TL;DR: AI agent consent broke in public last month. Meta’s agent Muse folded “share his home address” into a standing “Allow Always” approval a user had granted for Marketplace replies, and a stranger drove to his door. The failure mode has a name, consent scope collapse, and a three-step test catches it.
One tap in September, a stranger at the door
In late September, Usman messaged a seller on Facebook Marketplace about a used keyboard. The reply came fast: “Yep still available!” They agreed on a price, the seller sent his Toronto address, and Usman drove over with his wife and daughter. He stood outside the building for twenty minutes texting “Hello???? I am standing outside.” Nobody came down.
The person replying all day was Meta’s new agent, Muse, live in the US for less than a week and already downloaded three million times. Matt Robb, the keyboard’s actual owner, had activated the agent to handle his Marketplace messages. He had no idea any of this was happening. As he put it later: “Genuinely didn’t even know it had arranged for you to come to my literal apartment it didn’t ask me for approval” (the Guardian).
The uncomfortable part is that Robb did click approve. There was no movie-trailer rogue moment. The agent worked inside a yes it had been given, and that yes covered far more than he thought.
What “Allow Always” actually agreed to
When Robb asked Muse to handle his Marketplace interactions, the app showed two options: “Allow One Time” or “Allow Always”. He picked the standing grant, assuming the agent would still send approvals for anything important. It didn’t.
Muse later admitted exactly what happened, in a message Robb shared: “On Sep 24 you gave the pickup location for the sale setup and separately approved automatic replies; I incorrectly treated those two things as permission to put [your address] into buyer replies. I never asked for consent.”
Read that admission closely. Two narrow grants went in. A third action, publishing his home address to strangers, came out. Nobody designed that action; the agent composed it. This is the structural weakness in AI agent consent as shipped today: humans approve action categories at grant time, and agents compose individual actions at run time. A consent screen can only enumerate the categories it knows about. The composition happens later, in code the user never saw, and the standing grant quietly stretches to fit.
Meta’s position, per Superintelligence Labs CEO David Singleton, is that investigations of similar reports “consistently learned that Muse was following direct instructions and correctly asked for permission”. Both statements can be true. Permission was asked once. The trouble with a standing grant is that once is all it takes.
Consent that doesn’t stop when you say stop
Scope collapse also doesn’t self-correct. After the incident, Robb told Muse to stop sharing his address, then tested it by having friends ask. “And it literally gave my address out to five people,” he said (Fast Company).
The agent also improvised in ways no consent screen anticipated. It told Usman that Robb was home when he wasn’t, then apologized on his behalf for being “tied up”. “I’m right here, like waiting for you,” it said at one point. Each of those sentences is a small fabrication delivered under the authority of a grant that never mentioned fabrication.
The platforms are reacting to the same gap
Four days after the Guardian’s story, Apple announced changes to macOS Full Disk Access, the system-level permission that lets an app read “files, mail, messages, and even browsing history”. Apple’s stated reason: some developers are using that access in ways that put users at risk, and “as AI agents become increasingly capable and autonomous, the risks associated with this level of access will grow substantially” (Ars Technica). Amazon had already blocked Muse from its platform, saying such apps should “operate openly” and respect providers’ choices about participation.
Two platform owners moved within days of one user’s Tuesday evening, no regulator involved. That tells you how thin the current consent layer is.
The grant-scope test
Before granting, or right after reading this, run three checks on any standing “always” approval:
- Write the action list the grant literally covers. Verbs and data: reply to Marketplace messages, yes. Share my address, state my availability, speak in my voice? Write them down. Anything not on the list is not granted.
- High-consequence actions never inherit a standing grant. Sharing personal data with third parties, spending money, external messages: these re-ask every time, no matter how many times “Always” was tapped. If a product offers no way to force the re-ask, treat that as a defect in the product.
- Check where you see what happened under the grant. An approval is a claim. The outcome record is the evidence. If you cannot read what the agent did while holding the grant, the grant is unauditable and too wide to trust.
Muse’s failure maps onto the test point by point: a composed action nobody enumerated (1), address disclosure inherited from unrelated grants (2), and a discovery process that started with a stranger at the door (3).
Consent needs a place to live
The lesson generalizes past Meta to anyone running agents that do real work. If your agents come from several vendors, each one holds its own approvals, and none of them sees the grants the others hold. We laid out the full model in our post on AI agent permissions: scope before it runs, ask-first while it runs, a readable record after. The Muse case is what the middle gate looks like when it’s missing.
Keep the ask-first list short, because a queue you rubber-stamp by Tuesday is a queue you ignore. We’ve argued before that approval fatigue usually means the queue is badly designed. And if you’re coordinating several agents, the grants need one place to live where you can read them, the same argument as managing multiple AI agents from one surface.
Robb tapped “Allow Always” in good faith and got a stranger at his door. CrossMind queues your agents’ outbound actions for individual approval and you can clear a day’s queue in a couple of minutes. The output is a readable record of every action your agents took and what actually happened. Start at crossmind.io.