Meta Restricts Staff Access to Muse, but Stronger Privacy Is Still in Testing

Meta has described a way to keep its personnel out of a personal AI agent’s cloud computer. That is not the protection generally available with Muse today. At a September 24, 2026, 15:30 UTC cutoff, Superpower Daily’s comparison of Meta’s public disclosures finds that access to today’s Muse computer is restricted but still possible. A version intended to prevent that access is limited to trusted testers. A separate privacy system for AI glasses remains planned.

What the current Muse boundary does

Muse is rolling out in the United States on phones and the web. Meta assigns each user a dedicated virtual machine, or VM: a cloud computer holding the agent and data for connected services. Within it, the agent runs separately from credential storage and security services. That design limits what the agent itself can reach, even when it encounters untrusted material while working on a task.

A separate gatekeeper called Sentinel controls connected-service actions and requests to the internet. Users choose which services Muse can connect to and, where a service supports it, can give narrower permissions, such as access to read email but not send it. Meta says the agent cannot see stored real credentials. It asks before sensitive actions, including sending an email or making a purchase, though some low-risk or previously permitted actions proceed without another prompt.

Those are controls on the agent, not a cryptographic lock against Meta. The company says staff access to a current Muse VM remains possible to support, secure or operate the service, subject to operational restrictions. Limited data also leaves the VM for model inference—the work needed to generate a response—and telemetry. Meta describes using sanitized records of inference activity for training unless a user opts out. Neither a dedicated VM nor an approval prompt changes those access and data-flow distinctions.

The stronger Muse boundary is still in testing

Meta says Muse Confidential VM will encrypt the whole cloud computer, including conversations and user data, with a key only the user holds. It says this would prevent even Meta from accessing what is inside. The company places the release later in 2026 and says a small group of trusted testers is using it now. That testing is not a rollout to ordinary Muse users.

Meta also plans a publicly inspectable continuous audit when that version launches. One consequential detail remains open in its description: how an encrypted agent computer will handle the outside requests needed for model responses and actions across connected services. The user-held key defines the intended boundary around the VM; it does not, on its own, explain what information an authorized request may send beyond it.

Glasses call for a separate route to the cloud

Meta says glasses can handle some instructions on the device, such as placing a call or answering a text. More demanding AI work needs cloud computing. For that off-device work, Meta has described Private Processing, a design intended to keep personal data inaccessible to the operator while models run in confidential virtual machines. It names streaming transcription, contextual search and long-term recall as workloads the system is designed to support, not as confirmed features already using it.

In Meta’s design, a pair of glasses checks a server’s hardware certificate and compares its running software with a publicly witnessed record before sending personal context. A failed check stops the connection. Anonymous credentials and a third-party relay are meant to make it harder to direct one person’s request to a chosen server. Those checks address who can receive and process a request; they are not part of the protection Meta documents for today’s Muse Secure VM.

Keeping context for later use raises another problem: protecting saved information while still letting the AI search it. When a glasses feature needs that lasting state, Meta’s design calls for encryption with user-provided keys. The queries would run inside the confidential boundary rather than exposing the stored material to an ordinary cloud database. That is a storage design for the proposed glasses path, not a description of how current Muse memory is protected.

A privacy design is not a feature guarantee

Meta says Muse is coming to AI glasses. But its disclosures reviewed at the cutoff do not identify a shipped glasses feature using Private Processing or establish that every future Muse request from glasses will use it. Muse-on-glasses and Private Processing can both be planned for the same device without every agent request taking that protected route. Until Meta connects the design to specific features, the glasses safeguards cannot be treated as a current Muse guarantee.

This comparison rests on Meta’s public product, research and engineering descriptions, not independent tests of implementation or request routing. Its detailed Private Processing whitepaper concerns WhatsApp, so that account cannot prove identical controls are deployed for glasses or Muse Confidential VM. The supported distinction is between a restricted-access Muse rollout, a tester-only encrypted successor and a planned glasses cloud path whose feature coverage remains unconfirmed.