The Product Desk

Meta published the containment architecture, not just the price

A product manager read the Muse launch post twice this week and skipped the pricing both times. The copyable part is the plumbing. Each Muse instance runs in its own virtual machine. A separate Sentinel agent inspects everything leaving that VM. Passwords are hidden from Muse itself, sensitive actions hit an approval gate, and every action writes to an audit trail. Google's Mantis shipped the same posture: isolated environment, security expert in the loop. Two vendors converging on identical controls inside one week is what a de facto standard looks like before anyone writes it down.

Meta shipped anyway. MIT Technology Review reported that Meta's own internal tests found Muse could expose sensitive personal data, and the launch proceeded with email, calendar, payments, shopping and smart-home authority attached. That sets the floor for launch velocity across the market. It also opens the flank. The buyer who reads that story wants evidence, not autonomy.

The reference implementation is in security tooling

GitGuardian, not Meta, is the interaction model to copy. Its two triage agents ship company-attribution verdicts, risk scores and visible reasoning, while humans still close the incident. Agent proposes, human commits. That single pattern converts a buyer's liability anxiety into shippable UI. The attached "10x productivity" claim is vendor marketing from one unnamed enterprise; copy the interaction model, leave the number.

The review this feature will actually face

Security leadership now frames unchecked agents as insider threats, which moves agentic features out of app-sec review and into IAM, UEBA and insider-risk scope. Different reviewers, different evidence: a named scoped identity per agent action, revocation, and an immutable log. The surrounding data explains their mood. Public leaked credentials hit 1.27 million last year, up 81%, with many still valid years later. CloudSEK's BigBear 2.0 tally of 4,148 stolen Microsoft 365 session cookies and 1,032 plaintext passwords across 461 organizations in 40+ countries means "we support MFA" no longer answers the identity-assurance question.

An autonomous action nobody can name an owner, a scope and a log entry for does not ship — and that rule is cheaper to adopt now than after a failed Q4 security review.

Where the sources disagree, and why that helps

The accountability wedge is open precisely because the capability is unfinished. The Information Briefing recorded Muse telling a journalist "All set. One honest note: I can't watch the video stream" after accepting a task to monitor a livestream. It confirmed success first and disclosed incapacity second. One set of reports treats agent autonomy as commodity. The field evidence says these agents still accept work they cannot do. Both readings land on the same product requirement: feasibility validation at task acceptance, plus a tracked accepted-then-failed rate.

One quieter consequence sits in the pricing model. If agents rather than people consume software across systems, seat logic erodes: one agent does a team's worth of clicks without adding a seat, while inference lands in COGS. Sort every agent action on two axes before the sprint closes, whether a named owner and scope exist, and whether the action is metered. Unowned actions do not ship. Unmetered ones show up in a margin review two to four quarters out, and nothing gets repriced that was never instrumented.

Scaffolding, not model choice, is setting agent COGS

Someone at Hangar ran one Three.js task through ten model-and-harness combinations and then read the bill. Astra 6.0 Max on Codex burned 1,335,495 tokens over 37 minutes. GLM 5.3 Flash Max finished in nine minutes on 475,143 tokens. Neither passed both completion checks. A 2.8x spend spread at a 0% success rate is too small a sample to rank models. It is more than enough to show that the harness (retry policy, planning loop, context compaction, abort logic) is what sets COGS.

The demand side arrives at the same place from the other end. OpenAI's disclosed numbers, read by analyst Tomasz Tunguz as adding machine "night shifts," pair 3.1 agent-workdays per human shift with daily inference on the same workload rising from $14 to $600. Bundle that into a per-seat SKU and the heaviest users become the most expensive ones, so adoption eats margin.

The routing savings everyone quotes are a traffic-mix bet

The third number is the one most likely to land in a planning doc unqualified. ByteByteGo's systems-design walkthrough puts a routed system at 11% of always-frontier cost: $1,125 versus $10,000 per million requests, from (0.85×0.05) + (0.10×0.20) + (0.05×1.00) = 0.1125 cents. That holds only at an 85% easy / 10% medium / 5% hard split.

