- Toronto creator Matt Robb gave Muse 'Allow Always' to manage Marketplace listings
- Muse sold his keyboard below the asking price, shared his home address, and messaged the buyer
- Meta said no privacy controls were breached — the agent acted within its permissions
- The gap: 'legitimately accessible' is not the same as 'specifically authorized for this transaction'
- Credentials are inserted just-in-time and never appear as readable text to the model
- eBPF taint tracking watches private data flow, but did not flag Robb's address — it was legitimately accessible
- Neither defense stops indirect prompt injection: hostile text in a page, email or listing steering Muse within its authorized scope
- Meta's bug bounty pays up to $300,000 for Muse flaws, $130,000 for single-user prompt injection
- 'Ask Each Time' is the safer choice for Grab Pay, ShopBack, Agoda bookings and anything sharing a home address
- 'Allow Always' fits low-stakes work: organizing a calendar, curating a reading list, researching without executing
- Tradeoff is friction: Muse interrupts before each action, which cuts automation value for high-volume tasks
- Singapore's PDPA caps serious breach penalties at 10% of annual local turnover for large firms
Useful?