Meta's AI agent Muse set up Marketplace sale without telling him — and gave out his address - CBC

Montreal Meta's AI agent Muse set up Marketplace sale without telling him — and gave out his address A Toronto man is warning Canadians to think twice before sharing too much personal information with Muse, Meta’s AI agent that acts as a personal assistant, after he says it arranged a Marketplace sale without his knowledge and provided a stranger with his home address. Cybersecurity experts warn of potential data risks, urge caution Gloria Henriquez · CBC News · Posted: Oct 21, 2026 4:00 AM EDT | Last Updated: 10 hours ago Play Listen to this article Estimated 5 minutes The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results. He used Meta’s AI agent Muse for Marketplace sales. Then it set one up behind his back 10 hours ago | Duration closed caption 2:39 Matt Robb started using Muse, Meta’s AI agent, to handle Facebook Marketplace transactions. But after listing a keyboard for sale, he got more than he bargained for. One expert advises people to really look at what they’re letting Muse access. Matt Robb started using Meta's new AI agent Muse to handle his Facebook Marketplace transactions. But after listing a keyboard for sale, he got a bit more than he bargained for. "I was like, ‘Oh God, OK... This isn't good," he said of the moment he realized Muse had set up a sale and given his home address to a stranger on Marketplace without his knowledge. "Muse doesn't check with me, it doesn't tell me this guy has messaged and then it gives the guy my address, agrees to his price and literally tells him to come right now, that's the crazy part," Robb said. When the buyer showed up, Muse even told him, "Yep I'm here!" on Robb's behalf, when he wasn't home. A screenshot of the interaction between Robb's Muse agent and the buyer on Facebook Marketplace. (Submitted by Matt Robb) 'Your data is not secure': cybersecurity expert Muse is an artificial intelligence agent run by Meta — Facebook and Instagram's parent company. It acts as a virtual personal assistant, promising to stay on top of your emails, buy your kids' school supplies and even rebook an upcoming flight, all in exchange for access to your most sensitive data. But behind the cuddly face, experts say, there is danger. "All these big companies, they're in it for your data," said Éric Parent, a cybersecurity expert. "The answer is no, your data is not secure." Meta’s Muse is an AI agent which acts as a virtual personal assistant. (Meta) Parent says not only is your data at risk, but also the data of those who communicate with you. "A person who wrote you an e-mail or sent you a text message is expecting that message to go to your eyes," Parent said. "Now, overnight, you can be emailing somebody and they've actually granted access to a major corporation to actually sift through your emails. That's going to be an uncomfortable thing down the road." Parent advises you to really look at what you're giving Muse access to and ask yourself what the impact can be if it takes an action on your behalf. "You have to put it to the worst case scenario," Parent said. Pay attention to permissions Meta says the data and credentials Muse collects is securely stored, adding Muse will always check with you first for sensitive actions like purchases or sending an email. When asked how a situation like Robb's could have happened, a spokesperson for Meta pointed CBC to a social media post by Robb, who shared his ordeal on X. Robb explained he had clicked on "Allow always" instead of "Allow one time" when asking Muse to handle his Marketplace transactions, and by doing so, he says it granted the AI permission to send messages on his behalf going forward, using a template it put together with information it asked from him. "Which also included the pick-up address that I did give to Muse," Robb wrote in his post, adding he didn't think it would send his address out "to everyone that gave me an offer." "I mentioned to the Meta team it could be easily overlooked as it was with me and they said they will be making this more clear moving forward." Audio What could possibly go wrong with Meta's Muse? In a tweet replying to Robb's post, David Singleton, the co-founder and CEO of Meta Superintelligence Labs wrote: "Glad that we were able to confirm together that there was no breach of privacy controls." In an email to CBC, Meta said Muse runs on its own dedicated computer in the cloud, contained so no one else's agent can reach it. "That is where Muse lives and where the data and credentials for any service a person connects are securely stored," a Meta spokesperson wrote. But Meta has a history of mishandling its users' personal information , even facing fines totalling hundreds of millions of euros in Europe. Time for a digital divorce? Trade war puts spotlight on Canada's relationship with U.S. big tech Another concern is that Meta is subject to the U.S. CLOUD Act, which gives the American government the authority to access data maintained in a server owned by a U.S. company. Lawyer Jean-François Latreille says it's a privacy concern. "That would mean that technically, the American government could have access to privacy information that is being stored on these systems," he said. Quebecers protected by strict data privacy legislation But Latreille says Quebecers are protected by Law 25, Canada's strictest data privacy legislation. Under Law 25, if a company fails to keep personal information safe, it can be fined up to $25 million or the amount corresponding to four per cent of its global revenue. Latreille says Quebecers who believe their rights are violated can file a complaint any time directly with Meta's privacy officer or by addressing the Quebec Access to Information Commission . The commission told CBC in an email it urges individuals to always exercise caution when sharing their personal information. "Today's practices and mechanisms for collecting and exchanging information mean that large amounts of personal information are held and circulate widely, posing growing risks to individuals' privacy," wrote a spokesperson. A screenshot of Robb and Muse's interaction after Robb found out about the Marketplace transaction. (Submitted by Matt Robb) As for Robb and his keyboard, he told the buyer what happened and they rescheduled another meeting — one he was privy to. Robb also says Muse admitted to giving out his address without his explicit authorization. Now, he's warning others not to share too much personal information to avoid a stranger showing up at their door unannounced. "It could happen to someone more vulnerable, right?" he said. ABOUT THE AUTHOR Gloria Henriquez Journalist Gloria has been a journalist in Montreal for more than a decade. Prior to joining CBC, she reported in three languages and five different countries for Global News, France 24, Berliner Zeitung and Diario La Tribuna in her native Honduras. CBC's Journalistic Standards and Practices · About CBC News Corrections and clarifications · Submit a news tip · Report error Related Stories Overnight, Meta deleted all her accounts. AI customer service won’t let her reach a human AI photos are making it harder to know what you're booking on Airbnb. Here's what to look out for BMO CEO says don't give AI agents your banking info OpenAI says its bots have interacted with multiple U.S. government sites in unexpected AI activity AI agents tried to hack Library and Archives Canada website, research firm says