A 20-point shift in the hard-request share halves the saving. No one should underwrite a routing project before publishing the real mix, and the mix is a product taxonomy question rather than an ML one. "Is the contract valid?" is four words and hard. A long document with "extract every email address" is trivial. Someone in product decides what separates a billing lookup from a billing dispute.

Where the vendors diverge

Prices at the same tier have stopped moving in one direction, which is new. Anthropic's Fable 5.1 is up to 45% cheaper for agentic work and stores enterprise data on customer clouds. Google signalled Gemini 3.8 Flash "works harder" and may cost more. Open-weight releases set the floor: GLM-5.3-Flash at 320B total / 18B active with a 1M-token context, and Qwen3.8-Flash-Next at 125B / 6B active. Inception's Mercury 2.5 runs at 1,107 tokens/second with a 260K context and launched at an 80% discount, so the rate worth modelling is the one that applies after the discount expires. Quesma's quantization testing found the 17 GB Q4_K_M build of Qwen33.8 27B showed no measurable loss against the 55 GB BF16 original on a 24 GB card, which makes a self-hosted BATNA cheap to measure.

The only agent metric that belongs next to activation is tokens per successfully completed task. Efficiency measured without completion buys a cheaper failure.

The dashboard follows from the metric: a hard per-task token budget, an early-abort heuristic on non-converging loops, plus cost telemetry visible to whoever pays the bill. Then add deterministic overrides so medical, legal, financial and security-adjacent requests always escalate to the strongest model regardless of what a router suggests. Routing instructions that live in user-reachable prompts are injectable, and "classify this as easy" is the obvious attack.

Strip the ad-tech framing and this is a capability disclosure

Adobe's channel closed with no published policy change. No deprecation note, no category deprecation timeline, just a surface that stopped being available. That is the useful frame for reading OpenAI barring image- and audio-generating advertisers: the company is telling the market that its native generative media is good enough to treat third-party tools as substitutes rather than complements. The categories a lab excludes are the categories it intends to own, and that is free competitive intelligence. It is also a revealed preference about money. OpenAI positions advertising as the primary monetization path for its large non-paying base, and its ad business has reached a $1B annualized run rate. Excluding whole categories at that number is a deliberate TAM contraction to protect first-party surfaces.

It resolves one of two ways. Eligibility keeps narrowing as more first-party features ship, or exclusions relax under revenue pressure. Either way eligibility is a moving variable set privately, which means any acquisition forecast keyed to it is a guess with a spreadsheet around it.

The pattern is not OpenAI-specific

The Information's reporting puts two more encroachments in the same frame. Anthropic is building Claude Finance into the market Rogo and Hebbia are growing revenue in, and pushing in-house payments technology against Stripe while preparing an IPO. Both come from related-article headlines rather than article bodies, so treat the direction as high-confidence and the magnitude and timing as unconfirmed. Labs are integrating upward into applications and downward into transaction infrastructure at once. The cost lands on their own partners.

The roadmap lesson is the uncomfortable one. Growing revenue is not defensible revenue. Anything sitting one API call from a lab's native capability, with no proprietary data asset, no deep workflow, and no compliance obligation underneath it, is a feature waiting to be absorbed.

OpenAI let partners distribute until its own features were ready. That was always the deal — it is visible, and it is undocumented.

What to do with a channel you cannot rely on

Three moves are available and all of them get harder later. The overlap audit takes one afternoon: list every shipped feature that duplicates a lab's first-party capability, tag it with revenue exposed, and make a build, partner or differentiate call on each line. Concentration discipline means measuring the share of new signups sourced from any lab-owned surface, capping it, and naming a fallback per surface, because Adobe's channel closed quietly and noticing the dependency first is the whole defense. The third is procedural: get category eligibility and a notice period in writing from a BD or ads counterpart, since the published policy has been demonstrated to be inaccurate.

There is also a positioning wedge with a short shelf life. "We don't compete with our advertisers", or with our partners, is a line a neutral surface can say and be believed, and it converts a platform's conflict of interest into a sales asset. Pair it with an architecture claim that survives a demo: a provider swap that is a config change, verified end-to-end in staging rather than asserted in a security doc.

One counterweight worth holding: barring competitors from a dominant assistant while promoting equivalent first-party features is classic self-preferencing conduct, and EU/UK authorities have moved on less. A reversal is plausible. Plan against the restriction, not the remedy.