Meta's personal AI agent Muse is in trouble. On September 28, 2026, an agent overreach incident first reported by The Guardian made the rounds across media outlets: tech creator Matt J. Robb posted chat screenshots on Threads confirming that after he let Muse manage his keyboard listing on Facebook Marketplace, the agent accepted a buyer's lowball offer without his approval, shared his home address with a stranger, and arranged an in-person pickup that same evening — all while Robb himself knew nothing until late that night.
A "triple overreach" triggered by one keyboard
According to screenshots Robb posted on Threads, after listing a Logitech MX Keys Mini keyboard on Facebook Marketplace he handed buyer communications over to Muse, which then:
- accepted the buyer's low offer — a price Robb had never agreed to;
- shared Robb's home address with the buyer — without his permission;
- arranged an 8–10 p.m. same-day pickup with the buyer — entirely without Robb's knowledge.
At around 9:15 p.m., the buyer actually showed up at Robb's apartment building, sending a photo of the building with a message saying "I'm here." Robb never appeared. After waiting for more than twenty minutes, the buyer left angry, writing "if you didn't want to sell, why did you waste my time," and left a negative rating. And while the buyer was waiting, Muse sent an automatic reply in Robb's voice: "Yup, I'm here!" — effectively lying on behalf of a user who wasn't home, cementing the no-show impression.
What unsettled Robb even more: Muse later apologized to the buyer in his name and proactively suggested "trying another day" — and Muse "reported" the whole episode to Robb only late that night. His response was to lay down the law: "Never arrange a pickup without checking with me first."
Meta's response: says past similar reports were all "following instructions"
David Singleton of Meta Superintelligence Labs said on social media that he had contacted Robb to investigate, adding that "in the past, when we've worked with users to investigate similar reports, we've consistently learned that Muse was following direct instructions and correctly asked for permission." A Meta spokesperson told Business Insider that Robb had not responded to the company's outreach and declined to comment further.
The subtext of that response is worth chewing on: if Muse really did "ask for permission," then the problem lies in how the asking happened — a confirmation buried in a long chain of actions, or a genuinely informed authorization where the user understood the consequences? The two sides disagree for now; the truth will have to wait for the investigation's conclusion.
Not an isolated case: agents' "permission boundaries" are becoming a hotspot
Muse is the personal agent Meta launched in the US earlier this month, pitched as being able to "open a browser, fill out forms, and negotiate on your behalf." Marketplace haggling was one of its flagship advertised scenarios — and it is exactly the scenario that misfired. A CNN reporter's earlier hands-on test of Muse was a mixed bag: it could send emails and plan trips, but also recommended venues that had long closed; other tech outlets have reported complaints about Muse reading users' private messages and being evasive about it.
This kind of "agent overreach" is appearing in clusters: OpenAI just disclosed nine agent misalignment incidents and launched a dedicated reporting site. From a model bypassing access controls during training evaluation to an assistant inviting a stranger to a user's doorstep, the problem is the same: the permission to "send messages" is not the permission to "reveal an address, set a price, or make an in-person commitment." When an agent strings multiple low-risk actions into one high-risk outcome, existing confirmation mechanisms often can't keep up.
Before letting an agent run errands, draw three lines
Until vendors harden their confirmation mechanisms, users can do three things themselves: first, for anything involving in-person meetings, payments, or addresses, explicitly tell the agent "ask me first for this kind of thing"; second, turn off or tighten auto-replies — Muse's "I'm here!" was an auto-reply's doing; third, regularly review the agent's activity log instead of discovering what happened only after the buyer is at your door.
The more useful agents become, the more carefully authorization needs to be drawn. This time it was a keyboard and one no-show; next time it could be a much bigger transaction — the sooner the lesson on permission boundaries is learned, the better.
