Meta's Muse Can Spend Your Money. Its Real Bet Is That Trust Is an Engineering Problem.

Meta's new flagship AI product can spend your money. Give Muse your email, your calendar, and a payment method, and it will book your travel, fill out your forms, negotiate your bills, even price your used car for sale on your behalf. It is the "agent that does things" the whole industry has been promising for years, and Meta shipped it to American adults on a regular app and inside WhatsApp this month.

The part worth stopping on is not what Muse can do. It's what Meta built so you would let it. That is the unusual thing here, and it tells you more about where Meta's future earnings are headed than the feature list does.

Meta's answer to "why would I hand an advertising company my passwords" was not a promise. It was architecture. Each user's agent runs on its own locked-down virtual machine in the cloud, isolated from other users. A separate supervisor agent called Sentinel is the only thing allowed to let a real action reach the outside world, and the main agent cannot override it. The agent literally never sees your passwords or card numbers; real credentials are stored in the VM and swapped in at the network boundary only after approval, with single-use card numbers for merchants. Even the approval prompts are routed around the model, so a poisoned page can't fake a "yes." Later this year Meta plans a "Confidential VM," built with the founder of Signal, where the keys sit only with you and not even Meta's engineers can read what the agent does.

Read that list once more and notice who is being locked out. The careful design is not mainly to protect you from outsiders. It exists because Meta knows you need protection from Meta — or at least needs to believe you do. A company that spent twenty years reading your activity to sell ads is now selling you a thing whose whole value depends on you handing it your most sensitive life. Its only way in was to design the product so that not even it holds the keys. That is the same move a privacy startup would make, and it's striking to see it from the company that once warned a million users their passwords had been harvested by lookalike apps.

This reframes the obvious reading. Everyone wants to call Muse "Meta diversifies beyond ads." That's real but it's the smaller part of the story. The bigger question is whether a machine built on trust can be sold by the company least trusted to hold it — and whether Meta's only possible answer, expensive isolation, can survive the economics it creates.

Here's why the economics matter to you as an investor. Advertising is still nearly all of Meta's revenue — about 97% of sales. The company is burning roughly $92 billion a year on capital spending, mostly on AI, and its free cash flow actually shrank 23% over the past year even as revenue grew 28%. In other words, the AI buildout is consuming the cash Machine. The entire near-term bull case rests on the belief that this spending eventually pays for itself. Muse is the first thing Meta can point to with an actual price tag on it: a free tier, then $20 and $100 a month tiers for heavier use, plus a planned cut of the purchases the agent makes. That price tag is why the stock jumped around 6% in a day on the launch — not because an email-reading assistant is a hit, but because it is the first concrete answer to the standing question of what all the capex is for.

The uncomfortable part is that the math of a dedicated agent may not work at that price. Every user runs on their own cloud computer and spends real compute on nearly every action it takes. Rivals who went down this road bill agents by tokens and runtime, and the sector is wrestling with subscriptions that cost more to serve than they collect. At $20 a month, a per-user virtual machine plus continuous background work looks hard to cover unless the agent also pulls transactions Meta can take a cut of, or drives behavior Meta monetizes elsewhere. Meta can afford to price under cost longer than almost anyone because ads still pay the bills. But a subscription that loses money, propped up to win a category, has exactly the shape the persona would flag: a subsidy dressed as demand.

Two things will tell you whether this is a real category or a very expensive sideshow. First, whether people actually pay — not try the free tier, but hand over money and let the agent keep acting on its own. Second, whether trust survives the first big failure. This product only compounds in value the more access you grant it, which is the same as saying the damage surface grows with its usefulness. One leaked password, one wrong payment, and the category's promises are broken in a way no architecture can fully apologize for. Meta has bet its AI-era future on engineering an answer to a question its own history made harder for it than for rivals who never hoarded the data. If payment and trust both hold at scale, the "AI will pay for itself" story gets its first real numbers. If people use it but won't pay, or one trust failure chokes it, that story stays exactly where it is today: a $92-billion-a-year hope.