Mark Zuckerberg just told you what Meta’s actual product is now. Not feeds. Not glasses. An agent that takes your goals and runs with them around the clock, without you touching a keyboard again.
He spent just over an hour explaining why Muse exists, what it costs, and why most of the industry is building the wrong kind of AI product. Along the way he conceded Meta got LLM scaling wrong the first time, confirmed the next model is shipping, and walked through the architecture that keeps Meta locked out of your agent’s memory.
I watched the full interview so you don’t have to. Here are the ten that matter.
together with Outskill:
Zuckerberg wants an agent running your week. Most people still can’t get one to finish a single task.
Outskill closes that gap in a weekend: 16 hours of live training on the stack that matters now, Astra included.
▫️ Saturday and Sunday, 10 AM to 7 PM EST
▫️ Live attendees get a Prompt Bible, a monetization roadmap, and a toolkit builder
Free for the next 48 hours.
1. Muse Doesn’t Take Prompts. It Takes Goals.
Every AI product you’ve used runs on the same loop: you ask, it answers, the thread ends. Muse breaks that loop.
“Instead of the model where you send one prompt and it gives you an answer, what you do with Muse is give it goals. It works 24/7 and it doesn’t stop until it’s helped achieve them.”
That’s the actual product distinction, and it has nothing to do with marketing copy. Meta AI, ChatGPT, Gemini: all 3 are still built around a single question and a single answer, no matter how good the answer gets.
Muse gets a standing objective instead. It runs a virtual machine in the background, logs into accounts on its own, and keeps working across days without a new prompt from you.
Grokbot, Town, Instinct: Zuckerberg names 3 competitors chasing versions of the same shift, which tells you this is bigger than one company’s roadmap. Prompting is giving way to goal-setting across the whole industry, not just at Meta.
“The real unlock is a virtual machine behind the scenes where the agent can control a computer for you.”
2. Meta Can’t See Inside Your Muse Agent, and That’s the Whole Pitch (By Design)
A personal agent that knows everything about you only works if you trust it with everything. Zuckerberg’s answer to that problem has a name: Moxie Marlinspike.
“Nat and I personally recruited Moxie Marlinspike to work on this confidential VM project. We can make the commitment that even Meta cannot see the content that is in there, and you can do this technically.”
Marlinspike founded Signal, and back in 2014 he helped Meta build WhatsApp’s end-to-end encryption. He came back specifically to run Muse’s confidential virtual machine project.
The claim isn’t a privacy policy. It’s an architecture claim: your agent’s memory runs in a system Meta itself can’t inspect, and Zuckerberg says he can prove that technically, not just promise it in a blog post.
He’s reusing the WhatsApp playbook on purpose. Build the trust into the system first, then let the product carry the sensitive stuff, whether that’s email, health information, or whatever else you decide to connect.
“Meta spent more than 10 years building WhatsApp into a global end-to-end encrypted system designed so even Meta can’t see the messages people send.”
3. Muse’s Sentinel Agents Check Every Risky Move Before It Happens (Even When You Don’t See It)
Handing an agent your credentials is the scary part of this whole category. Meta built a separate layer specifically to catch it doing something you wouldn’t approve of.
“We built all these Sentinel agents that monitor the incoming and outgoing traffic and data your agent is sending, for the purpose of flagging to you when you might want to review something. If you’re going to log into something, do a payment, or transfer sensitive information, you need to approve it.”
Muse never sees your raw credentials. Meta built a secure credential store that issues one-time card numbers instead, so the agent only gets access when it’s logging into something you actually asked for.
Sentinel agents sit on top of that layer, watching for prompt injection and for anything leaving your agent that shouldn’t go out. Connectors start read-only, too: email access doesn’t include send permission until you grant it specifically, which Zuckerberg frames as least privilege built into the architecture rather than a setting buried in a menu.
