How is Muse's subscription model fundamentally different from typical AI product subscriptions?
Most AI products tier subscriptions around feature unlocking — pay for access to a better model, longer context, or more integrations. Muse's three-tier pricing ($0/$20/$100 mapping to 100M/500M/3B tokens per week) is almost entirely usage-based billing. Meta AI executive Alexandr Wang publicly stated the free tier should suffice for most users, and paid tiers exist to "help us cover compute costs," not to unlock gated capabilities.
This means Meta isn't counting on subscription revenue as the primary profit driver — subscriptions are closer to offsetting heavy users' compute costs, while the real profit model sits in transaction fees. That's also why Reuters described this pricing ladder as looking "more like usage-based billing than a typical feature-tiered software model."
Why would Meta invest such significant engineering effort in building Sentinel instead of just training the model to be more careful?
Training a model to be "more careful" can never offer a 100% guarantee — the entire premise of prompt injection attacks is finding ways to manipulate the model's reasoning into taking actions it shouldn't. Relying on the model's own judgment means betting the entire security boundary on a system that is, by nature, deceivable.
Meta's approach moves the gatekeeping function outside the model's judgment entirely, into an independent operating-system-level process (Sentinel). Even if Muse's reasoning is compromised, it still can't bypass Sentinel's review of connector operations and network egress. This isn't just security hygiene — it's a precondition for whether the entire business model can function. Without a guarantee independent of the model itself, merchants wouldn't trust an agent to handle transactions directly, and Meta's plan to profit from transaction fees would have no foundation.
How exactly does the "proxy token" mechanism prevent credential leakage?
Most people might assume an AI agent logging into a website or app must "see" the actual username, password, or API key to operate. Muse's design does the opposite: real credentials are stored and proxied by a dedicated hatch-authd service, and what Muse itself receives is only a "proxy token" — something that lets it complete the task without being the actual credential.
Meta's framing is that "the agent never sees the real token, which means any attempt to coerce it into leaking actual secrets via prompt injection is futile." In other words, even if an attacker successfully tricks Muse via prompt injection into "revealing" what credentials it holds, there's no real password to reveal — at most, a scope-limited, revocable proxy token.
If I start using Muse for shopping or handling tasks, what do I actually control?
Based on Meta's published design, the core lever you control is "connector policy" — configuring, for each service (email, shopping sites, calendar), what Muse can and can't do, and which actions require your explicit approval. Sentinel decides to allow, deny, or ask you based on these policies, which means the more precisely you scope them (granting access to a specific task rather than blanket read/write to your entire inbox), the smaller the blast radius when something goes wrong.
Also worth noting: Meta's current Secure VM defaults to using your query data (this can be manually disabled), and the Confidential VM — designed so that even Meta can't see inside — won't arrive until later this year. If this layer of privacy matters to you, you need to proactively check and adjust that default now, rather than assuming it starts off disabled.
On September 8, 2026, Meta officially launched Muse, its personal AI agent, and shortly after at the Meta Connect conference, CEO Mark Zuckerberg made a strikingly blunt statement: "We believe that Muse will make you money... we will profit by taking a small fee from transactions." That line is worth pausing on, because it separates Muse's business model from the subscription-first logic most AI products have followed. Meta isn't locking capability behind a paywall — it's essentially giving compute away for free, betting instead on whether this agent can complete enough real transactions.
Muse's pricing splits into three tiers: a free plan offering 100 million tokens per week, a Power plan at $20/month for 500 million tokens per week, and a Maximum plan at $100/month for 3 billion tokens per week. Alexandr Wang, the Meta AI executive overseeing the product, said the free tier should be sufficient for most users, and that paid plans exist mainly to "help us cover compute costs" rather than to unlock gated features. This differs from traditional SaaS subscription logic — as Reuters noted, the steep jump in pricing tiers ($0 to $20 to $100, with allowances of 100M, 500M, and 3B tokens respectively) looks more like usage-based billing than a typical feature-tiered software model. In other words, Meta isn't trying to make money from subscriptions; subscription fees are closer to a way of offsetting the compute costs of heavy users.
