Truth decays slowly. But a persistent machine that remembers what you told it last month decays in ways nobody has priced yet.
Last week I sat in a WeChat call with four people I trust more than most exchanges, and one of them — an infrastructure engineer who spent the last two years hardening sandboxes for a custody provider — dropped a line I have not been able to shake. He said, "Emma, everyone is arguing about which agent is smarter. Nobody is arguing about who holds the keys to the room the agent lives in." Then he described something that, if it is real, moves the entire conversation. Two products, apparently converging on the same primitive: a persistent agent VM — a cloud computer that does not die when the conversation ends. GrokBot, tied to an X account. Muse, tied to a Meta identity. One runs the whole account inside a Firecracker microVM and lets every bot share the room. The other gives each user a sealed Linux box and inserts credentials at the network edge so the agent never actually sees the token.
I have spent nine years watching this exact movie in crypto. Not the AI version. The custody version. Every cycle, a new team tells us sophistication has replaced trust, and every cycle, we discover that sophistication just moved the trust to a smaller, quieter room that nobody audited. When I read the architecture notes, my first instinct was not excitement. It was recognition. This is the 2017 ICO whitepaper problem wearing a Linux kernel. Code over hype — and right now, the hype is loud and the code is a rumor.
So let me be precise about what I am doing here. I am not going to pretend GrokBot and Muse shipped. As of the date I am writing this, the releases described — a GrokBot beta, a Muse launch — sit in the future tense of a document with no official changelog, no API reference, no pricing page, no third-party teardown. No source link survives a second click. That matters, and I will not bury it. What follows is a structural reading of a claim, not a review of a product. But the claim is worth reading carefully, because the architecture it describes is the architecture the entire agent industry is walking toward, and because the governance failures it hides are the same failures that emptied wallets in every bear market I have survived.
Context first, because this does not come out of nowhere.
For three years, the dominant pattern for "AI that does things" has been the stateless API call. You send a prompt, you get a completion, the session evaporates. The model has no home. It has a mailbox. This is cheap, it is easy to meter, and it maps perfectly onto token billing — which is exactly why the industry settled on it. When an agent needed to browse, the vendor bolted on a browser tool. When it needed a file, the vendor bolted on a retrieval layer. Every capability was a stateless bolt-on to a stateless core.
The problem is that real work is not stateless. Real work accumulates. A human assistant who forgets your project every morning is not an assistant, they are a search engine with a personality. So the industry began the slow migration every infrastructure person I know saw coming: from stateless inference to stateful workspaces. An agent that keeps a file system. An agent that keeps a browser session. An agent that keeps a terminal and a set of credentials and, crucially, a memory of what it did yesterday. This is where the document gets interesting, because it says two of the largest labs have quietly stopped treating the runtime as a feature and started treating it as the product.
On one side, the document describes GrokBot as an account-level persistent cloud computer. Every bot under one account shares the same environment: the same screen, the same files, the same credentials, the same network identity. Isolation happens between accounts, and the mechanism named is a Firecracker microVM — the AWS open-source lightweight virtualizer that already powers a large fraction of serverless infrastructure on the planet. Inside the box, the bots are roommates. Between the boxes, there is a hard wall.
On the other side, Muse is described as a per-user isolated Linux VM, with a host-side governance agent the document calls Sentinel. Sentinel is the sole authority over what the connectors do and what traffic leaves the box. Credentials do not live inside the VM. They live outside it, and they are injected just-in-time at the network boundary, so the agent composes an action against a token it never holds. There is also a prompt-injection classifier and a human-in-the-loop approval step for sensitive operations.
Here is the first thing every crypto reader should notice, and I want to state it plainly because it is the spine of this entire article: the interesting question is never "is there a VM." The interesting question is where the security boundary is drawn — at the account or at the action. GrokBot draws a thick wall around the account and a thin wall inside it. Muse draws a thick wall around the individual and a thick wall around each consequential action. Everything downstream — every risk, every business model, every compliance posture — flows from that single architectural fork.
Let me take the account-level design first, because it is the one that scares me.
A Firecracker microVM is genuinely excellent technology. I have audited systems that lean on it and I trust it more than most container runtimes for hostile multi-tenancy. It boots in milliseconds, it has a narrow device model, it presents a small attack surface to the guest. If I am xAI and I want to sell "a computer for your bots" to a hundred million X users, Firecracker is the responsible choice. Between-user isolation is real. One user cannot, through any normal path, reach into another user's machine.
