We’ve made this bargain before. Search, email and social networks gave us useful services for free and built businesses on advertising and attention. Most people accepted the trade, and that wasn’t irrational. Gmail won in 2004 because it was the better product.

Personal AI agents bring us back to the same fork, with more at stake. A personal agent may see your email, calendar, files and purchase history, remember conversations from months ago, and then act on your behalf. That future has already arrived. Meta launched Muse on September 8, able to send email, book travel, lower bills and make purchases. Instinct, the startup assistant, already contacts businesses and runs accounts for you from its own email address.

Follow the money

What matters is how the provider earns money and whether that money can shape what the agent recommends or does.

Muse is a good test case, and to Meta’s credit it comes with real commitments. There are no ads, the agent runs on its own isolated computer, and Meta says Muse data stays out of its ad systems. There’s a free tier plus $20 and $100 monthly plans. Meta expects to profit, in Mark Zuckerberg’s words, “by taking a small fee from transactions.”

So the incentive points toward purchases whether you pay nothing or $100 a month. Meta hasn’t disclosed the fee, whether retailers can pay for placement or how Muse ranks products. If I ask for the best hotel in Key West under $300 and it picks Hotel A, I want to know whether Hotel A is best for me or simply pays Meta a cut. Advertising pulls the same way, and OpenAI started running ads in ChatGPT in February.

A paid agent can still change the deal

We’ve often been led to believe that if we don’t pay for a product, then we’re the product. But even if you pay a subscription fee for your personal agent, it doesn’t mean it’s always acting on your behalf or that you own and control what makes it useful. For example, you may still face a vendor lock-in problem. An agent that has spent a year learning your preferences, contacts and accounts is hard to leave. Anthropic and Google now let you import remembered facts from rival assistants, but an agent’s connected accounts, permissions and credentials can’t be moved, and no standard exists for them.

Stated commitments can shift too. When Facebook bought WhatsApp in 2014, it told European regulators it couldn’t reliably link accounts across the two services. Two years later WhatsApp began sharing users’ phone numbers with Facebook, and the European Commission fined Facebook €110 million for the misleading filing.

The privacy-first pieces are appearing

Proton’s Lumo assistant doesn’t train on conversations, encrypts saved chats and memory so Proton can’t read them, and runs open models on Proton’s own servers. In May, Proton Pass added tokens that give AI agents limited, revocable use of your credentials. Confer, from Signal founder Moxie Marlinspike, uses confidential computing so even the provider can’t see your conversations, and Brave is adding agentic browsing to its subscription-funded Leo assistant. Meta and Instinct lead on agents that act, and Proton and Confer lead on privacy. Nobody has both yet.

Open-source projects such as OpenMuse give technical users full control, but most consumers won’t configure containers or test for prompt injection. The Gmail lesson applies. The private option has to be just as good.

There’s room for it. Consumers now routinely pay around $20 a month for premium AI, and the sensitivity of agent data may make them more willing to pay for one that promises no ads, no paid placement, encrypted and exportable memory, and permissions you can revoke. But Muse’s $20 tier shows that a subscription alone doesn’t guarantee any of that.

Access will decide which model wins

Independent agents need access to the services they act on. If Amazon, Google and Meta make their platforms easy for their own agents and hard for everyone else, privacy-first agents start far behind. Senator Mark Warner’s AI AGENT Act (S. 5051) would require large platforms to give registered agents access on the same terms as users and bar providers from using delegated data for advertising. As I noted when the discussion draft appeared, access should rest on conformance to open standards. With interoperability, agents become more like browsers and you pick the one you trust. Without it, we get another set of walled gardens.

Brands should also prefer to understand who they’re dealing with. A contact center engaging in an interaction with an agent its user pays for (or runs herself on her own trusted infrastructure) can assume that agent wants what the customer wants. A commission-funded agent may have other reasons in play. Service teams will need to know whose interests an agent represents.

Still early enough to choose

The first consumer internet made free the norm, and its costs became clear only after the platforms were enormous. Personal agents are early enough that real alternatives are viable. There’s still time for those of us in the industry to help people understand the choices, or even to build or at least back agents whose only customer is the user. For everyone else, it means asking who pays the company behind an agent before handing it the keys.

Categories: Articles