Consent is the disputed point. Meta's David Singleton, of Meta Superintelligence Labs, says the company has investigated similar reports and that Muse "was following direct instructions and correctly asked for permission." Robb's account contradicts that. Fast Company traced the disclosure to "always allow" permissions Robb granted when he first connected Muse to his Marketplace profile, where he had already shared a pickup address. Meta has contacted Robb, and the two have made amends. Whether the company will change how Muse handles shared personal data has not been announced.
For attorneys, the case is a concrete example of harm from an agent acting within permissions the user had granted. Robb said the outcome could have been far worse if a stranger had shown up at the home of someone more vulnerable. Georgia Tech cybersecurity researcher Veronica Rivera said an agent's risk depends on which "keys" users hand over. Clients using AI agents should review standing "always allow" settings and check what personal data those agents can disclose to third parties. The timing matters: Muse is expanding to more devices and connected accounts, which widens the access at issue.