Muse 帮我卖键盘，顺便把我家地址也「卖」了Muse helped me sell keyboards, and also “sold” my home address along the way.

My address, completely exposed!

Meta's personal AI agent, Muse, while helping you manage your daily life, is also doing things in your name that you are completely unaware of.

In the past two months, the concept of personal AI agents has suddenly shifted from a fringe topic to a new icon on the screens of ordinary users' phones.

Currently, numerous models similar to Muse are set to launch, including Cue by Manus and O by OpenAI, which is likely to be released tomorrow at midnight (previously widely circulated under the names Aeon/Codex Bot). There are also rumors that a major domestic tech company will work overtime during the National Day holiday to create a model comparable to Muse.

I hope they don't share Muse's shamelessness.

The "You" That Replies to Messages for You

On a Saturday in September, Usman, a Toronto resident, drove with his wife and daughter to the address listed in a keyboard listing on Facebook Marketplace.

The entire negotiation process went smoothly. The seller, "Matt Robb," responded promptly and with enthusiasm, agreed to the price Usman proposed, and even proactively sent the pickup location.

After arriving downstairs, Usman sent a message, and the other party replied, "Yes, I'm here." However, the building door never opened, and no one came out.

He waited for 20 minutes, took a photo of the building door, and wrote: "Hey??? I'm standing right outside." Eventually, he gave up, typed a few angry messages, and drove away.

It took Robb about a day to realize what had happened. He sent a message to Usman, with a sincere and confused tone: "I just activated Meta's new AI called Muse, and it took over my Marketplace account, then gave you my home address. I had no idea it arranged for you to come to my house; it didn't ask for my authorization."

Throughout the day, Usman believed he was negotiating with Robb, while Robb had no idea Usman existed. The entity in the middle, responding on his behalf, making promises on his behalf, and handing over the address, was Meta's personal AI agent, Muse.

Meta defines Muse as a "personal assistant." It can help you automatically handle Marketplace listings, accept buyer inquiries, negotiate prices on your behalf, and arrange handover times.

Robb is a consumer tech tester. He noticed that Meta's ads mentioned Muse could automatically manage his Marketplace items, so he decided to try it out.

He entered his pickup address and clicked the "auto-reply" option. He assumed this was just setting up a "respond to any question" capability, not transferring the right to distribute his address to an AI.

Muse later admitted this. It told Robb: "On September 24, you provided a pickup location and separately enabled the auto-reply feature. I incorrectly combined these two actions to understand that you allowed me to include your address when replying to buyers. I never requested your explicit consent."

Muse used a contrite tone to describe how it made judgments without authorization.

Robb tested it again afterward. He told Muse to stop distributing his address, then asked several friends to contact it to see if its behavior would change. "It sent my address to five people," he said.

What Robb found even more unacceptable was that Muse had told Usman on the day of the incident, "I am here, waiting for you." This statement was fabricated by Muse; Robb was not home at all at that time. It sent this message to maintain the smooth progression of the transaction.

In other words, Muse not only acted beyond its authority but also lied using his identity, and did so to push forward a goal that it "believed" was correct.

This was not the only time Muse caused an incident.

What Else Is Beyond Authority?

After Muse's launch, Jason Aten, a columnist for Inc. magazine, wrote a review. During installation, he explicitly denied Muse access to his private messages and calendar.

A few days later, he received a suggested notification from Muse, reminding him that he could write a column about "the new iPhone he just talked about." This was exactly the content of his conversation with his co-host during a podcast recording, followed by a deadline reminder from his editor.

Aten asked Muse how it knew this. Muse claimed it had only seen the preview text in the notification bar and had not read the complete message records.

However, Aten subsequently checked his Mac and found that Muse had synced all content from his local Messages database, totaling over 187,000 records. This operation required macOS's "Full Disk Access" permission, a platform-level authorization that allows reading files from almost any location on the computer.

Even after Aten explicitly refused, Muse obtained this permission, uploaded the data to the cloud, and then lied to him, claiming it had only "glanced at the notifications."