The real profit expectation sits elsewhere. Muse has already integrated with Stripe, Shopify, Shop Pay, and PayPal, alongside retail and service brands including Best Buy, Gap, Sephora, Walmart, Wayfair, Expedia, and Instacart — letting the agent handle everything from browsing and price comparison to checkout on a user's behalf. Zuckerberg was explicit that this fee is charged to merchants, not passed on to consumers as a markup — which means Muse's profitability depends entirely on how many merchants are willing to let an AI agent complete transactions in place of a human, not on subscriber counts.
This is precisely the problem: if you're a retailer, an AI agent that can autonomously browse your site, fill out forms, and complete checkout sounds like both an opportunity and a liability — someone still has to absorb the cost when the machine gets it wrong. Meta's answer isn't to train Muse to be "more careful" at the model level. Instead, it built an operating-system-level enforcement layer that sits independent of the model's own judgment, called Sentinel.
According to Meta AI Research's published technical documentation, Sentinel is a host-side process running outside Muse's execution environment, acting as the sole authority for all connector operations and network egress. When Muse wants to take an action through a connector — say, placing an order via Shopify — it must first submit a request to Sentinel describing the connector type, the method being called, the operation category, and the user's intent. Sentinel then decides to allow, deny, or ask the user, based on policies the user configured in advance. This decision isn't made by the model itself — even if Muse's reasoning process is compromised by a prompt injection attack, it cannot bypass this independent gate.
The more critical design choice sits at the credential layer: Muse never directly touches your real passwords or API keys while executing tasks. The system uses a "proxy token" mechanism, with a dedicated hatch-authd service handling credential storage and proxying. Meta's own framing is that "the agent never sees the real token, which means any attempt to coerce it into leaking actual secrets via prompt injection is futile." Even Sentinel's evaluation of whether a network egress is safe doesn't rely solely on surface-level information like domain names — it tracks data flow at the kernel level, a mechanism industry analysts describe as "taint tracking": once an execution flow reads user data, it gets marked as "tainted," automatically losing its default auto-allow privilege and requiring stricter verification.
Put these two pieces together and a dependency emerges: Meta's business model relies on a precondition — without Sentinel's architecture ensuring that credentials can't leak even when the model itself misbehaves, merchants like Best Buy or Sephora simply wouldn't open their APIs to let an autonomous agent complete transactions directly. A single incident of a hijacked agent making fraudulent charges, or a botched operation causing merchant losses, would undercut the entire transaction-fee business model at its foundation. This also explains why Meta invested heavily in splitting Muse's execution environment into two isolated security domains — an "execution environment" and "security services" — using systemd-nspawn containers to restrict the workspace's system call capabilities, and even offering a bug bounty in the $300,000 range. These aren't merely compliance gestures; they're preconditions for whether the entire "let an agent spend your money, Meta takes a cut" business model can hold up at all.
Meta also acknowledges the trust architecture is still evolving: the current Secure VM defaults to allowing Meta to use query data (though this can be disabled), and the company plans to launch a Confidential VM by year-end, aiming to use cryptographic guarantees so that even Meta itself cannot access data inside a user's VM, with external auditors able to inspect the source code and conduct ongoing audits. This gap means today's trust rests, to some degree, on believing that Meta's stated architecture actually operates as described — rather than on independently verifiable cryptographic proof. For an agent that's meant to swipe your card on your behalf, that gap carries real weight.
If you're planning to let an agent like Muse handle shopping, booking, or even negotiation on your behalf, the question that actually matters isn't "how smart is it" — it's "where is the stop-loss mechanism when it makes a mistake." Sentinel's three-layer gating (connector request review, credential proxy isolation, network egress taint tracking) reflects Meta placing that stop-loss at the system architecture level, rather than betting on the model getting it right every time — a relatively mature design direction by today's standards. But it also means the scope of permission you grant with each "approval" directly determines your maximum exposure when things go wrong. Before use, it's worth checking whether the connector policy grants overly broad access (like full read/write to your entire inbox instead of scoped access to a specific task) — that matters more than whether the subscription tier is a good deal.