Meta's Muse

Every few years a technology shift arrives that rewards the company willing to break its own product to meet it. Meta has been right about one of these before, spectacularly, and the memory of being right is now doing a great deal of work inside the company.

On September 8, Meta shipped Muse, a personal AI agent that reads your email, watches your calendar, moves money, and buys things. It is available in the United States on iOS, Android and the web. From day one, inside WhatsApp, with Meta saying its glasses are next. The cost is free for most people, $20 a month for heavy users, and $100 a month for the heaviest.

Meta has sold an AI subscription before, Meta One launched at $7.99 and $19.99 in Singapore, Guatemala and Bolivia in the spring. But this is the first time it has put a price on intelligence in its home market, in a product built for the purpose. That is the decision. The reason it matters has almost nothing to do with the price.

The decision

Strip the launch to what Meta actually committed to and three things stand out.

The pricing is not pricing. The tiers are Free, Power at $20, and Maximum at $100. The free allowance is 100 million tokens a week, which is an enormous amount of agentic work for a normal person. Alexandr Wang, Meta’s chief AI officer, said at launch that “for the vast majority of users, they should be able to do what they need to within the free tier.” Meta’s own framing is that the paid plans exist largely to cover computing costs for the heaviest users.

And here is the part that gives the game away: there is no published feature differentiation between $20 and $100. Nothing in Meta’s newsroom, its subscriptions help page, or any launch coverage identifies anything Maximum does that Power does not, beyond higher limits, and Meta has not published the limits either. You are being asked to choose between two numbers, neither of which has been disclosed.

That is not a product ladder. It is a metering valve with a price tag. Which tells you Meta is not building a subscription business here; it is making the unit economics of a free product survive its power users.

The architecture is unusually serious. Each user gets an isolated cloud VM where credentials live. A permission layer called Sentinel sits at the network boundary as, in Meta’s words, “the sole permission authority for approval to perform actions with connectors to third-party services and for all egress over the network,” classifying every action as allow, deny, or ask. The agent never handles real tokens, only surrogates. Purchases against stored payment credentials are gated: “we prompt for a human in the loop approval with the exact details of the purchase every time.” Approval dialogs render in the client UI rather than in the conversation, a deliberate defense against a hostile web page talking the agent into something.

On the public record, this is the most detailed agent-security architecture any consumer AI company has published. It is also, right now, partly a promise. Meta’s own VP of engineering for consumer products, David Singleton, has acknowledged to Wired that engineer access to data inside the secure VM “would still be technically possible.” The confidential-computing version that would make that impossible has not shipped.

The advertising carve-out is real, and it is the most specific privacy commitment Meta has ever made about a product. The sentence appears twice, near-identically, in the newsroom post and the research blog: “Muse doesn’t share a person’s conversations or the data in their VM with Meta’s ad systems.” That is not hedged corporate language. It names a thing that does not happen, and Meta can be held to it. We take it at face value and think the skeptics have this one wrong.

The interesting question is not whether Meta is lying. It is where the sentence stops, because it was written carefully.

The two nouns are contents, not metadata. Your Gmail’s contents are unambiguously inside the promise. That you are a Muse user, which tier you pay for, and which services you chose to connect are not obviously inside it, and Meta has not said. That is where the cross-app signal argument actually lives. Not in the conversations, which are spoken for, but in the shape of the account around them.

“Ad systems” is narrower than “recommendations.” Meta’s October 2025 language, when it pointed the machine at Meta AI conversations, covered “content and ads recommendations,” two systems. Muse’s carve-out names one.

Training is a separate promise, defaulting the other way. Muse interactions train Meta’s models unless you switch it off, with data sanitized to remove “key” personally identifiable information, a word Meta has never defined publicly. That violates nothing. It is simply a second commitment running opposite the first, on the same data.

And all of it is policy rather than architecture. The confidential-computing build that would make the promise physically enforceable has not shipped, which is why Singleton could only say engineer access “would still be technically possible.” Policies have version numbers, and the precedent for this one changing is nine months old and inside the same family. On December 16, 2025, Meta began using AI interactions elsewhere to target ads, with no general opt-out.