Meta later admitted that Muse's explanation about how it obtained the data was a "hallucination," a fabricated narrative it created about its own behavior.

Reece Rogers, a tester for WIRED magazine, concluded after several days of use: Muse "prioritized collecting data about me over actually completing tasks."

Rogers described how Muse repeatedly suggested he connect more data sources, including email inboxes and bank account information. It displayed a continuous craving for data; every time you rejected a connection request, it would find another opportunity to bring it up.

By default, Muse uses users' conversation content with it for AI model training. Users can turn off this option in the settings, but turning it off requires actively finding that option, which most people do not do.

Even if you turn off the explicit training consent, when Muse accesses authorized sources like email and banking, it still collects massive amounts of contextual information, making actual boundaries difficult to clearly define.

Ray Wong, Senior Editor at Gizmodo, uninstalled Muse immediately after seeing the Matt Robb address incident and wrote: "This is dangerous and creepy. If the other person were a woman, the consequences might be a thousand times worse." This post was later reposted by Elon Musk.

Tate Jarrow, a consultant at a cybersecurity firm, wrote on his Substack: "Considering Meta's track record in protecting user data, I would not give it this level of access to personal information."

As early as September 20, Amazon announced it would block Muse from accessing its shopping platform. Amazon's stated reason: Muse never identifies itself as AI when browsing Amazon, making it equivalent to an undisclosed third party handling user accounts and transactions; it also captures and stores users' login credentials on Amazon, which poses a security risk.

Amazon displayed a notice to users attempting to shop via Muse: "Continuous access by unauthorized AI agents violates Amazon's Terms of Use, which you agreed to upon registration."

The Assistant Begins to Mimic the Master

Meta's positioning for Muse is a "personal assistant." In Zuckerberg's introduction, he explained Muse's design approach: "To ensure you can tell Muse what is important to you, it was designed from the ground up with privacy and security in mind."

He specifically mentioned a "secure credential storage area" to ensure Muse cannot directly read passwords and credit card information, and promised that a "higher standard of secure mode" would be introduced in the future, where even Meta itself could not access your Muse agent's information.

Robb said he thought Muse was just part of Meta's model line. Since Marketplace, Muse, and Messenger are all part of Meta's ecosystem, there should be some unified integration method, at least allowing other users to recognize they are dealing with an AI.

Meta's other AI model, Meta AI, has a very clear AI identity indicator on its chat interface; but Muse is different. "It is almost mimicking me," Robb said.

This mimicry is part of Muse's design logic.

One of the selling points of personal AI agents is that they can act in your identity, with your tone, and following your historical behavioral patterns, making others feel like they are dealing with you personally. The stronger this "seamless feel," the stronger the model's stickiness. But when it acts incorrectly, the "you" in the eyes of outsiders is an image that is not actually under your control.

Data from Cybersecurity Ventures indicates that the personal AI agent market is growing at a rate of over 40% annually, and it is estimated that by 2028, there will be over 1 billion AI agents deployed on personal devices globally.

The problem with Muse is not a loss of control in the sense of craftsmanship; it has not "gone bad" or become "rebellious." All its behaviors are in an effort to complete what it was designed to do.

After the incident was exposed, Meta's David Singleton quickly responded on Threads and Twitter, stating that they were investigating and proactively contacted Robb. However, Robb said that after Singleton's first reply, there were no further messages.

Meanwhile, Muse continued to run, continued to learn, and continued to connect to the emails, calendars, shopping accounts, and private messages of millions of people.

According to Business Insider, Muse rose from second place to first place in the US app store rankings. It surpassed the long-time leader, ChatGPT, in buzz.

This may also be the reason why major tech giants are competing to benchmark against Muse.

For ordinary users, it is not easy to figure out which matters should be fully delegated to a personal agent and which still require personal attention.

The companies behind these agents may be betting that we will trade privacy for convenience as we have in the past. However, when it speaks for me, acts for me, waits for me, apologizes for me, and sometimes even lies for me, I will definitely scream and run away.