On 23 September Meta said it is bringing Private Processing to its AI glasses “to deliver rich AI experiences without anyone, including Meta, seeing your data” (Meta newsroom). It is a sentence built to survive a keynote clip. I wanted to know what it has to survive on paper, so I read the documents it points to.
Meta’s engineering post from the same day gives the outline. The glasses send some requests to Meta’s servers, where they run inside confidential virtual machines, hardware-isolated environments meant to keep the operator out. Before the glasses send anything, they check the environment’s measurements against a public, append-only ledger of the software Meta has deployed, using remote attestation. If the hashes or the chip vendors’ certificates don’t match, the connection fails. Meta adds that the corresponding binaries are available to researchers in its security program under agreement, that its bug bounty now covers the system, and that it works with outside firms “like NCC Group” to audit the design. On the question of what the design defends against, the post says the “foundational threat model” is in the Private Processing whitepaper.
That whitepaper is a WhatsApp document. It was first published in June 2025 and updated on 16 March 2026, six months before the glasses post, and in the text I read the word “glasses” does not appear. Given the dates that is unsurprising, but it means the glasses threat model is inherited by reference, and as far as I could find it is not written down anywhere for the glasses themselves.
the paper trail is about another app
Lay the dated documents on a line and the shape is plain. Meta’s engineering post on WhatsApp Private Processing came out on 29 April 2025, the whitepaper on 10 June 2025, and NCC Group’s public report on 27 August 2025. The whitepaper’s second version followed on 16 March 2026. The glasses have one post, on 23 September 2026, which arrives 191 days after the second whitepaper version and 392 days after the audit report (my arithmetic from those dates).
what the fine print says
The whitepaper names the actors the design is meant to stop: malicious insiders, third-party or supply-chain vendors, and malicious end users. It is direct about limits too. One it declares out of scope outright: “Defeating this attestation method would require collusion with our hardware vendors and is therefore out of scope.” Two more it hedges. It notes that AMD treats certain classes of vulnerability, side-channel attacks such as Prime and Probe the most prominent, as out of scope for the confidential-computing feature Meta uses on the CPU side, and says compensating controls can address them. And it lists physical host attacks as a threat scenario with mitigations, while conceding that defending against physical access adds significant complexity and attack surface.
The most useful reading is the outside auditor’s. NCC Group spent 115 person-days on the WhatsApp message-summarization service in the first half of 2025 and published a public report in August. It logged 21 findings: 16 fixed, four where Meta accepted the risk, and one low-severity finding left unfixed. That is a published audit with a findings count. Two of the fixed findings show what an attestation check alone does not cover. The confidential VM initialized network interfaces it did not need, and a missing freshness check would have let an older, vulnerable image be reused. A hash on the ledger proves a build was registered, not that it is the current one.
The report also says what “private” rests on. Users must trust Meta “to not insert any malicious behavior in artifacts that are not open source,” to guard its signing keys tightly, and not to collude with Cloudflare or Fastly, the two outside parties in the design. NCC’s account of what would close the gap runs to a single line: fully verifiable transparency would need every file and binary to be open source and covered by attestation.
what “even Meta” means once you read it
Put together, “without anyone, including Meta” is a claim about a design in which Meta’s own staff and ordinary infrastructure cannot read your data, assuming the ledger describes what is running and the chip vendors behave. Whether the ledger describes what is running is checkable, but only by whoever can read what a hash points to, and for the glasses Meta says that means researchers who have signed an agreement. That is a reasonable arrangement. It is also a smaller thing than the sentence in the announcement.
what I could not find
Here is what I looked for and did not find. Absence from what I could read is not proof that it does not exist. I found no threat model written for the glasses, no published audit of the glasses deployment with a findings count like NCC’s, and no treatment of camera frames, as opposed to the workloads the engineering post names for offloading: streaming transcription, contextual search and long-term recall. I also found no date, default setting or opt-in rule for the mode. “Like NCC Group” is not the same sentence as “NCC Group audited this.”
a different layer in the same week
The week brought two Muse security stories, and the first is easy to conflate with this one. Two developers, Peter James and Jonny Saunders, each got Muse to hand over the contents of its root filesystem, and a Meta spokesperson answered that exporting files from a virtual machine gives no privileged access to Meta’s infrastructure or to anyone else’s data (The Verge). That episode concerns the assistant’s own environment, which Meta says is a persistent Linux virtual machine for each user. It says nothing, in either direction, about the attested path the glasses promise covers. The Verge also reports a second Muse vulnerability that week, an exploit from the researcher Patrick Wardle that let attackers hijack the agent and redirect transcription processing, which Meta fixed with a hotfix. I have not seen enough detail on that one to say which layer it touched. There are at least two boundaries in play: what the assistant can see about you, and what Meta can see. The announcement’s sentence is about the second.
how these labels get tested
In April 2020 Citizen Lab examined Zoom, whose app described meetings as end-to-end encrypted. The researchers found a single AES-128 key used in ECB mode for every participant, delivered from a Zoom server that appeared to be in Beijing (Citizen Lab). The label was testable because someone could watch the protocol. “Private processing” is the same kind of label with a better-engineered design behind it, and the ledger gives outsiders something to check. Who those outsiders are, and what they may publish, are the parts I could not find spelled out for the glasses. I made a similar point about a different label in the Super Intelligence essay: a new name changes what people hear, not what is in force.
So I read the glasses promise as a design with a public ledger and one published audit, of a different product. The number I would wait for is a findings count on the glasses deployment.
References
- Meta (2026). Your Personal Agent Coming to AI Glasses. Meta newsroom, 23 September 2026.
- Meta (2026). Bringing Private Processing to Meta AI Glasses. Engineering at Meta, 23 September 2026.
- Meta (2025). Building Private Processing for AI tools on WhatsApp. Engineering at Meta, 29 April 2025.
- Meta (2026). Private Processing for WhatsApp Overview: Technical White Paper and Security Guide. Version 1 published 10 June 2025; version 2 updated 16 March 2026.
- NCC Group (2025). Public Report: Meta Platforms WhatsApp Message Summarization Service. Published 27 August 2025 (the report’s cover is dated 26 August 2025).
- O’Brien, T. (2026). Muse will apparently let you download its entire filesystem. The Verge, 24 September 2026.
- Marczak, B. & Scott-Railton, J. (2020). Move Fast and Roll Your Own Crypto: A Quick Look at the Confidentiality of Zoom Meetings. The Citizen Lab, 3 April 2020.