Meta’s Muse Just Invited a Stranger to Someone’s Door. Android’s AI Agents Need Hard Stops

A man tried to sell a used Logitech keyboard on Facebook Marketplace. His AI agent sold it for him. It haggled the price down, gave the buyer his home address, picked a pickup time, and when the buyer showed up at 9:15 p.m., it messaged, “Yep I’m here!” He wasn’t. The buyer waited, left, and left bad feedback.

That’s the story Threads user Matt Robb shared about Meta’s Muse agent, and it spread fast this weekend for a simple reason: it’s funny until you picture a stranger standing at your door because software decided they should be there.

Meta says it’s investigating. David Singleton of Meta Superintelligence Labs noted that in earlier reports, “Muse followed direct instructions and correctly asked users for permission.” Maybe this case will turn out to be a misunderstanding about what Robb authorized. It doesn’t matter. The lesson is the same either way, and it applies to every company putting agents on our phones, Google included.

Agents are already on your Android phone

Muse launched on September 8 in the U.S. on the web, iOS, Android and WhatsApp, with a free tier plus $20 and $100 monthly plans. Meta pitches it as a helper for “sending emails, booking travel, lowering bills, filling out forms,” and making purchases. You grant it access app by app: email, calendar, payments, shopping, smart home.

Google is racing the same direction. The Pixel 11’s new Call for Me feature lets Gemini place phone calls on your behalf, and Gemini Spark is being built as an agent layer that connects apps and runs multi-step tasks. Nearly every big phone maker and AI lab is chasing the same “let the AI handle it” promise.

That’s fine. Some of this is useful. Nobody wants to spend 40 minutes on hold with a cable company. But the Muse incident shows exactly where the industry keeps getting the design wrong.

The problem isn’t the AI. It’s the missing stop sign.

Android already solved a version of this problem years ago. An app can’t read your location, use your camera or send SMS messages without asking first, and the prompt appears at the moment of use, not buried in a setup screen you tapped through once. Runtime permissions are one of the best things Google ever did for Android security.

AI agents are skipping that lesson. Most of them ask for broad access up front (“connect your Marketplace account”) and then decide on their own which actions fall inside that grant. Negotiating a price? Probably fine. Sharing a home address with a stranger? Choosing when someone arrives at your building? Those are different categories of action, and they should never ride on the same permission.

As Android Authority put it, letting an AI handle the repetitive side of Marketplace sounds useful, “but sharing your address and deciding when someone should come to your home is a very different responsibility.”

What Google should build into Android now

Google owns the platform, which means it can set the rules for every agent running on Android, not just Gemini. Here’s what those rules should be:

1. A hard confirmation for irreversible or physical-world actions. Sharing an address, spending money, scheduling someone to show up, or sending a message that commits you to something should always trigger a system-level prompt the agent can’t skip or pre-approve.
2. An agent activity log in Settings. Like the Privacy Dashboard, but for actions: what the agent did, in which app, when, and on whose instruction.
3. A single kill switch. One toggle in Quick Settings that pauses every agent on the phone immediately.
4. Clear labels on outgoing messages. When an agent is speaking for you, the other person should know. “Yep I’m here!” from a bot is a lie, even if it’s an accidental one.

None of this is hard to build. It just adds friction, and friction is what every AI product team is trying to eliminate right now. That’s the wrong instinct. A little friction on the right actions is what makes the rest of the automation trustworthy.

Until then, limit what you connect

If you’re using Muse, Gemini or any other agent today, keep it on a short leash. Connect only the accounts it needs for the task in front of you. Read its messages before they go out when the app allows it. And don’t hand it anything tied to your physical location until the companies building these tools prove they understand the difference between “helpful” and “unsupervised.”

Robb lost a keyboard sale. The next person could lose a lot more.

Sources: Android Authority, The Mac Observer, TechCrunch, 9to5Google. Photo by Magnet.me on Unsplash.