The privacy promise Meta made about Muse is the reason a Muse ad business could work, not an obstacle to one. Meta has said that conversations and the data inside the virtual machine Muse runs on are not shared with its ad systems. That rule rules out the familiar model, where a profile is shipped to an auction. What it leaves is an inverted flow. The advertiser catalog is sent into the user's sandbox, the agent does the matching locally, and the ad system receives one fact back: a campaign produced a sale.
That inversion changes what Meta would be selling. The impression and the click drop out of the transaction. What gets sold is a completed decision. The most exposed revenue in consumer internet economics is the high-intent search query, because an agent that already knows the intent never has to type it.
The analyst who first argued Muse might "never" need ads has now reversed that view, and the reversal is useful mainly for the mechanism it lays out. The examples below come from that account. Product details such as Muse's virtual machine and the competing agents are described as reported, not independently verified.
The Query That Never Gets Typed
Car insurance shows the economics most clearly. The incumbent insurer knows the renewal date and has every reason to keep it quiet. Rivals cannot see the date, so they wait for the customer to reveal intent with a search like "cheap car insurance." That query is among the most expensive in search, with insurers and lead-generation sites bidding as high as $60 to $70 per click. Most of those clicks never turn into a policy, so the insurer that wins the customer is also paying for the clicks it lost. Customer acquisition cost lands in the several-hundred-dollar range.
Now consider an agent with inbox access. It reads a renewal notice showing the premium rising from $1,480 to $1,720 on November 14, a 16% increase. Service receipts imply roughly 6,000 miles driven in the year. The agent searches the ad catalog, finds a low-mileage policy, requests a quote of $1,250 with permission, and switches on instruction. The intent signal that Google currently auctions is never expressed in public. It is captured upstream, in the inbox, before it becomes a query.
The usual framing, "AI agents will take share from search," misses something here. The agent does not compete with search for the query. It removes the query. In this example Meta does not win a bigger slice of the auction. It goes around the auction altogether, in a category where its current role is small.
Reversing the Flow Turns Targeting Into Retrieval
The model needs two assets at once: personal context and advertiser supply. Context sits in the virtual machine. Supply sits in Meta's existing ad system, where millions of advertisers already have campaigns, creative, budgets and billing. A startup agent could gather context through connectors and still have nothing to show. A catalog without context is today's Meta, guessing from behavioral signals.
Combining the two turns targeting into retrieval. Targeting is probabilistic. The system infers that a user who watches running videos might want shoes and pays for many impressions to find one buyer. Retrieval is conditional. The agent knows a half marathon is nine weeks away, the current pair is fourteen months old with about 500 miles on it, and the user has a standing preference for a wide fit under $160. From the catalog it surfaces one option, a Brooks wide-fit model at $140, labeled as sponsored, along with an explanation based on the user's own data.
The privacy architecture holds in each example because the information moves in one direction only. Every user's agent reads the same full catalog. The decision about which ad was considered and why one was chosen stays inside the sandbox. The advertiser learns only what any merchant learns from an order. The travel example adds a third case. Instagram saves of Mexico City restaurants, which the ad system can already see, combine with an open calendar from October 23 to 26 and a walkable-hotel preference under $200 a night. The result is a $180 hotel near four saved restaurants, plus two reservations, and no flight or hotel search is ever typed.
Billing for Outcomes, Not Attention
The three examples carry different revenue signs for Meta, and the difference matters more than any single example.
- Insurance is mostly new revenue. The dollars currently go to search and lead generation, and Meta's share is modest. An agent-completed switch takes spending Meta does not have today.
- Travel is mostly new revenue. Meta currently gets paid for sparking the idea and hands the booking moment to Google. Carrying the user from saved post to confirmed reservation captures the second half of that funnel.
- Running shoes are partly cannibalization. Apparel brands already spend heavily on Instagram. If the first ad converts, Meta sells fewer impressions to reach the same buyer.
The shoe case shows where the real cost of the model falls. Retrieval is efficient, and efficiency reduces impression volume. The only way Meta comes out ahead on its home categories is by repricing from reach to results: charging per sale at a rate high enough that a brand pays more for certainty than it used to pay for exposure. The model also leaves no other pricing option. The ad system cannot see why its ad was chosen, so it cannot run a conventional impression auction on that choice. Cost-per-action billing is the only pricing the privacy constraint allows.
