233: Muse Is Why Meta Has No Business Building The Agentic Web

[00:00:00] Mark Zuckerberg is having a moment, and we need to talk about it. Zuckerberg, who runs Meta, was sitting across from a reporter a few weeks ago, and he was explaining what it means for an AI to be discreet. Picture that, AI to be discreet. The example he used was a restaurant. You ask your AI to book you a table, and then maybe you have dietary restrictions.

[00:00:23] Maybe you're pregnant, and you don't want to tell a stranger on the phone any of that. I don't know why, but let's assume you don't. You want the booking done, and you want to give away as little about you as possible. That's the promise. Now, something else was happening that same month. When Meta's AI phoned a business to book something for a person, some of those calls were not really made by AI.

[00:00:49] They were made by people, by contractors in a call center, and at least one person testing it wasn't told the caller was human

[00:00:59] I'm Sani, and this is No Hacks. Nobody asked any of us if we wanted the internet to change, so I check what AI is actually doing to it: the good, the bad, and the pointless.

[00:01:10] Meta's AI is called Muse. Meta is the company behind Facebook, Instagram, and WhatsApp, and Muse is what they call an AI agent, an assistant that goes off and does things for you.

[00:01:22] It can book, it can buy, it can read your email. It's free, so people are trying it. According to the information, more than half a million people have tried it in the first week. How many people kept using it? I guess we'll never know. Only Meta does. Nilay Patel, who runs The Verge, says it was surprisingly good.

[00:01:47] Muse is part of something that's called the agentic web. Think about how you use the internet today. You open a website, you read, you click, you type in your credit card number. With an agent, you just say or type what you want, and then the agent does the opening, the reading, the clicking, the paying on websites for you, and you never get to see the websites.

[00:02:09] And every big company wants to be the company behind the agent you end up using. Meta, Google, OpenAI, even Elon Musk's company has one. So if Meta wants my passwords to access my websites, then they need to describe exactly how it works and exactly how secure it is without reverting to future tense while explaining

[00:02:33] So the question is, is Meta's AI agent worth access to your email, your passwords, and your credit cards? One of the reporters Zuckerberg was talking to asked him a version of that.

[00:02:45] Her name is Joanna Stern. Here she is

[00:02:47] 

[00:02:47] And so I haven't, for instance, hooked up my personal Gmail because I have two fears there. One, do I trust Meta to have my personal Gmail information, my very private messages? And then two, what if Thingy, my muse, goes off and just starts randomly emailing people or doing something I, I don't want it to do on my behalf?

[00:03:07] And I'll stop it right there. His full answer is about two minutes long. The whole interview is linked in the show notes and the description, so you can hear all of it yourself. It's on Joanna's YouTube channel, and it's a channel I definitely recommend subscribing to. He waltzed around the answer. He said a few things in the future tense, and he never addressed the security and privacy in a way that answers her question.

[00:03:31] It was a non-response I expected this more or less, and yet on paper, it's a serious design. Every user gets their own computer. A second AI checks everything the first one sends out. The man behind Signal's encryption, Signal the messaging app, the, the encrypted messaging app, is working on it, and Zuckerberg says no one else is anywhere close, whatever that means.

[00:03:57] So pay attention to the tense he's using. Here's the first thing he said word for word, "We've built the privacy model to have this new secure VM where all your content is on your own virtual machine." What's a virtual machine? You open Muse on your phone, and you ask it for something, but the work doesn't happen on your phone.

[00:04:15] It happens on a computer Meta sets up for you alone somewhere in the cloud in a data center, and your logins live there too. So your own computer is Meta's computer. That's present tense. That's what's built. So what does Meta do with what happens on that computer? Well, they answered that one themselves in a technical post that accompanied the announcement post for Muse on the launch day, and I quote, "Muse does not share your conversations or the data in your virtual machine with the Meta ads systems."

[00:04:49] Now think about how ads actually work. You look at a pair of shoes once, and they follow you around Instagram for a week because the shop saw that you visited and, and, and searched for it. And then in that same section, they say, "When Muse browses the Internet, it will appear as your activity.

[00:05:07] So if you ask Muse to buy a shirt from a clothing designer's website, that designer might use your visit to show you an ad on Instagram." So your conversations stay out of the ad systems, but the shoes still get to follow you. This time it was Muse that looked at them and not you. This is an ad company telling you in writing that what your agent does can end up in ads on Instagram.

[00:05:35] Your conversations with Muse are used to train Meta's AI. If you don't want that, there's a switch in the settings, so it's on unless you go and find it.

[00:05:45] Here's another thing. He said your passwords are not accessible to the agent and that there's a second agent called Sentinel that polices the first one.

