Meta's Private Muse Pitch Leaves Trust Gaps

Meta opened Connect by selling personal superintelligence as a private computer for every user. The centerpiece is Muse, and the security story is a VM wrapper around it.

The pitch is big. The proof is still pending.

On stage, Mark Zuckerberg and Alexander Wang framed the Muse secure VM as extremely advanced and ahead of anyone else in the industry, a private and secure computer assigned to each Muse. Wang said it is free, safe and secure, and the reason personal agents can be delivered to everyone. For what is already shipping, that is the affected system: Muse on phone, desktop and the new Mac app with computer use, plus connectors to Spotify, Plaid, Stripe, Shopify, PayPal, Expedia and Instacart that let the agent act across files, messages, calendar and the web.

The harder promises are not shipped. Meta said it will soon release a Muse Confidential VM so that even Meta will not be able to see that information, and it is building private processing for glasses where nobody, including Meta, can have access to your data for sensitive features like live translation. The company pointed to the same technology it uses to keep AI experiences inside WhatsApp private, but offered no architecture diagram, no attestation flow, no auditor and no code for external review in the keynote.

Glasses got the most concrete privacy controls that exist today. Meta cited the capture light that turns on any time you take or save a photo or video and said it disables capturing if the light gets tampered with. That is a local attacker requirement by design. You need physical access to cover or break the indicator to attempt covert capture, and the device is supposed to refuse. The new claim goes further. Hearing Enhancement turns glasses into an FDA-cleared, over-the-counter hearing aid for perceived mild to moderate hearing loss, tuned via a guided assessment in the app. That expands what the glasses hear and amplify, which makes the private processing promise matter more.

Skepticism is warranted because Meta is asking users to route email, files and purchases through an agent that shops with Link and Shop Pay, drives any Mac app with permission, and will soon get its own email address to act on forwarded threads. Wang said developers filed over fifteen hundred connector applications in less than a week after the platform opened, which widens the trust boundary fast. The keynote did not detail permission scoping, revocation, data retention in the VM, or what happens if a connector is compromised. It did not say whether Confidential VM and private processing will be default, opt in, or limited to specific features at launch.

That leaves a familiar gap between demo and deployment. A secure VM is not automatically a confidential VM, and a promise that Meta cannot see data is different from a system where Meta cryptographically cannot see data and can prove it. Until Meta publishes threat models, independent evaluations and ship dates, the privacy gains live in slides. The event itself ran September 23 to 24 as a virtual livestream (source), and Meta's recap positioned Connect 2026 around Muse getting better with new features, connectors and a state-of-the-art model that brings Muse to life beyond phone and desktop (source). The security half of that story is still to be delivered.