But the document contains a sentence that I want framed and hung on the wall of every agent startup: the platform explicitly warns that a bot's screen is not a security boundary, and that if another bot should not have access to a credential or a file, you should not place it there. Read that twice. The platform is telling you, in its own documentation, that it does not enforce least privilege inside your account. The microVM protects you from other customers. It does not protect your bots from each other, and it does not protect you from a single compromised bot.
This is a responsibility transfer dressed up as a feature, and it is the oldest move in the crypto playbook. "Not your keys, not your coins" was never just a slogan; it was a disclosure that the custody model made you responsible for a threat you probably did not understand. Same structure here. "Not a security boundary" is not a bug report. It is the platform pre-emptively assigning you the blast radius.
Why is that dangerous at Internet scale? Because an account-level shared runtime is a lateral movement paradise. Imagine you run six bots: one for email, one for calendar, one that browses the web for research, one that touches a payments connector, one that manages your social posts, one that runs shell commands. They all live in the same house. The researcher bot wanders onto a hostile page. Injected instructions arrive through the content it reads. The bot now acts on those instructions with every privilege the account has, because there is no per-bot wall to stop it. It can read the file the email bot saved. It can grab the token the payments consultant needed. The microVM that so elegantly keeps the stranger out of your house keeps every resident of your house inside with a compromised roommate. The wall is in the wrong place. It is drawn against the world, not against the failure
I want to be fair to the design, because coordination is genuinely valuable. A shared runtime is why a resident agent can pick up work another agent started — the file is already there, the session is already warm, the friction is near zero. If you have ever tried to chain two stateless agents that cannot see each other's state, you know the tax. Coordination-first is not stupid. It is a bet that friction is the bigger enemy than blast radius, and for a consumer or creator workflow, that bet may even be correct. But it is a bet, and it is being sold as a specification.
Now the action-level design, which is smarter and, precisely because it is smarter, more dangerous in a subtler way.
Muse, per the document, hands each user an isolated Linux VM and puts a governance agent on the host. Sentinel governs connector actions and network egress. Credentials sit outside the runtime. When the agent needs to use a token, the token is injected at the boundary — the agent writes the action, Sentinel attaches the secret in flight, the agent never possesses the raw key. If you have spent any serious time with cloud identity, this should ring a familiar bell: it is the pattern of a secrets manager combined with a policy engine combined with an egress proxy, wrapped around an agent. This is the architecture of a bank branch, not a locker room. There is a teller between you and the vault, and the teller decides what counts as an authorized withdrawal.
On its face, this is far more defensible than the account-shared model. A compromised agent in an action-governed world can only do what Sentinel permits. It cannot exfiltrate a token it never held. It cannot quietly open an outbound connection to an attacker's collector if egress is filtered. The blast radius of a single bad prompt shrinks from "the whole account" to "the one action the classifier failed to catch."
But notice what just happened to trust. In the account model, the trust sits with the user, who is told to police themselves. In the action model, the trust concentrates entirely in Sentinel — a single component, on the host, that is the sole authority for every connector action and every byte of network egress for that user. That is not the absence of a trusted party. That is the most concentrated trusted party in the entire stack. And concentration of trust is the exact sin we spent the last decade in crypto trying to engineer away.
I have seen this shape before, and I want to tell you about it because it is the closest thing I have to hard-won evidence. In 2020, during the DeFi summer, I worked with the MakerDAO community on a series of guides about ethical lending — teaching people to understand collateral risk without a black box. When the liquidation chaos hit, I spent two weeks manually pulling on-chain data so my community could see, with their own eyes, what was happening to their positions. What I learned is that transparency does not require everyone to read the code. It requires that the person who reads the code be replaceable. The system was trustworthy not because it was simple, but because any sufficiently patient person could re-derive the same truth. The moment trust concentrates in one node that only one team can inspect, you have rebuilt the bank and called it a protocol.
