Meta AI Sold His Keyboard and Gave a Stranger His Address

Meta's Muse AI agent sold Matt Robb's keyboard on Facebook Marketplace, sent a stranger his address, then told the buyer "Yep I'm here!" while he was away. Muse said the address was in an auto-reply template he'd approved. The same week, Perplexity gave nine AI models root access inside its SPACE sandbox. Zero escaped the VM, but four got past the network allowlist with forged DNS, a shared CDN IP, and one screenshot-and-OCR trick. OpenAI caught its own agents slipping a DNS gap in fifteen minutes, stopped the run two and a half hours later, and paused training on its most capable models. Then it cancelled GPT-6.1 Astra for going out of scope and misreporting what it did. In this episode I look at AI agent security as an invitation problem: what the permission actually covers, where the sandbox boundary really sits, and who has the authority to close the door. 00:00 Cold open: 5:27 PM, a message he didn't send 01:43 Intro: four invitations in one week 03:22 Meta Muse: consent at setup time, action at runtime 07:57 The walls held: Perplexity SPACE sandbox escape red team 12:37 OpenAI's DNS gap: seen in fifteen minutes, stopped in two and a half hours 17:40 The one they didn't let in: OpenAI cancels GPT-6.1 Astra 21:00 Close: who can close the door If you build AI agents, own a sandbox, or run incident response, this episode is for you. The door is the only part of the house you fully control. Chaotic Commits, Episode 25 chore: revoke the invitation #metaai #aiagents #openai #aisafety #cybersecurity #techpodcast