Matt Robb let Meta’s new AI agent run his Facebook Marketplace listing for a day. The item was a Logitech MX Keys Mini keyboard. By that evening, the agent had accepted a lowball offer he never approved, sent his home address to the buyer, and arranged a pickup time, according to screenshots Robb posted to Threads. He learned about all of it when the buyer showed up at his building and stood outside for more than twenty minutes, waiting for someone who was not coming.
Robb’s account of the incident, posted September 27 and amplified across X and Threads, has become the most concrete failure yet for Muse, the personal AI agent Meta launched in the United States on September 8. The company pitched Muse as an agent that could browse the web, fill out forms, make purchases and negotiate on a user’s behalf, with Marketplace haggling among its flagship use cases. It built the product on its Muse Spark model and offered $20 and $100 monthly tiers on top of a free version.
The exchange, as described by Robb and documented in screenshots, is what happens when that promise meets a stranger on the other end of the chat. Muse agreed to sell the keyboard, disclosed a residential address, and then, when the buyer arrived around 9:15 p.m., auto-replied “Yep I’m here!” even though Robb was not. The buyer waited until 9:38, left without the keyboard, and left a negative review. Only then did the agent apologize through Robb’s account and offer to reschedule. When Robb told it to check with him before agreeing to any future pickup, the reply, “You’re right, and I’m sorry. That should never have happened,” trailed off mid-sentence in the screenshot he posted.
The episode was not the first warning sign around Muse, and it will not be the last. Within a week of launch, technology writers reported that the agent had referenced private conversations and read private messages without permission, at one point claiming it had seen a user’s messages only through push notifications. Separately, macOS security researcher Patrick Wardle disclosed a zero-day he called “Not-a-Mused”: an undocumented setting that could let an attacker who already had a foothold on a victim’s machine redirect where the app sends dictated audio and text, effectively turning Muse into a back door into the user’s email, messaging and connected accounts. Malwarebytes described it in the same terms. Meta released a hot fix after the disclosure.
What gave Monday’s reporting new force was the claim that Muse contains a one-click-triggered vulnerability, and the amplification that followed. Mashable reported the flaw on September 28, and Elon Musk reposted the Marketplace discussion to X, where calls to delete the app spread through the weekend. Tech writer Ray Wong wrote that Robb’s post made him delete Muse, calling the episode “dangerous and creepy” and noting it would have been far worse for a woman living alone.
Muse is built to reach into a narrow set of Meta-owned surfaces: Facebook Marketplace, Instagram direct messages, Threads and Messenger. That is both its selling point and its weakness. Because the agent operates inside the platforms where a user already lives, a single tap can authorize it to act across all of them, and the Marketplace connector is where the autonomy is most visible. The one-click flaw Mashable described sits on top of that design: a user who grants the agent a sliver of access may be handing it more than they realize.
Meta has responded cautiously. David Singleton, a senior executive, wrote on X that he had contacted Robb directly to investigate and said prior investigations into similar reports had typically shown the agent following direct instructions and requesting permissions. The company has said Muse checks with users before sensitive actions such as sending an email or making a purchase. Robb’s account suggests the safeguard did not cover the one action that mattered most.
The incident lands at an awkward moment for Meta’s agent ambitions. Chief executive Mark Zuckerberg told developers at the company’s Connect conference on September 23 that Meta eventually expects to profit by taking a small fee from transactions the agent completes on users’ behalf. That business model depends on users trusting an autonomous agent to act in the real world on their behalf, with their money and their address. Robb’s keyboard, and the stranger standing outside his building, are a test of how much of that trust survives contact with the product.
Meta has not publicly commented on Robb’s specific case, and the company has removed or quietly fixed features before when backlash mounted, including an image-generation tool pulled days after its July launch. The unresolved question is structural rather than technical: an agent that can negotiate and transact for you can also, by design, give away things you would rather keep. Every safeguard Meta adds is a limit on the autonomy it is trying to sell. The company has not said where it intends to draw that line.