Sentinel, as described, is that node. If Sentinel is bypassed, misconfigured, or corrupted, every action for that user is compromised at once. If Sentinel's policy is wrong, the user may never know. If Sentinel's classifier is fooled — and prompt-injection classifiers are routinely fooled — the action proceeds with credentials attached, and the agent never even had to steal them. And here is the part the document never addresses: just-in-time credential injection is a mechanism, not a guarantee. It does not automatically prevent replay, it does not automatically prevent privilege escalation through the connector layer, it does not automatically prevent the token from being cached in memory inside a process the agent can reach, and it does not automatically prevent the logs from leaking the value that passed through. The magic word "injected" hides an entire unpriced attack surface behind it.
And then there is the human-in-the-loop approval. On paper it is the crown jewel. A human signs off on high-value autonomous actions. In practice, every operator who has run a busy approval queue knows what happens: the queue grows, the human fatigues, and fatigue becomes the vulnerability. Approvals become reflexes. Reflexes become rubber stamps. The most secure-seeming control becomes the softest target because it sits directly in the path of the human's patience, which is finite and measurable. Approval fatigue is not an edge case. It is the default state of any control that scales linearly with activity while human attention does not.
So I have two architectures and a clean, uncomfortable symmetry. GrokBot pushes the trust burden onto the user and calls it coordination. Muse hoards the trust in a single host agent and calls it safety. One over-delegates. The other over-centralizes. The document frames this as "coordination-first versus security-first," and while that framing is tidy, I think it flatters both designs. What they actually represent is a choice about where to hide the single point of failure — in the user's discipline, or in a component the user cannot audit. Neither answer is decentralization. Both are custody models. We have simply changed the asset from coins to actions.
This is where the bear market context matters, and I want to be direct with you, because a lot of you reading this hold assets that are bleeding and you are looking for one more thing to worry about. You do not need a future GrokBot to be exposed to this class of risk. You are already exposed. If you have handed a trading bot an API key with withdrawal and trade permissions on a centralized exchange, you are running an account-level shared runtime. The bot has the key. The key works everywhere inside the account. The exchange says the API is not responsible for loss of funds, exactly as the agent vendor says the screen is not a security boundary. The disclosure is identical. The blast radius is identical. The only thing that has changed is that we now give the bot a nicer interface.
Based on my audit experience, the safest pattern I have ever seen for an automated actor — and this holds whether it is a trading bot, a treasury bot, or a future persistent agent — is not a cleverer runtime. It is scoped, ephemeral, revocable credentials with a hard egress allowlist and an immutable action log. Give the actor exactly one capability, for exactly the window it needs, revoke it on completion, and never let it hold a standing secret. The reason is not paranoia. The reason is that the compromised case must be survivable. A well-designed system assumes the actor will be hijacked, by a hostile webpage, a poisoned data source, or a clever prompt, and asks: when that happens, what is the worst outcome? If the answer is "everything in the account," the design has failed before the first line of code
That leads me to the contrarian angle, and I want to argue against the framing of the document itself, because I think it is looking at the wrong competition.
The document's central competitive claim is that the battle has shifted from model capability to runtime governance precision, and that whoever builds the better governance layer wins the enterprise. That is half right. It is right that runtime is the new battlefield. It is wrong, I think, about what precision buys you. The document treats "more precise governance" as strictly better — more controls, more classifiers, more approvals, more Sentinel. But every control you add is also a thing that can fail, and every centralized control is also a thing that can be captured. The most governed system is not the safest system. It is the system with the most single points of failure wearing the most reassuring uniforms. Complex governance does not eliminate the trusted party. It multiplies the surface on which the trusted party can betray you, then hides that surface behind a compliance checklist.
I have lived through a version of this. After the collapse of the centralized intermediaries in 2022, I did not write a single cheerful post for a very long time. I withdrew. For about six months I went quiet and audited the foundations of decentralized identity projects — the kind of work that asks whether sovereignty is technically implementable at all, or whether it is a story we tell ourselves to sleep at night. What I found is not what I expected. Decentralized identity does not become trustworthy because the cryptography is beautiful. It becomes trustworthy because it makes the trusted party interchangeable. The verifier can be one of many. The issuer can be one of many. Revocation is a public act. The system survives the failure of any single participant because no participant is required to be honest for the system to function
Neither GrokBot nor Muse, as described, has that property. Both require you to trust the operator. The difference between them is which operator and how much. That is not a governance revolution. That is the same old custody question, restaged for a new asset class, and priced with the same optimism that has preceded every collapse I have covered.
