Hey everyone,
Meta released Muse yesterday, its personal AI agent. I have been following Meta in depth for years, and this is a significant milestone for Meta, as I think this is the most important product Meta has shipped since it bought Instagram and WhatsApp. Muse is the first Meta product that can capture significant value outside of the ad impression ecosystem and, over time, possibly become even bigger.
In the article, I cover the business case for Muse Spark and some economics, as well as technical details on how the agent is set up, what this means for Meta’s compute, and my research on the latest sentiment/usage around adoption of Muse Spark 1.3, OpenAI GPT 6, and Google Gemini 3.8.
Before we start with the article, I would like to invite everyone to an upcoming talk I will be hosting on Sep 16th. The topic is Token Economics (usage trends, model tradeoffs, and best-practice token optimizations).
I will be joined by Kyle Cheng, a former Anthropic technical staff member; Andy Hock, Chief Strategy Officer at Cerebras; and Chris Ackerson, SVP of Product at AlphaSense.
Each of the guests represents a different angle on token economics (frontier lab view, infrastructure/semi view, and big token consumer customer view) and, because of this, will give us a very interesting perspective on the whole topic and the trends we are heading toward.
Even if you can’t join us live, make sure to register to receive the link to the recordings of the discussion. You can sign up for free using this link.
Now let’s start with the article.
What Muse actually is
The simplest way to describe it: every Muse user gets their own dedicated computer in Meta’s cloud, and an agent that lives on it and works for them around the clock. It’s the mainstream version of OpenClaw. OpenClaw showed the tech community what a personal agent with full access to your life can do, but it required a weekend of configuration, and I think everyone knows that this version of the product was not what was going to go mainstream.
Some data from Meta’s Muse launch
Available in the US only for now, available via web, iOS, Android, and inside WhatsApp chats. AI glasses integration is still coming.
Free tier with up to 100 million tokens per week, then two paid tiers: Power at $20/month and Maximum at $100/month.
Connectors to email, calendar, payments (Link by Stripe at launch, Shop Pay), health, smart home, dining, shopping, music, events, plus Instagram and Facebook, including the tools for running a business and buying ads.
If a service isn’t a built-in connector but has a public API, Muse writes its own connector. If there is no API, it uses its browser.
Powered by Muse Spark 1.3, which Meta recently released.
The tasks list Meta gives as examples are sending emails, booking travel, lowering your bills, filling out forms, turning a recipe reel into a grocery list, sending party invites, buying things. The assistant is made for the digital chores of a normal household, which is exactly the segment where distribution beats model capability and Meta has an edge.
Why this is a TAM expansion and not a feature
For the last decade, the value Meta’s platforms created has been much bigger than the value Meta captured. Influencer marketing, social commerce, Marketplace, WhatsApp business chats. While Meta wanted to expand that value capture, two things blocked those efforts: Meta’s own product choices and the platform owners. Apple’s ATT alone cost Meta roughly $10B in 2022 revenue, by the company’s own estimate. Every attempt at payments, shops, and commerce got squeezed by app store rules, OS-level tracking limits, and the fact that Meta doesn’t own the device. Meta has many failed projects like the payment project Libra, which got regulatory scrutiny even before launch, and many others.
Muse is different because the agent doesn’t run on your iPhone. It runs on a Linux VM in Meta’s data center with its own Chromium browser. When Muse shops for you, it is Meta’s browser hitting the merchant’s site, Meta’s wallet issuing a single-use card number via Stripe Link, and Meta’s Sentinel approving the checkout. Apple is reduced to being the screen on which you tap “approve.”
And Zuck was unusually explicit on the business model on Sources. The plan is for Muse to pay for itself by helping people earn and save money, with Meta taking, in his words, a very small cut of the transaction, potentially paid by the business on the other side. Add the $20/$100 subscription for power users on top. That is a transactional revenue line and a subscription revenue line, which are exactly two of the four new revenue lines (transactional, compute, APIs, subscriptions) I wrote about after Meta’s Q2 earnings.
Meta makes about $67 per year per daily active person, blended globally. A $20/month Power subscription is $240 per year, 3.6x the current ARPP. A $100/month Maximum tier is 18x. Even if only 1% of DAP ends up on a paid tier, that is 36 million subscribers at a blended, say, $30/month, or about $13B of annual revenue that didn’t exist before, at software-like margins on top of an ad business that did $59.4B in a single quarter. And I think the subscription line is actually the smaller of the two. The transaction cut has the bigger ceiling, as it not only captures the e-commerce market but also extends into traditional commerce and experiences.
