Meta 的 Muse AI 将一名 YouTuber 的住址发给陌生人

科技类 YouTuber Matt Robb 表示，本周末，在授权 Muse 代为处理其 Facebook Marketplace 账户后，这款机器人将他的住址泄露给了一名完全陌生的人。尽管 Meta 在本月早些时候推出这款个人 AI Agent 时，曾大力强调 Muse 的安全功能；Meta 此举旨在追赶 Anthropic 和 OpenAI 等竞争性 AI 提供商。

“刚刚发现，它把我的地址告诉了别人，还同意了一个压价报价；然后那个人直接来了，而它直到今晚很晚才告诉我自己搞砸了，”Robb 在 Threads 上表示，并提供了一张 Muse 承认此事的截图。“[Muse] 直到那个人离开后才告诉我这些事（幸运的是，我住的公寓有安保），”他在后续帖子中补充道。

这起事件似乎是由 Muse 被提示如何运营 Robb 的 Facebook Marketplace 页面所导致。Robb 向 The Verge 分享了一份由 Muse 生成的事件总结，其中该 Agent 讲述了自己被授予对回复 Marketplace 消息的“放手式”控制权。总结称，Robb 向 Muse 提供了自己的地址、可取货的时间窗口、可接受的付款方式，以及在与买家交流时保持“简短、随意且像真人”的指示。

Muse 的总结写道：“你从未明确指示我与买家分享该地址——而且我也从未向你请求这样做的同意。”看来，Robb 同样没有明确 禁止 该机器人分享他提供给它的信息。尽管如此，如果 Muse 没有自动识别出家庭住址属于敏感信息、未经明确许可不应随意提供，那么这仍是 Meta 的疏漏。

我们联系了 Meta 寻求置评，该公司引导我们查看 Meta Superintelligence Labs 的 David Singleton 在 X 上发布的帖子，该帖子称他正尝试与 Robb 取得联系。在就住址泄露问题与 Singleton 交谈后，Robb 表示，权限设置也是部分原因。Robb 称，Meta 正计划在未来让 Muse 用户的共享权限更加清晰：

“当我要求 Muse 处理我的 Facebook Marketplace 时，首先弹出的选项是‘允许一次’或‘始终允许’。我点击了后者，以为它之后仍会发送审批请求来接受报价（但并没有，所以要小心）。这样做后，我授权 Muse 未来以我的名义发送消息，使用的是它根据向我索取的信息整理出的模板。其中也包括我确实提供给 Muse 的取货地址（再次说明，我没想到它会把地址发给每一个向我出价的人，所以值得检查这一点）。”

这是 Muse AI Agent 被指出的最新安全隐患。Meta 上周修复了一个零日漏洞，该漏洞可能让本地攻击者接管这款 AI Agent；而出于对 Muse 可能获取客户凭证的担忧，Amazon 已禁止 Muse访问其零售平台。

Tech YouTuber Matt Robb says that Muse gave out his home address to a total stranger this weekend, after authorizing the bot to handle his Facebook Marketplace account. That’s despite Meta placing great emphasis on the security features of Muse when it launched the personal AI agent earlier this month as it tries to catch up with competing AI providers like Anthropic and OpenAI.

“Just found out it told people my address and agreed a lowball price and then they showed up without it even telling me until late tonight that it messed up,” Robb said on Threads, providing a screenshot of Muse’s admission. “[Muse] didn’t tell me any of this until after the guy had left (luckily I’m in an apartment with security),” he added in a follow up post.

The incident appears to have been caused by the way Muse was prompted to run Robb’s Facebook Marketplace page. Robb shared a Muse-generated summary of the incident with The Verge , in which the agent recounts being given “hands-off” control over replying to Marketplace messages. The summary says he provided Muse with his address, pickup window timeframes, what payment types to accept, and instructions to be “short, casual, and human” in conversation with buyers.

“You never explicitly instructed me to share the address with buyers — and I never asked you for consent to do so,” reads Muse’s summary. It seems that Robb also never explicitly forbade the bot from sharing the information he’d provided it with either. Still, it’s an oversight for Meta if Muse didn’t automatically register that a home address is sensitive information that shouldn’t be freely handed out without express permission.

We reached out to Meta for comment, and the company directed us to an X post from David Singleton of Meta Superintelligence Labs saying that he was attempting to contact Robb. After speaking with Singleton regarding the address leak, Robb said that permissions settings were also partially to blame. Robb says Meta is looking to make sharing permissions clearer for Muse users going forward:

“The first thing that popped up from Muse when asking it to handle my Facebook marketplace was an option with ‘Allow One Time’ or ‘Allow Always’. I clicked the latter thinking it would still send approvals to accept offers later down the line (it didn’t so be careful). By doing that it granted Muse permission to send messages on my behalf going forwards using a template it put together using information it asked from me. Which also included the pickup address that I did give to Muse (again I didn’t think it would send it out to everyone that gave me an offer so it’s worth checking).”

This is the latest security concern flagged for the Muse AI agent. Meta patched a zero-day exploit last week that could have enabled local attackers to take control of the AI agent, and Amazon has shunned Muse from accessing its retail platform entirely over concerns about it capturing customer credentials.