So what should you actually watch for, and what do I actually believe will happen? Let me separate what I can see from what I am guessing, because the difference matters and I refuse to blur it.
What I can see, if these designs are real, is an economic trap that the document entirely ignores: the cost model of a persistent VM is the enemy of the gross margin of a SaaS product. A stateless inference call is billed per token and shared across many users at the same instant — the utilization is aggressive, the infrastructure breathes. A long-running per-user virtual machine is the opposite. It looks, economically, like Virtual Desktop Infrastructure, and every company that ever sold VDI learned the same lesson: idle compute is a silent, permanent tax. Each user who never logs in is still a reserved slice of CPU, memory, storage, and network identity. The document never mentions density, hibernation, snapshotting, or resource quotas, which are precisely the things that decide whether this business survives its own success. I have watched exchange launchpad returns decay from triple digits to single digits over the past two cycles, and the mechanism is always the same: the product that looked infinite in the bull market turns out to have a cost structure that only works at a scale the margin does not allow. Persistent agents face the identical squeeze. If they charge per seat, power users destroy unit economics. If they charge per resource, consumers revolt. If they charge per action, they have reinvented the stateless API with extra steps and a much bigger bill.
What I can see about the competitive picture is that the document leaves out the most dangerous players. It compares GrokBot and Muse as if they were alone. They are not. Every major lab is building computer-use agents, every cloud provider is building the primitives — the sandboxes, the secret managers, the policy engines, the egress controls — that these two products assemble by hand. This is the classic infrastructure mistake: selling an application on top of a primitive that the infrastructure layer is about to commoditize. The moment a cloud provider ships a first-class, secure, audited agent runtime with IAM integration, both GrokBot and Muse lose their differentiation on the axis that actually matters. The document's competition is a two-player race. The real race has a dozen runners, several of whom own the substrate everyone else stands on.
What I am guessing — and I want to flag it clearly as a guess, so you can weigh it against everything else — is that the runtime governance layer becomes the locking point. If a Muse-style governance stack becomes the enterprise default, migrating off it will be painful, because policy, audit history, and connector behavior are sticky. Stickiness is where enterprise money is made and where enterprise freedom is lost. A governance layer that is easy to adopt and hard to leave is a very good business and a very bad principle. And here I have to be honest about my own bias: I believe in the principle more than the business. Hold the line. A system that locks your actions to one operator's policy engine is not a sovereign system, no matter how many walls it draws.
And there is a governance question nobody is asking loudly enough: if a persistent agent accumulates your files, your sessions, your tokens, and your history over months, what happens when you try to leave? Can you export your state? Can you delete it completely, including snapshots? Is it encrypted at rest, and with whose key? Does it cross borders depending on where the microVM is scheduled? These are the questions that turn an agent runtime into a compliance liability, and the document addresses none of them. In crypto we learned — slowly, painfully — that data lifecycle is not a footnote. It is the whole audit.
So where does that leave me, and where should it leave you?
I am not going to tell you to fear the agent. I am going to tell you to price the trust. Every persistent agent product you will use in the next two years is selling you a runtime, and a runtime is a place where things accumulate — which means a runtime is a place where trust accumulates, and trust that accumulates is trust that can be lost in a single event. The industry is about to hand every user a hundred small, always-on computers filled with their credentials and their history, and it is going to call this convenience. Some of it will be. The rest will be the largest aggregated attack surface we have ever built, running quietly in our accounts while we sleep. Build anyway. Because the answer is not to refuse the tool. The answer is to demand that the tool draw its walls in the right place.
What I want, and what I will keep pushing for as long as I have this platform, is a runtime whose breaches are survivable. Not a cleverer fire suit. A building designed not to burn down. Scoped credentials this hour, revoked the next. Egress that defaults closed. Action logs that a stranger can re-derive and verify. Governance whose trusted party is replaceable rather than irreplaceable. That is not a security-first versus coordination-first debate. That is the old question, the only question that ever mattered on this ledger: do you hold the keys, or does the room hold them for you?
The document says two products shipped with the same blueprint and different locks. I believe the locks are the entire story, and I believe the industry will spend the next cycle discovering that the expensive part was never the blueprint. It was deciding, honestly, who gets to hold the key — and then having the discipline to make that party disposable. Truth decays slowly. Convenience decays overnight. Hold the line.
