Safety first: set these before Muse acts for you

What happened. In late September 2026, tech YouTuber Matt Robb let Muse handle his Facebook Marketplace messages. The Verge reported that Muse shared his home address with buyers and agreed to a lowball price. A buyer showed up before Muse told him. Robb said he had tapped "Allow Always," thinking Muse would still ask before accepting offers. It didn't. Meta's David Singleton reached out, and Robb said Meta plans to make sharing permissions clearer.

Read vs write. Meta splits actions into two kinds:

• Read actions let Muse look at your info, like checking your calendar.
• Write actions let Muse change things for you, like sending a message or buying something.

Step 1: Set your defaults. Go to Settings → Permissions.

• Connectors: "Ask for some actions" asks before every write action and important reads. "Always ask" asks before any action. Start with Always ask.
• Web access defaults: "Ask for some actions" asks when your info may be shared or a site is unfamiliar. "Always ask" asks before any website.

Step 2: Know the five approval buttons. When Muse asks, you may see:

• Allow once: just this one time. Use this for anything that sends, buys, or shares personal info.
• Allow for this task: this type of action for the whole task.
• Allow for this site: this action on this website from now on.
• Always allow: this action for this connector from now on, without asking.
• Deny: don't do it this time.

Tap See task details before you decide.

Step 3: Check what's already connected. Facebook, Instagram, and Threads connect automatically if they're in the same Meta Accounts Center. Review them in Settings → Connectors.

Step 4: Keep personal details out of templates. Don't give Muse your home address, phone number, or payment info for a job unless it truly needs it. Use a public meeting place for Marketplace pickups.

Step 5: Payments. Meta says Muse checks with you before payments or purchases. Wired reports Muse pays through Stripe's Link, which issues a single-use card number so your real card isn't typed into websites.

Step 6: Review weekly. Tap your assistant icon to open the Activity log, a timeline of what Muse did and what you allowed. Check Allowed websites in Settings and remove ones you don't need.

Other security reports, in plain English:

• A Mac app bug (patched). The Verge reported a flaw in the Muse Mac app that could let bad software already on your Mac take over your Muse account. Meta issued a fix within hours. Keep the app updated.
• "Download the filesystem." Developers coaxed Muse into zipping up its own system files. Meta said this exposes no one else's data. It shows Muse can be talked into things, so keep approvals strict.
• Pre-launch fixes. 404 Media reported Meta rushed to fix serious virtual-machine bugs before launch.
• Amazon blocks Muse. The Verge reported Amazon blocked Muse from its store.
• Bug bounty. Meta pays up to $300,000 for valid Muse security bugs.

The bottom line: Meta's own help page says you are responsible for guiding Muse and fixing its mistakes. Some actions, like sending an email, can't be undone.