The strategic why

Muse is a bet that the center of gravity in AI is about to move from the desk to the pocket, and from work to life. If that is right, Meta wins by default, because it already lives in the pocket of the 3.5 billion people who open one of its apps every day.

The precedent is 2012, and the company’s memory of it is precise. At the IPO, Facebook’s mobile ad revenue was effectively zero. The S-1 warned there was no meaningful mobile revenue at all. By Q3 2012 mobile was 14% of ad revenue; by Q4, 23%, and mobile daily users passed web daily users for the first time. A year later, 53%. A year after that, 69%. The stock went from $38 to roughly $18 and did not recover its offer price until July 2013. Meta ate 14 months of humiliation, and came out owning the decade.

What made that work was not foresight about screens. It was the willingness to change the product’s fundamental unit from a page with a sidebar to a feed with advertising inside it. Meanwhile competitors waited for the old world to reassert itself. The museum piece from that era is Steve Ballmer’s quote to USA Today: “There’s no chance that the iPhone is going to get any significant market share. No chance.”

So Meta is dusting off the decade old playbook, once again. And there is a genuinely good argument underneath it. Consumer AI usage is already majority non-work. OpenAI’s own research with NBER found non-work messages rising from 53% to more than 70% of ChatGPT usage. The everyday, low-stakes, hands-busy tasks, reorder the thing, book the table, chase the refund, find the form, are exactly the tasks a phone-shaped agent should own, and exactly the tasks people prefer not to open a laptop for.

The second half of the why is more interesting than the pricing, and Meta has not said it out loud. Muse is Meta’s first consumer product with real switching costs. Nothing in Meta’s history locks a user in. The social graph is sticky but portable; leaving Instagram costs you your audience, not your data. A Muse instance with your Gmail, your calendar, your bank connection through Plaid, and a year of accumulated standing permissions is the first thing Meta has ever built that would be genuinely painful to abandon.

And there is a third leg the launch materials barely draw attention to. Muse is a consumer agent that buys, checkout through Link by Stripe today, Shop Pay listed as coming soon. Meta already runs the other side of that transaction. Meta Business Agent went live globally on WhatsApp and Messenger on June 3, and Zuckerberg said on the last earnings call that more than a million businesses use it every week “to talk to their customers or complete sales.” Meta has already said how that side gets paid: getting started is free, and “in the coming months, businesses will access the agent through paid subscription offerings.” Reporting has Zuckerberg exploring a cut of purchases completed through the consumer agent.

Put those together and the shape of the business is clearer than either pricing page suggests. Meta is not trying to build a subscription business. It is assembling both ends of a transaction, an agent that buys, an agent that sells, and positioning itself at the point where the two meet. The consumer side is free because the consumer side is not where this gets paid.

What it defends against

Being a spectator. Twelve months ago Meta’s model strategy was in ruins. No Llama had shipped since April 2025; Behemoth was announced, delayed, never released. By the ATOM Report’s tracking, Qwen passed Llama in cumulative Hugging Face downloads in September 2025 and reached roughly two to one by March 2026, while Meta’s share of new open-weight derivatives collapsed from a 44% peak to 11%. Most damning: Meta had become a large Gemini customer for its own coding and moderation workloads because, on the Financial Times’s reporting, Gemini outperformed Llama, and in June, Google capped Meta’s usage over compute constraints.

That is the position Muse Spark was built out of. Spark launched April 8, 2026, closed-weight, and by version 1.3 on September 2 the configuration it ships in scores 61 on the Artificial Analysis Intelligence Index. Tied for third in the world, and, per Artificial Analysis, no model scoring 59 or above costs less per task. A higher configuration scores 62, but it is in limited preview for Meta’s partners and its pricing has not been published. Five months earlier, version 1.0 scored 52 and ranked fourth. Whatever else is true about Muse, Meta is no longer a bystander at the frontier. It got there in five months by doing the thing it spent five years telling the industry it would never do.

The open-source position it still wants credit for. Zuckerberg’s August 10 essay is careful: “we will resume releasing some open source models soon.” Note the “some.” One real release followed, Muse Glimmer, 29.6 billion parameters under Apache 2.0. The frontier promise did not. Open weights for the flagship Muse Spark model were pledged August 10, restated September 2, and have not appeared.