If you’re building your own agent guardrails, these actually go into the mechanics:
▫️ Stop Blaming the Model. Fix the Architecture
▫️ Your AI App Has a Hole in It Right Now
4. Muse Is Free Because Zuckerberg Thinks It’ll Make You Money (Here’s the Math Behind It)
Every other AI product wants a subscription. Meta is betting it doesn’t need one.
“We’re confident in standing behind the fact that this is going to make so much money for people that the business model over time is to take a very small cut of whatever the transaction is.”
Meta is giving away 100 million tokens a week for free, plus the virtual machine that runs behind it. A subscription option exists, but it isn’t the bet Zuckerberg is actually making with the free tier.
His logic: if Muse runs your small business, handles your logistics, or manages a transaction end to end, it generates enough value that a small cut beats a monthly fee. That cut doesn’t even have to come from you, either. Zuckerberg says it can come from the businesses Muse transacts with on your behalf, with Stripe handling payments underneath.
This bet only works at Meta’s scale. Free compute for hundreds of millions of people needs margin most companies don’t have. Zuckerberg doesn’t name the specific revenue line covering the free tier in this conversation, but he does describe Meta elsewhere in the interview as an extremely profitable business, and points to that as what lets it outspend labs running on thinner margins.
If you’re rethinking how to price an agent product instead of a subscription, these break down the shift:
▫️ Most AI Startups Are Pricing Themselves to Death
▫️ The $100B Question: How SaaS Giants Are Rewriting the Rules of Value with AI
5. Muse Agents Learn From Each Other Across the Fleet (A Network Effect Nobody Else Is Building)
Most agent products still work like a single-player game. Zuckerberg is building for the version where agents learn from each other.
“Most of the industry is thinking about agents as a single-player game, where you have your agent and you use it. As more people start using Muse, it just gets better forever.”
Meta hasn’t rolled this out broadly yet, but Zuckerberg flags it as the long-term differentiator over raw model capability, at a moment when the model itself is turning into a commodity. If your MMA coaching pipeline improves because someone else’s agent already solved a similar tracking problem, that’s compounding value no single model release can match on its own.
It’s also a familiar move from the person who built Facebook and Instagram on network effects. Scale begets scale, and he’s aiming to recreate that dynamic here, this time across a fleet of personal agents instead of a feed.
6. Zuckerberg Admits Meta Got LLM Scaling Wrong (And Fixed It With Fewer, Better People)
Meta had already built state-of-the-art machine learning for feeds, ads, and content moderation. Zuckerberg assumed that experience would carry over to large language models. It didn’t.
“I made this mistake of assuming that because we were good at other types of machine learning, building and scaling LLMs would work kind of the same way.”
Llama 3 landed well. Llama 4 missed the trajectory Zuckerberg wanted, and that miss triggered a reset that had nothing to do with adding headcount.
Instead, he shrank the team around its strongest researchers and built the lab physically around where he sits in the office. He spent a large chunk of his own time recruiting for what he now calls talent density: a group small enough that everyone can hold the whole system in their head, where each seat going to the best available person actually moves the outcome.
The result so far is MuseSpark, built on a smaller pretrain code-named Avocado, with Watermelon, a bigger pretrain, coming next. During the interview, the host referenced a recent Artificial Analysis chart he believed placed MuseSpark just behind Claude Fable 5.1 and Opus 5, though he flagged some uncertainty about the exact names himself. That’s the host’s read on the trajectory, not a claim Zuckerberg made.
If you want more on where the frontier labs actually stand right now, these go deeper: ▫️ OpenAI’s $122B masterclass: 10 takeaways from Sarah Friar
▫️ Anthropic Just Passed OpenAI in Revenue
▫️ Ilya Sutskever’s New Playbook for AGI
7. Muse Is Being Trained to Know What Not to Say
A personal agent has to reveal enough about you to get things done, and it has to decide what to hold back on its own.