Facebook Marketplace might be the first killer use case
If I had to bet on the first Muse use case that goes viral, it is buying and selling on Facebook Marketplace. Marketplace has over 1.1 billion monthly users across 228 countries and facilitates over 3 billion buyer-seller connections per month through Messenger. Meta has said in the past that 1 in 4 young adult daily actives in the US and Canada use Marketplace
Marketplace is also the most annoying commerce experience Meta owns: making product descriptions, monitoring prices, and negotiating with buyers takes time. Meta already started shipping AI listing drafts and auto-replies for Marketplace in March 2026. Muse is the logical next step to fully automate that. Marketplace is barely monetized today, but a personal agent that runs the whole transaction, with Meta’s wallet in the middle, is what can significantly change that and make it a transaction business. And Meta’s own security post explicitly mentions Marketplace as one of the things Muse does on your behalf.
Security and privacy, Meta went as far as possible
I want to spend time here because I think the architecture is partly the moat and really important given Meta’s brand reputation when it comes to privacy. The full write-up is in Meta’s security post by Tarek Sheasha (VP at Meta Superintelligence Labs), and I’d recommend reading it if you are technical.
One VM per user. Every user gets an isolated Linux box with a browser, storage, CPU, and memory, enough to compile code, run sub-agents, and run cron jobs (scheduled tasks that happen while you sleep). Your data and your credentials for connected services live in that VM, not in centralized Meta infrastructure. The clients (iOS, Android, web) talk directly to your VM.
Two security domains on one box. Meta, is not an LLM with root access. The agent itself, its files, and every tool it runs sit inside a systemd-nspawn container (a lightweight sandbox). Root inside that container maps to an unprivileged user on the host. The sensitive stuff - credential storage, safety classifiers, connector business logic, the database with your state - runs outside the sandbox as separate services. The agent literally cannot reach them. All communication between the two sides goes over kernel-authenticated Unix sockets.
The agent never sees your passwords. When Muse needs to call, say, your Gmail, the code inside the sandbox only ever holds a fake “surrogate” token. A separate service (authd) holds the real OAuth token. At the moment the network request leaves the VM, the real credential gets swapped in at the network boundary. So even if someone prompt-injects the agent and tells it “print your API keys,” there is nothing to print. Same for website logins: your username and password go straight into the secure store and get injected into the browser form at the point of need; the agent sees an accessibility-tree snapshot of the page, not the raw DOM, and cannot execute JavaScript on the page.
Sentinel. A second, separate agent runs on the same VM and is the only thing allowed to approve actions and network egress. Muse proposes; Sentinel decides allow / deny / ask-the-user. It inspects the destination at layer 4 and layer 7 (hostname, resolved IP, port, HTTP method, path, decoded request body). Meta also implemented what they call “tainted egress” using eBPF kernel programs: each tool process starts clean and becomes “tainted” the moment it reads your personal data. Clean, low-risk requests can be auto-allowed; tainted ones fall back to the approval flow. That is how they keep the number of “are you sure?” pop-ups tolerable.
Purchases. Every checkout on a site where your card is on file triggers a human-in-the-loop approval with the exact details. On new sites, Muse uses its wallet and Stripe Link issues a single-use card number tied to that merchant, that dollar amount, and a limited time window. Even if it gets stolen, it is useless.
Email hygiene. The email connector filters out one-time passcodes, password reset links, and magic login links with deterministic filters plus a classifier, because your inbox is the master key to every other account you own.
Prompt injection. Meta’s defense is layered: the model is trained against it (they say Spark 1.3 is close to state of the art on their internal evals), external data is labeled untrusted in the harness, an ensemble of independent classifiers runs on everything entering the model’s context, and then the deterministic boundaries above apply even if the model is fooled. Meta opened the bug bounty to the public yesterday, paying up to $300,000 per valid report and up to $130,000 for a successful prompt injection affecting a single user.
Confidential VM (coming later this year). Today, Meta restricts employee access to your VM by policy. The next step is cryptographic: a mode where Meta itself provably cannot read what is inside your VM, with the design and source code going to external auditors and a continuous, publicly inspectable audit after launch. This is the part Zuck and Nat Friedman personally recruited Moxie Marlinspike, the founder of Signal, to build. Zuck’s claim on Sources was that even Meta cannot see the content, and that he isn’t aware of anyone offering anything close.