Disintermediation of the feed. If assistants become how people decide what to buy, the feed’s grip on commercial intent loosens. Meta would rather own the assistant than defend the feed against one.

The risk

Four, in ascending order of how much they should worry Meta.

The $100 tier will not sell, and that’s fine. Nobody is paying $100 a month for undisclosed headroom on a consumer errand-runner; people with $100 AI budgets are running work on desktop tools and will keep doing so. It is the least consequential risk here, because Meta does not need that tier to work. It needs it to exist, so the free tier’s heaviest users have somewhere to go.

The subscription math is the actual story. Start from what Meta could plausibly convert. OpenAI runs 50 million paying subscribers against 900 million weekly users, 5.6% built over three years, globally. Muse is US-only and Meta is actively telling people not to pay. Two million subscribers would be a genuine success, and it would imply something like 36 million American users at OpenAI’s conversion rate, and more than 10x what Meta’s standalone AI app ever reached.

Two million at $20 a month is $480 million a year. Meta’s 2026 capital expenditure guidance is $130 to $145 billion. The subscription would cover about a third of one percent of capex, one sixty-fifth of what Meta spent on capital projects in the second quarter alone, and a tenth of what Reality Labs lost in that same quarter. You would need roughly fifty-seven million paying subscribers to fund a single quarter of capex, which is more than the entire global paying base of every consumer AI product in existence.

So the subscription cannot be the point, and Zuckerberg has said so in as many words on the Q2 call: Meta will “evolve more of these products to be like our ad systems where businesses only pay us when we achieve results for them.” The subscription is a bridge. The toll booth is commerce.

Agentic commerce is not ready, and not just for Meta. The rail is real. Link by Stripe checkout, single-use card numbers, Shop Pay and 1Password coming. The demand is not.

Accenture asked 25,000 people across 16 countries and got the one number that tells the whole story. 74% say they would trust an AI agent over their best friend to buy on their behalf. 9% would actually let one do it. People love the idea. They will not hand over the card.

Then the behavior caught up with the survey. OpenAI scaled back in-chat Instant Checkout this March, barely six months after shipping it. eMarketer read it plainly: adoption of agentic commerce is “weaker than AI and payment companies anticipated.”

That is the finding, and it is bigger than Muse. Agentic commerce is being sold as a 2026 business. On the evidence, it is a 2028 one. Meta is laying rail ahead of the traffic, which is the right call if you can afford to wait and an expensive one if you cannot.

The addressable user is also narrower than “busy people at home.” It is not a category of shopper but a category of purchase: bounded, reversible, already decided. Replenishment, not discovery. Under a few hundred dollars. Undoable. The agent is not choosing, it is executing a choice already made. Which means the instinct that this is for groceries and reorders rather than vacations is right about stakes and wrong about channels. People already book travel and buy groceries on a screen. What they will not yet do is hand the screen the authority to decide.

The retention pattern is Meta’s own. The launch numbers are respectable, not extraordinary: roughly 83,000 US iOS downloads in two days and the #2 App Store spot, against about half a million for ChatGPT in its first US week. Threads did 4.3 million on day one, then lost about 82% of its daily users within four weeks, time spent collapsing from 19 minutes a day to under three. Meta’s own standalone AI app was still at roughly 775,000 daily users five months after launch. What moved it to 2.7 million, in four weeks, was not the assistant but a short-form video feed bolted onto it.

The pattern is consistent enough to predict: spike, plateau, then distribution. Threads reached 500 million monthly users, and Bloomberg’s description of how is unambiguous. “Users scrolling Instagram often see Threads posts in their feeds, and clicking those posts redirects them into the Threads app.” Threads’ head, Connor Hayes, offered the 500-million milestone as evidence that users increasingly come to Threads directly, which is a concession dressed as a milestone.

The difference this time is that Meta skipped the waiting. Muse did not launch as a standalone app that Meta would later prop up with cross-app placement, it launched inside WhatsApp on day one, alongside the app and the web, with “coming soon to AI glasses” written into the announcement. Meta learned the Threads lesson and applied it at t-zero.