“Let’s say you’re pregnant, and you’re making a reservation somewhere. You don’t necessarily want to say I’m pregnant, but maybe you want a place with good mocktails. It needs to know what is sensitive without having to ask you a million questions. That’s a specific thing we put into training.”
Discretion is a training objective for Muse specifically, not a capability Zuckerberg expects other labs to prioritize the same way. He draws a direct contrast with something like an enterprise coding agent, where the whole team already sees the work, so there’s less need to separate what counts as sensitive.
Coding sits underneath most of what looks like a different kind of task entirely. The MMA coaching pipeline, a Jeopardy game one beta tester built for friends, the Civilization strategy guide he built with his daughter: Zuckerberg says all of it reduces to code the agent writes that you never see.
Judgment about what to reveal, paired with the raw capability to build things on request, is what he believes other labs are training for less deliberately.
8. Muse Studies Overnight and Proposes Its Own Next Project (Without Being Asked)
Zuckerberg’s daughter wanted a Civilization strategy guide. Muse turned it into a history lesson on its own.
“It studies. It consolidates its reflections into memory. It works on projects, and it can also suggest new projects.”
Zuckerberg asked Muse to build a strategy guide for playing Civilization with one of his daughters. Muse later proposed expanding it into a tab covering historical lessons about the civilizations in the game, and he said yes.
The same pattern shows up in his MMA training feedback loop, where the agent suggested it could get better at picking the right camera frame to send him, then went and did it without a follow-up prompt.
Zuckerberg frames this as solving AI’s actual adoption problem: most people don’t know what to ask an agent to do. An agent that proposes its own next move, the same loop-engineering pattern showing up across the industry, solves that without requiring the user to get better at prompting first. It’s also why what the agent learns overnight matters as much as what it answers in the moment.
9. The Beta Tester Who Went Silent for Days Told Zuckerberg Everything He Needed to Know
Product signal doesn’t always look like praise. Sometimes it looks like someone going quiet.
“Someone I know who’s generally pretty skeptical about technology, I gave it to her, and she didn’t say anything for a few days. Then she texted me: when you do the general release, do I get to keep my Muse agent, or are you going to reset it?”
Within a day of getting beta access, one person was running their homeschool through Muse. Another had it plan an entire trip within 12 hours.
Zuckerberg’s own use cases skew domestic rather than technical: a weekend baking project with his 3-year-old that Muse organized end to end, Instacart order included, and mountain climbing permits it secured automatically for his older daughter. The baking project’s first attempt, cake pops, turned out to be a bad place to start, and he learned that the hard way.
None of this shows up on a benchmark. It’s the kind of usage that predicts whether people keep opening the app after week one, which is the only metric that actually matters for a product meant to run 24/7.
10. Zuckerberg’s Case Against Gatekeeping AI: The Superintelligent Lawyer Problem
If only one side in a courtroom gets a superintelligent lawyer, the system breaks. Zuckerberg says that’s the argument for putting AI everywhere instead of restricting it.
“If one person had a superintelligent lawyer, maybe they could win cases they shouldn’t be able to win. But if everyone had a superintelligent lawyer, it would be efficient sparring, and no stupid argument could stand. Justice would be served more efficiently and more fairly.”
This is the argument underneath the 15-page manifesto Zuckerberg just published, and the 1-page Personal Superintelligence essay he wrote for the Wall Street Journal a year earlier. Muse, he confirms, is what that earlier essay was actually pointing to.
His framework rests on 3 principles: putting people in charge of the technology is what generates prosperity, the primary purpose of AI is inventing new things rather than automating existing ones, and safety comes from checks and balances rather than restricted access. A big part of that third principle, in his own words, is a “robust open source ecosystem,” which he frames as making the whole system more secure precisely because more people can scrutinize it. That’s the same logic behind why so many companies now invest in open source well beyond AI.
He points to the Hugging Face security incident as evidence. The industry instinct is to hand advanced cyber models to roughly the top 100 institutions and stop there. Zuckerberg’s problem with that: more than 100 institutions actually matter.