[00:05:54] Here's what that means. When you give Muse a password, Muse itself never gets to see the password. There's a separate program on that same machine that keeps the password, and Muse only gets a stand-in for the password. Sentinel is that other program sitting next to Muse. It has to approve anything Muse sends out to the internet, and it swaps the real password on the way out.

[00:06:18] That's present tense again. It's Meta's description of Meta's system. Nobody outside Meta has published a check of whether that's how it works or, or whether it works well.

[00:06:27] On September 20th, Amazon blocked Muse from its store, and one of the reasons it gave was that Muse appears to capture and store customer credentials. Credentials equals logins. Amazon has not shown evidence for this. Meta has not shown evidence against it. That's two companies making two claims that we cannot check.

[00:06:49] And Amazon has a shopping agent of their own. It's called Alexa for Shopping. The one part of Muse that runs on your computer, comes with a hidden setting that could have let other software on your Mac take it over. One outside researcher found it.

[00:07:05] Meta patched it within hours of it going public. So the one part you could check had a hole in it. The part you cannot check is the part you're supposed to trust. Here's the third thing. He said, Zuckerberg said, that Moxie Marlinspike, the man behind the encryption in Signal, the private messaging app, is working on something called the Muse Confidential VM, Muse Confidential Virtual Machine.

[00:07:32] Your own computer again, but locked with a key that only you hold, his words. So that way, Meta can't even see the stuff inside it. He's working on it. This is not live. Meta's announcement says the same thing in writing. Later this year, Meta will introduce Muse Confidential VM, future tense. The version where Meta cannot see inside this computer, the virtual machine that you get that Meta hosts, is the one that's coming later.

[00:08:04] Which brings me to the question I wanted to see answered. What happens if their VMs get compromised?

[00:08:11] And he does answer this once. He says, "If a hacker gets into Meta," and I quote, "They're not going to be able to get it." But he says that about the locked version, the one that's coming later this year, not the current one.

[00:08:23] For the one you'd actually be using today, he says nothing. The announcement says nothing. The technical post says nothing. He also talked about publishing the technical details for security researchers to check. I haven't found them. There's no date when they'll be published.

[00:08:40] That's future tense as well. And remember Joanna Stern's second worry from that clip I played, Muse going off and emailing people she never meant it to. He answered that one with what he calls discretion. That's the restaurant and not telling a stranger you're pregnant, basically.

[00:08:56] His words, "The AI needs to be trained from the ground up to know what's okay to share, and discretion is something we will have to really succeed at." Future tense again. Here's a present tense, though. In the same month when Muse phoned businesses to book things for people, some of those calls were placed by human contractors.

[00:09:19] One Meta employee warned in an internal post, "We are one bug away from unnecessary information being leaked to human callers. So discretion today was a stranger on the phone. For what Muse can actually send today, you have to go to another interview two weeks earlier. Email, Zuckerberg said, should start read-only.

[00:09:41] And if you wanted to send emails, you ask for that specifically.

[00:09:46] But in order to have the agent email anyone for you, you need to give it this access. So the default protects you right up until you use it to send emails. Everything is said in the present tense. Only Meta has checked. So the pitch is, trust us now and the protection from Meta will come later. So why would I hand Muse my email, my passwords, my card?

[00:10:10] This is not it. Meta is full of it here, as they always have been. So who's asking you to trust this? What's Meta? Meta is an ad company. That's not my opinion. It's in their own annual report. Last year, Meta made a little over two hundred billion dollars. Now you get how they get so much money to waste on AI and data centers.

[00:10:32] And ninety-seven point six percent of this money came from ads. And look at their record on privacy, something we're supposed to trust them on here. In twenty nineteen, the US Federal Trade Commission, the government's consumer watchdog, fined Facebook five billion dollars. At that time, that was the biggest privacy penalty ever.

[00:10:55] The finding was that Facebook had deceived people about their ability to control their own privacy.

[00:10:59] That's after Cambridge Analytica, a political consulting firm, got hold of data on eighty-seven million Facebook users. And then in 2021, Frances Haugen, who worked at Facebook, walked out with the company's internal research.

[00:11:15] It showed the company knew Instagram could make teenagers feel worse about themselves. There's a movie coming out about this on October 9th, The Social Reckoning, and I think Zuckerberg's strong PR push might have something to do with the film coming out soon. We'll see about that. But the company that did all the things that Frances Haugen warned the world about, that company cannot preach agentic privacy and security.

[00:11:40] So why does it matter this much? Why does who's building it matter so much on the agentic web? The early web was created by CERN, a physics lab paid for by governments, not late-stage capitalism tech companies. In 1993, they gave the whole thing away. It was decentralized by design. That's the key difference.

[00:12:04] And then the tech companies came. In the '90s, they fought over the browser, the thing you opened to get online. It was called the Browser Wars. But even then, the browser ran on your computer. Muse and all the competitors it has, they run on computers that company controls.

