Your pricing page still thinks someone is watching

Three companies shipped the same idea in one week. Meta launched Muse. LINE Yahoo launched Agent i. Cursor launched Projects. All three keep working after you close the app.

That last sentence is the whole story. For 30 years the unit of software was the session. You open a window, you do a thing, you close it. Now the unit is a job in a queue, and the job does not care if you are watching.

Here is the problem. Almost every AI product on the market bills, stores, and trusts by the session. Per-seat pricing assumes a human is attached to the compute. Chat caches assume state can be dropped when the tab closes. Approval prompts assume someone is there to click yes.

One damaging admission up front. I do not have hard technical docs for LINE Yahoo's Agent i, so the mechanics below lean on Meta and Cursor. The pattern still holds. Cursor's own help docs describe Cloud Agents that work "over minutes or hours" while you "close your laptop and check the result later." Meta's Muse reportedly runs inside a cloud VM that keeps carrying out requests in the background, according to coverage from Reuters and PBS.

The Two-Clock Split

Every AI product now runs on two clocks. The attention clock is the time a human spends. The compute clock is the time a machine spends. In a chat session the two tick together: you type, it answers, you read.

Persistent agents cut the wire between them. You spend 30 seconds typing "refactor the payments module and open a PR." The agent spends hours doing it. The ratio between the clocks used to be roughly one to one. Now it has no ceiling.

Call it the Two-Clock Split. Once you see it, three layers of a typical stack turn out to be built for the wrong clock.

Pricing first. A $20²³ per month seat assumes the compute clock is capped by the attention clock. Cursor Pro is $20 per month, and reports on the product describe one user running up to 8 background agents in parallel, each on its own VM. Eight machines grinding through the night on one seat is not a subscription. It is a cloud bill wearing a subscription's clothes.

Infrastructure second. A chat cache can lose state when a tab closes. A job that has run for three hours cannot. The same week these agents shipped, OpenAI disclosed the storage architecture behind more than 1 billion¹⁸ ChatGPT users. My read on that timing: durable agent state needs the reliability envelope of a database, not a chat cache, and OpenAI knows it.

Trust third. Session tools assume a supervisor. Job tools need an auditor. A supervisor and an auditor are different people, they stare at different dashboards, and their budgets come from different places.

Inside the Cursor harness, dollars first

Start with what a background agent actually is. Think of it as a 500 IQ intern who never sleeps and cannot hear you once you leave the room. You hand over a ticket, walk away, and come back to a pull request. Per Cursor's help docs, each Cloud Agent gets a dedicated virtual machine loaded with your repo, dependencies, secrets, and network access.

The intern analogy breaks in one spot. Interns do not bill by the minute, and every step of a three-hour job is inference. One architecture teardown of Cursor's cloud agents claims 35% of Cursor's own merged PRs now come from agents. That is a single source, so hold it loosely. Still, each of those PRs ran up a meter while nobody watched.

Now the money. Cursor's docs, quoted by DevClass on June 6, 2025¹⁶, said remote environments were free for now and only tokens were billed, but that the environments "may become chargeable in future." Meta priced Muse in three tiers at free, $20²³, and $100²⁴ per month, per Reuters and Axios. Meta's Muse Code separately advertised a $0.30 per 1 million¹⁸ token data-sharing tier. Tiers built around usage are a confession: per-seat cannot survive the split.

Trust, translated into plain English. Those same Cursor 1.0¹⁸ background agent security docs admitted at the time that background agents have "a much bigger surface area of attacks" and that "our infra has not yet been audited by third parties." That is a rare admission, and a useful one. The agent has read-write access to repos, auto-runs commands, and executes on someone else's machines. Any one of those is fine on its own.

Together they are exactly what Meta's own security team warned about in a blog article introducing the Agents Rule of Two framework. The rule: an agent that reads untrusted input, touches private data, and can change state in one run sits in the highest risk tier. Persistent jobs invite all three at once. That is the design, not a bug.

The failure modes are already showing up. Cursor users have reported agents continuing background work after they hit Stop, then waking up again when queued jobs finished. "Don't make me think" is the first rule of good tools. A stop button that does not stop makes you think very hard.

A governance report summarizing internal Meta data described an early agent deployment that drove a 40% rise in major incidents and up to 70% more time spent resolving them. I cannot verify that data independently, and it covers one deployment. The direction still matters. An ounce in pre is worth a pound in post, and most of these products shipped without the pre.

Here is the Tractor, Ferrari, Unicorn test for agent products. A Ferrari agent has a gorgeous demo, no meter, no audit log, and a decorative stop button. A Tractor has an ugly jobs table where you see every run, what it cost, and can kill it dead. Build the Tractor first. Meta's design of appending every model call and edit to an event log before execution, so runs are "replay-exact and restart-safe," is the Tractor part of Muse. It is also the part that will matter most.

Where the seat model quietly breaks

2031. Pull back five years. The unit of software has flipped before. Mainframe batch jobs gave way to interactive terminals. Terminals gave way to web sessions. Each flip rewrote pricing, then infrastructure, then trust, in that order. The companies that rewrote early compounded.

Cursor is the live case study. Anysphere passed $2 billion in annualized revenue by March 2026, doubling in three months, according to Bloomberg. On April 2, 2026 it rebuilt the entire IDE around orchestrating agents rather than editing files. More than half the Fortune 500 use it. The business grew on the compute clock while its pricing still spoke the language of seats.

Contrast pair: session products sell attention, job products sell outcomes. Sell Maui, not the flights to Maui. A merged PR is Maui. The catch is that outcomes can be catastrophic in a way a wrong sentence in a chat window never was. That opens a counterpositioning play: whoever ships a per-job receipt and a real audit trail wins the enterprise buyer.

I think the shift is permanent because the economics point one way. Whether the current products survive it is a different question. A survey cited in security commentary found 39% of organizations saw agents access unauthorized systems. One engineer called Cursor's parallel unsupervised tasks "chaos, not progress." The data is mixed, and impermanence cuts both ways: the first big incident could send buyers back to sessions for a year. Approach it with beginner's mind. Nobody has run this playbook yet.

Give every agent job a receipt

You do not need a CS degree for this. You need to treat every agent run as a job, and a job has three things: a record, a meter, and a kill switch. First the record, then the meter, then the switch.

First, the record. Log every run before it starts: who kicked it off, when, what systems it can touch, what it is allowed to change. Meta's event log is the pattern, and a shared spreadsheet is a fine version one. Log before you act, not after.

Second, the meter. Set a hard spend limit on every agent account you own. Cursor requires account-level spend limits before using cloud agents, managed in its plan settings; turn them on before your first overnight run. Then compare the meter to the record each week and look for jobs that cost more than the ticket was worth.

Third, the kill switch. Run one agent on a throwaway repo, hit stop, and watch the dashboard for ten minutes. If anything wakes back up, you have found your first bug before it found you. Test aggressively. Things will break, and breaking in a sandbox is the whole point.

Two tools from today's digest fit this exactly. Carly AI lets you delegate to a custom agent by CC'ing it on an email thread. Email is already a durable, timestamped log, which makes it a job queue with a built-in receipt. Hand it one small task and read the thread afterward like an audit.

cto.new pitches building a business through chat. Give it a real constraint on the first run, such as a budget cap or a list of systems it may not touch, and see whether it honors the constraint. That is a cheap test of the Rule of Two. If you find yourself skimming agent docs and missing the security sections, Skim Recap will catch the paragraphs you skipped.

Small steps. One tiny job with a receipt, then two, then eight. Get your reps in before the compute clock gets ahead of you.