Hugging Face isn’t among the biggest 100. When its team detected an intrusion, they turned to open-source models because they lacked access to the closed ones causing the damage. That draws the cutoff line in the wrong place.
“The best antidote to an AI that can hack into systems is giving everyone access to an AI so they can harden their own systems first.”
The Personal Agent Playbook
Muse bets that agents win by taking goals instead of prompts, earning trust through architecture instead of policy, and getting paid by making you money instead of charging you rent.
▫️ Founders: The differentiator Zuckerberg is betting on isn’t the model. It’s the trust architecture underneath it. Build your credential handling and permission model before you build the demo, not after.
▫️ Investors: Meta is testing whether a transaction cut beats subscription revenue for agent products. It’s a bet that Muse creates enough value that Meta doesn’t need to charge a premium for raw intelligence the way some frontier labs do. Watch the pricing model, not just the benchmark scores.
▫️ Operators: Copy the Sentinel pattern regardless of which model you’re running, a second system that monitors an agent’s outbound actions and gates anything sensitive behind human approval. Build that layer before you connect an agent to a payment method.
▫️ Everyone else: Muse’s free tier includes 100 million tokens a week plus a virtual machine. Give it an actual goal instead of a prompt and see what it does with a week.
The 4 Principles to Steal
Ship the trust architecture first. Zuckerberg recruited Moxie Marlinspike before Muse had a broad release. He built the confidential VM and the Sentinel layer into the product from its first version, instead of bolting them on after a scare.
Price for value created, not access granted. A small cut of a transaction, taken from the business on the other end, scales differently than a subscription. It only works if the product genuinely generates that value in the first place.
Talent density beats headcount when you’re behind. Meta didn’t fix Llama 4’s trajectory by adding people. It fixed it by shrinking the team around its best researchers and getting closer to the work personally.
Let the agent propose the next move. The blank-page problem is the actual adoption barrier for most AI products. An agent that proposes its own next step solves that without asking the user to prompt better.
Watermelon ships soon. MuseSpark, per the host’s own hedged read of a recent Artificial Analysis chart, sits just behind Claude Fable 5.1 and Opus 5. That gap is the one worth watching next.
This covers the product. The full interview covers the politics too, teen safety, data centers, and AI regulation. Watch it here.
If this breakdown saved you an hour, send it to one founder or investor who needs it.
More on Meta’s Bet
▫️ Zuckerberg’s $14B Bet: Glasses Kill the Phone in 5 Years
▫️ Nobody Cares About the Model Now. It’s About the Type of Moat
Where the Frontier Race Stands
▫️ Marc Andreessen: The AI moat is not the model
▫️ Sam Altman: Intelligence Got 100x Cheaper in 2 Years
▫️ Dario Amodei’s full picture: 10 takeaways that matter
Moving from rigid prompt engineering to goal-oriented agentic workflows changes the fundamental nature of security operations. We are finally shifting the burden of execution away from the analyst, allowing the machine to navigate intent rather than syntax. This transition mirrors the reality that internal decision chains in automated systems will remain opaque by design. Trying to force an audit trail for every micro-decision inside a high-speed agent is a distraction from the actual outcome. We should focus on the integrity of the goal itself instead of the black box mechanics of how the agent reaches it. Trusting the output requires a shift in how we validate performance at scale.
https://cyrilsimonnet.substack.com/p/nobody-will-ever-make-your-socs-ai?utm_source=substor&utm_medium=substack&utm_campaign=comment
Worth separating what shipped from what was announced. Meta's 8 September newsroom post describes Muse running on Muse Secure VM today, and says Muse Confidential VM, the version encrypted with a key only the person holds so Meta cannot access it, arrives later this year. So the claim that Meta is locked out of the agent's memory is the roadmap, not the current build. The same post puts the rollout in the US only. For a European firm scoring agents against vendor questionnaires, both lines matter: the guarantee is dated, and availability is not there yet.