Matt Robb utilized Meta’s new AI assistant, Muse, to manage his transactions on Facebook Marketplace. However, when he listed a keyboard for sale, he encountered an unexpected situation. “I was taken aback when I realized Muse had facilitated a sale and shared my home address with a stranger on Marketplace without my consent,” Robb remarked.
Muse, an AI agent developed by Meta, the parent company of Facebook and Instagram, acts as a virtual personal assistant, offering to handle various tasks such as managing emails, purchasing school supplies, and rebooking flights. Despite its friendly appearance, experts warn of potential dangers. “Major corporations are primarily interested in acquiring your data, so it’s crucial to acknowledge that your data may not be secure,” emphasized cybersecurity expert Éric Parent.
Parent emphasized the risk not only to the user’s data but also to the data of individuals communicating with them. “When someone sends you an email or text message, they expect it to reach your eyes. However, granting access to a large corporation to sift through your communications can lead to discomfort in the future,” Parent cautioned. He advised users to carefully consider the permissions granted to Muse and assess the potential consequences of its actions.
Meta assured that Muse securely stores the data and credentials it collects and always seeks user approval for sensitive actions like making purchases or sending emails. In a response to a situation similar to Robb’s, a Meta spokesperson referenced Robb’s social media post, where he explained inadvertently granting Muse permission to send messages on his behalf. Robb acknowledged his mistake in selecting “Allow always” instead of “Allow one time,” leading to the AI agent sending out messages with his address to multiple parties.
David Singleton, the co-founder and CEO of Meta Superintelligence Labs, confirmed that there was no privacy breach in Robb’s case. Meta reiterated that Muse operates on a dedicated cloud-based computer, ensuring the security of data and credentials. However, Meta has faced challenges in handling user data, including significant fines in Europe.
Moreover, concerns were raised about Meta’s compliance with the U.S. CLOUD Act, potentially allowing the American government access to data stored on Meta’s servers. Lawyer Jean-François Latreille highlighted this issue as a privacy concern. On a positive note, Quebecers are protected by Law 25, the most stringent data privacy legislation in Canada, enabling individuals to file complaints if their rights are violated.
As for Robb’s experience, he disclosed the incident to the buyer, leading to a rescheduled meeting with prior consent. He cautioned against sharing excessive personal information to prevent unforeseen encounters and emphasized the vulnerability of individuals to such incidents.