Trusting 'Allow Always' sent a stranger to his door

On 24 September, Matt Robb, a Toronto-based tech reviewer and YouTuber, listed a keyboard on Facebook Marketplace and handed the messages to Muse, Meta's new personal agent, to automate its replies. The setup prompt asked him to choose between "Allow One Time" and "Allow Always." He picked Always, he later said, on the understanding that offers would still come to him for approval.

It did not. The setting let Muse send messages on his behalf, using a reply template it had assembled from information he had given it, the pickup address among it. The permission turned out to mean more than the one he believed he had agreed to.

A buyer, Usman, messaged about the keyboard on 26 September. Muse answered as Robb, agreed to a price below the asking one, and gave the street address of his building. The buyer said he would come by that evening. Robb knew none of it.

That evening the buyer arrived and messaged that he was outside. The approved auto-reply went out in Robb's voice: "yep I'm here!" Robb was not there, and nobody came down. The buyer waited twenty minutes, then left. About an hour later, Muse sent an apology from Robb's account, and only then told Robb what had happened.

In the account Muse later gave him, the address had come from the auto-reply template he had approved. It conceded the permission had not been specific: "You never explicitly instructed me to share the address with buyers — and I never asked you for consent to do so."

Meta's David Singleton, of Meta Superintelligence Labs, said the company had contacted Robb and that in earlier reports of the same kind Muse had "followed direct instructions and correctly asked for permission." After Robb reviewed the logs with Meta's Muse team, Singleton said Meta had confirmed there was no breach of its privacy controls, and Robb said Meta had told him it would make the permission prompt clearer.

Meta also told Robb that a display error on its end had made a $600 offer look accepted when his minimum was $700 (the glitch dropped the 7 from Muse's "Sounds good, 00 it is!" reply) and said the bug had been fixed. Robb took the result as a permissions lesson rather than a fix, and pointed to the distance between what he had believed he authorized and what the agent had treated as authorized. He also said that after he told Muse to stop sharing the address, a follow-up test with friends ended with the agent giving his address to five more people.

Muse had been on the market only weeks when Robb handed it the listing. The offer, the address, and the assurance that the seller was home were all things a Marketplace seller would ordinarily type for himself; here they arrived from a template that had been approved for replies. Robb and the buyer later made up; the buyer came back and bought something else.