[00:12:21] Meta in this case. The agentic web is built as a centralized thing in how people will plug into it by using AI agents provided by major tech companies. Well, at least most people will do it that way. So it's Browser Wars again, let's call it Agent Wars. And they're spending money to be the one you pick.

[00:12:41] For the last few weeks, I've been seeing ads for Grok Bot from Elon Musk's AI company on YouTube all the time

[00:12:48] And Meta has already said how it plans to make money from Muse. For most people, it's free, and it's going to be free. Zuckerberg told Alex Heath on the Sources podcast that, "The business model over time that we expect is to effectively just take a very small cut of whatever the transaction is." That's the plan from Office Space.

[00:13:10] There's a term for this. It's called salami slicing. You take a slice of every transaction, so thin that nobody cares or nobody notices. In the movie-- watch the movie if you haven't. It's a crime. It's a business model now. And that cut, that tiny little cut will come from the businesses that they're working with.

[00:13:28] So if you run a store on Shopify, that's gonna be you. Neil Patel made this point on his show, Decoder. Meta wants to sit in the middle between the buyer and the store and take a cut. And Meta knows exactly what that feels like from the other side, because on the iPhone, Apple sits in the middle. According to Patel, Apple takes thirty percent of most sales in its App Store, and Meta has spent years trying to build something that gets it away from Apple.

[00:13:56] Now it wants to be the one in the middle. That's why they're pushing for this. The people building this are doing it with profit in mind from day one, and I think that's a very bad thing.

[00:14:06] And this is why this will be different from the early days of the internet. I want this to work. For the agentic web to really become something we can all benefit from, where we have software and AI agents doing things for us online, helping us find information, getting the boring things done, helping us shop and compare.

[00:14:25] For that to happen, we cannot have Mark Zuckerberg and Meta as a part of it. This is a company with a terrible, terrible privacy track record, promising us it's handling privacy and security in vague speak and future tense. Stay away from this

[00:14:42] And I'm gonna share two documents. The first one is from April 1993. It's CERN giving away the web word for word. "CERN relinquishes all intellectual property rights to this code, both source and binary form, and permission is granted for anyone to use, duplicate, modify, and redistribute it." The second one from September this year, from this month, it's Meta launching Muse word for word.

[00:15:07] "Later this year, Meta will introduce Muse Confidential VM, where the whole VM, including a person's data and conversations with Muse, is encrypted with a key only they hold, so not even Meta can access it." The first one was giving away the web for free.

[00:15:21] Anyone could use it on their own computer, and nobody owned it. That's how it became the web. The second one is a promise for later about a computer Meta runs with an ad company's agent in the middle and a cut of every sale in the plan. Something one company runs, sits in the middle of, and takes a cut from, that's not web. That's Facebook, and we don't need Facebook on the agentic web or any other version of the World Wide Web

[00:15:51] This was NoHacks. If you want a verdict like this every week in your inbox, just go to nohacks.co/subscribe.

[00:15:58] I'm Sani. Thank you for listening

[00:16:00] All right, so another, another post-episode, uh, blurb from me. First of all, I'm gonna move the episode release to Saturday morning. I talked to a friend a few weeks ago, and, uh, he said... Well, we, we discussed it, and we, we kind of agreed that Saturday morning is when we both listen to our podcast. That's the long walk, long run, gym.

[00:16:23] There's no work. You can focus. So I'm gonna try Saturday morning from now on. But if you don't like that, just respond or send an email to [email protected] and let me know what you think. The second thing that's happening is I just saw a video by House of L AI YouTube channel, and, uh, she's a, she's a great tech analyst that you should also subscribe to.

[00:16:43] There, there are a lot of people doing incredible work on YouTube, independent creators. And she said, and there was another person who said this, uh, that AI think tanks or non- nonprofits, whatever it was, tried to approach them and, uh, ask them to, uh, say that they're afraid that AI is going to destroy the world.

[00:17:05] Like, that's their opinion. So all those doomsday, uh, Jason Coxon-inspired, uh, Dario Amodei-inspired, all those people saying that AI is going to destroy the world, you should just-- next time you hear about this, you should know that there's, there are companies and or nonprofits or whatever they are, think tanks, I, I, I don't know what the structure is, that are paying people to say this.

[00:17:29] And of course, influencers get paid to say whatever, but this has been kind of the hottest thing on the internet, or in my bubble at least. AI is going to destroy us all. I'm getting Skynet videos recommended, uh, clips from Terminator 2 all the time now on YouTube. I, I don't know why, shorts. I don't think this is real.

[00:17:48] I think this is more of a narrative design project than anything else. So don't believe everything you hear online. Believe NoHacks, obviously, and I will talk to you next week. Thank you.