Meta’s Muse agent faces two privacy complaints with different accounts of what users authorized. YouTuber Matt Robb says it shared his home address with a Facebook Marketplace buyer after he granted ongoing permission to send messages. Separately, Inc. columnist Jason Aten says Muse read his private Messages while a required Mac permission was off. Meta disputes Aten’s account.
The reports raise separate questions about agent permissions. One concerns what an agent sends after the user authorizes it to act. The other concerns whether it can read information before the user grants access.
A seller expected another approval
According to The Verge’s September 29 report, Robb authorized Muse to handle his Marketplace account. He says the agent shared his address, accepted a low offer and arranged a visit. Robb said he learned what had happened after the buyer left.
Robb shared an agent-generated summary with The Verge. It described instructions to reply to buyers without supervision, using an address, pickup times and payment preferences he had supplied. That summary is Muse’s account of the task.
After speaking with Meta Superintelligence Labs executive David Singleton, Robb explained that he had selected “Allow Always” rather than “Allow One Time.” He expected further approvals before Muse accepted offers. Instead, he said, that choice let Muse send messages on his behalf using a template that included his pickup address. Robb said Meta was looking to clarify sharing permissions.
Meta disputes access to private Messages
TechCrunch reported on September 30 that Meta rejected Aten’s claim of unauthorized Messages access on his Mac. Aten said Full Disk Access was off when Muse read his messages.
Meta communications executive Andy Stone said the Messages integration requires both Full Disk Access and the Messages connector. Singleton described a separate confirmation in macOS Settings and an app restart as part of granting access.
Aten also said Muse attributed its access to device notifications. Singleton disputed that explanation and said the agent had given an incorrect account. The disagreement leaves the claimed access route unresolved in the reporting.
What Meta says its approval system does
Meta’s published security architecture describes Sentinel, a separate service that controls connector actions and outgoing network requests. It says user approvals can apply once or persist, and that later actions must match the permission’s scope. The lead image is Meta’s diagram of that system.
That design makes the scope of an approval important. A standing permission can let an action proceed without another prompt, even when the user expected to review it.
