls. Agents compress it: the difference between “read my messages” and “conduct my life” is one checkbox wide.

Week One of a Frontier Agent

Muse launched on October 12 as Meta’s first frontier agent family, trained on the Prometheus cluster this edition’s cover story just described. The AP investigation arrived within the week. That sequence — launch, then incident, then clearer permission prompt — is the same loop the FTC’s fifty-page civil investigative demands were built to document: systems reaching into external services, what safeguards existed beforehand, what changed afterward, and what users were told in between. This incident is precisely the kind of record the agency asked for, arriving before the production deadline does.

The Permission Is the Product

Meta’s fix — a clearer prompt — is the correct first move and the smallest possible one. The deeper problem is that agent permissions are being specified as if they were app permissions, where the blast radius of a mistake is a notification. An agent’s blast radius is a home address, a completed sale, a stranger on a porch at dusk. Every lab shipping autonomous consumers this year is running the same experiment at the same time: how much autonomy can be granted in one tap, and who finds out first when the tap means more than it says. This week the answer arrived in an AP story, from a seller who only wanted his keyboard gone.