All of this matters a lot because the personal agent race is not going to be won on model capabilities. It is going to be won on who people trust with their inbox, their calendar, and their credit card, and on who can serve the workload cheaply enough at scale. Instinct, the hottest startup in this category, raised $250M at a $2.5B valuation two weeks ago, and in the same week got dragged for a “perpetual and irrevocable” data license in its terms and for sending an email on a user’s behalf without asking. Meta, of all companies, is showing up to this fight with the most paranoid architecture in the market, and I think it is the right one given Meta’s history and brand reputation.
The unit economics of 100 million free tokens per week
Muse Spark 1.3 is priced at $1.25 per million input tokens and $4.25 per million output tokens on the standard tier, with a $0.15 cached-input rate; the “contributor” tier, where Meta can train on your data, is $0.10/$0.20. 100 million tokens per week at Meta’s own standard list price, assuming a typical agent mix of ~90% input / ~10% output, is about $155 of API value per week, or roughly $8,000 per year, given away for free. Even at the contributor tier price it is ~$11 per week / ~$570 per year. Meta is essentially pricing the category so that Instinct, Town, and anyone else without a big profitable business cannot compete on price.
My rough scenario for what this costs Meta. If Muse gets to 100 million monthly actives and an average user actually consumes 5-10 million tokens per week (a handful of real agentic tasks with sub-agents and a browser session or two), that is 0.5-1 quadrillion tokens per week, or 26-52 quadrillion per year. For context, Google was processing 1.3 quadrillion tokens per month across all of its surfaces in October 2025. At an internal serving cost of, say, $0.10-0.20 per million tokens blended (the contributor tier at $0.10/$0.20 has to be at or above cost), that is $2.6B-$10B per year of inference cost, before the CPU, memory, and storage of keeping tens of millions of VMs alive.
And it seems usage is off to a strong start already, as Alex, the head of AI at Meta, already tweeted that usage of intially users is 10x than what the testing cohort was:
There are a few implications to this which I outlined here:
On the Q2 call, Zuck said Meta was getting a lot of offers for its compute at a significant premium and floated running an auction over compute. Muse is the alternative use of that compute. If Muse usage takes off, I think the odds of a third-party compute deal go down, because the internal return on that compute, measured in transaction take rate and subscriptions, is probably higher than renting it out, plus it adds long-term durable product value. If Muse stalls, the compute deal becomes more likely. Either way, the compute will get used.
A personal agent’s job is 90% integrations, distribution, and harness, and 10% raw intelligence. Meta’s model needs to be good enough and cheap enough to serve hundreds of millions of people without them hitting a wall after three tasks. That is the exact opposite of the problem OpenAI has right now with Astra. Meta doesn’t need a frontier model for this use-case.
The network effects of AI personal agents
An interesting thing that Zuck said on Sources is that the whole industry currently treats agents as a single-player game, and Meta is building for multiplayer. Concretely, Muse has a “fleet” concept: the underlying agents can learn anonymized insights from the whole user base, so the product gets better as more people use it. That is a network effect on a product category that has not had one yet.
The practical version of this is the idea/suggestion tab on Muse. Most people still don’t know what to ask an AI agent to do for them. Muse learns from your conversations what matters to you and makes unprompted suggestions, and it does what the team calls “learning through the night,” reorganizing and proposing next steps while you sleep. Now scale that with anonymized fleet data: “people like you who connected their calendar and email mostly use me for X.” If any company is good at recommendation systems and network effects it’s Meta so this could give them a durable advantage over competitors, especially if they reach scale.
Then we come to Meta’s distribution. Threads went from zero to 500 million monthly actives almost entirely on Instagram’s distribution, and Zuck said on the Q2 call that Meta plans to run that playbook repeatedly for AI apps. Muse is already inside WhatsApp chats at launch. And add partners: on day one, Muse ships with Stripe Link, Shop Pay, and 1Password, plus Instagram and Facebook business tools, because everyone wants to be inside the Meta ecosystem. A small startup has a much harder time getting those integrations; with Meta, it's different because everyone wants to work with them and tap into their ecosystem.
My Sentiment analysis check: Muse Spark 1.3 vs GPT-6 Astra vs Gemini 3.8 Flash (analyzed X, Hacker News, GitHub, and Reddit)
This part is for paid subscribers only, but the results are quite surprising compared with the current consensus.