So the prediction is not whether Meta leans on the family, but how fast the rest arrives. WhatsApp and the glasses are the two Meta has committed to. Facebook, Messenger, Instagram and Threads appear nowhere in the launch materials and are, on Meta’s own track record, exactly where this goes next. Each does a different job. Messenger and WhatsApp are where an errand gets asked for. Instagram and Facebook are where commercial intent is manufactured, and where an agent that can buy is worth the most. Threads is the smallest prize and the easiest install. The glasses are the one that changes the product rather than the distribution, because hands-busy is where a personal agent stops being a novelty. When the curve flattens, and on Meta’s history it will, expect placements across all of them, described as organic.

The glasses are the underrated lever, and “coming soon to AI glasses” was in the launch post. By Counterpoint’s count Meta holds roughly 82% of a smart glasses market that grew 139% in the second half of 2025, and EssilorLuxottica sold 7 million units in 2025 alone. Hands-busy is where a personal agent earns its keep. One caution: the only hard retention data for Meta eyewear is the prior generation, Ray-Ban Stories, where internal documents showed fewer than 10% of buyers still using them and 13% returning the device.

The connection problem. This is the binding constraint, and it has nothing to do with whether people like Meta enough to keep scrolling.

Every product Meta has ever shipped asked for attention. Attention is costless to give while holding a low opinion of the company, which is precisely why 3.5 billion people give it daily. Muse asks for something Meta has never asked for: authority. An explicit, conscious decision to hand over the inbox, the calendar, and a payment rail. Made once, deliberately, at a permissions screen, by a person who has to decide in that moment whether they trust this particular company with the contents of their email.

That is a different act, and Meta arrives at it carrying the worst consumer trust position of any company at this scale. It ranked 97th of 100 American brands on the Axios-Harris reputation index in 2022, and social media companies were still drawing unfavorable ratings there this year while Apple, Amazon, Alphabet and Microsoft scored “very good.” A co/efficient survey of 1,566 registered voters fielded in early May put Zuckerberg’s net favorability at -66, worst of any tech executive tested, against Nadella’s -3.

Then the timing. Thirteen days before Muse launched, Meta agreed to pay up to $17.1 billion to 47 states, DC and three territories over features the attorneys general said were designed to harm young users. About $12.1 billion guaranteed over ten years, the rest contingent on Snapchat, TikTok and YouTube matching, and no admission of liability. Texas settled separately for over $1 billion. New Mexico is the one Meta lost: a jury found 75,000 violations of the state’s consumer-protection statute in March, and in August the court found the platforms a public nuisance and ordered $567 million in abatement on top of $375 million in penalties. Meta is appealing. This is the news environment in which Meta is asking people to connect Gmail.

The obvious objection is that Meta’s reputation has never cost it anything, and that objection is correct, and beside the point. In the year Cambridge Analytica broke, revenue grew 37% and daily users grew 9%. Last quarter, reported during the run-up to the child-safety trial, was $60.8 billion and up 28%, with ad prices and impressions both rising. The stock went up on settlement day. None of that is evidence about Muse, because none of those products ever required a permission grant. Feed engagement is revealed preference under zero friction. A connector screen is a stated preference under real friction, and the two have never been tested against each other at Meta.

Nobody has published a connector-adoption rate for any AI assistant, not ChatGPT, not Gemini, not Copilot, so this is unfalsifiable today in either direction, and anyone who quotes you a number is inventing it. But the mechanism is clear and the utility curve is brutal. An agent without the inbox and the calendar is a chatbot with a shopping cart. Meta does not need people to like it. It needs a meaningful fraction of them to click Allow, once, on the most sensitive data they own. That is the first time in twenty years the trust deficit has had a place to actually show up in a funnel.

Two smaller things. Reuters reported that internal testing found Muse bypassing guardrails and exposing private iCloud photos, with Meta’s own CTO hitting repeated login failures and Meta’s VP of AI products, Vishal Shah, conceding it “is impossible to say that there is never going to be a mistake.” And the human-confirmation commitment we admire has its relaxation mechanism already built in. Sentinel only asks when no authorized policy covers the action. Standing permissions are the intended path, and the number of prompts a user sees is a product decision Meta can tune down quarter by quarter without announcing anything. The principle is real today. It is not load-bearing.