Advertisers have reason to accept this. A per-sale fee on a $1,250 policy is easy to justify against a several-hundred-dollar blended acquisition cost built on clicks that mostly fail. The same reasoning is less clear for a $140 shoe, where the margin available to pay a per-sale fee is thinner and Instagram reach is already effective.
Cost is also part of the equation. Consumer agents are expensive to run, and free access at mass scale needs a payer. Meta's rising capital intensity is the cost base that this monetization would have to cover.
Where the Thesis Leaks
The strongest objection is that privacy and trust are different problems, and the architecture solves only the first.
The agent chooses only among advertisers in Meta's system. A cheaper insurer that does not advertise on Meta is invisible to it. The user receives a better deal than the incumbent offered, but not necessarily the best one available. The ranking logic also sits inside Meta's model. The sandbox prevents the ad system from seeing the user, but it does not prevent the ranking from weighting the bid. If sponsored placements start to favor higher payers over better fits, the trust that persuaded users to hand over email logins and payment credentials is the asset that breaks. The opacity that protects privacy also makes that kind of drift hard to audit from outside.
Two smaller problems follow. The first is attribution. Advertisers used to granular reporting would get almost none, because by design the ad system cannot explain why they won. Some will treat outcome billing as a feature. Others will question an auction they cannot inspect. The second is the scale of this economy, which is currently illustrative. The source analyst concedes none of it may happen at meaningful scale next year.
The status quo is not neutral either. The first results for "cheap car insurance" today are the ones that paid to be there. A closed catalog run by an agent replaces one paid shelf with another. It is not a move from neutrality to bias.
Who Can Afford to Run This
The model has four requirements: a capable agent, free access at scale, personal context, and a deep advertiser catalog. The competitive map makes sense only by looking at which piece each rival lacks, and at whose existing revenue the model would eat.
- OpenAI has the willingness but, as reported, not the economics. Its agent product is bundled into a $100-a-month Pro tier. Its ad business counts advertisers in the tens of thousands against Meta's tens of millions, and it has no social graph, so all context has to come through connectors.
- Apple has distribution but no advertiser catalog. Its agent capability lags, and an ad engine would contradict a decade of privacy positioning. Hardware and services margins could fund an ad-free agent, but the running costs make that a hard subsidy to sustain.
- Google is the one competitor that could assemble every piece without building anything new. Gmail and Calendar already hold the context Muse has to request, and in insurance and travel its advertiser base is arguably deeper than Meta's.
Google's constraint is incentives, not capability. Every errand its agent completes is a commercial query it no longer auctions, and its revenue is concentrated in exactly the high-intent categories this model goes after. For Meta, most of the same activity is new. That asymmetry, more than any product gap, explains why Google's personal agent reportedly still sits behind a paywall. The restraint looks like a choice. Google has moved fast before once a threat became undeniable, as it did after ChatGPT. If Muse gains traction, protecting search stops being the cheaper option.
There is also a structural reason the prize concentrates. Users are unlikely to want several agents reading the same inbox and flagging the same insurance renewal. If one personal agent wins each household, the contest is over a single seat, and the company holding it decides which catalog gets searched.
The Condition That Settles It
The read is that Muse will carry ads. Indirect monetization, where agent activity sharpens targeting on Facebook and Instagram, lets Meta wait before introducing them. The form those ads take will be outcome-priced retrieval, not sponsored links in a chat window. Sponsored links in a chat window are this era's banner ad: the old format moved into a new medium before the native format appears.
Two observable conditions would confirm or break this view. The first is billing. If Meta offers advertisers per-sale pricing for agent-surfaced placements, the inverted-flow model is real and the high-intent search categories, insurance and travel first, are the ones exposed. If agent ads launch on impression or click pricing instead, Meta is selling attention in a new wrapper and the thesis fails. The second is Google's paywall. The day its personal agent becomes free at scale is the day Google concludes that cannibalizing its own queries is cheaper than losing them to Meta.
