Meta Brings Private Processing to Its AI Glasses

Meta has brought Private Processing — its confidential-computing infrastructure for AI workloads — to Meta AI glasses, engineers Pritam Shah and Oskar Linde detail in a blog post published on September 23, 2026.

It first shipped in 2025 for WhatsApp and the Meta AI app. Glasses are a harder case: features like streaming transcription, contextual search or recall across weeks need models far larger than the frame can host, and the assistant must keep personal context over time.

Clouds conventionally encrypt data at rest and in transit, but must decrypt it in memory to compute on it, exposing it to the host system and the infrastructure operator. Private Processing closes that third state — data in use — by running models in confidential virtual machines (CVMs) whose memory the chip encrypts.

Inside the trust boundary

The foundation is the Trusted Execution Environment (TEE), a hardware capability of certain CPUs and GPUs. A CVM's memory is encrypted under a key held by security hardware on the chip and never released to the host system. Meta cites the Confidential Computing Consortium's three guarantees: confidentiality, integrity and code integrity.

Before sending anything, the glasses request a remote attestation report signed by a key that exists only inside the chip. They check that the signature chains to the chip vendor's root key and that the measured software image matches an entry in a public, append-only ledger. If a check fails, nothing is sent.

Anonymous routing and encrypted memory

Sessions begin with blind-signed anonymous credentials, so authentication cannot tie a request to an account, and traffic passes through a third-party OHTTP relay — Fastly or Cloudflare — before reaching a TEE node chosen without identifying the user. Results that must persist are encrypted with user-provided keys before leaving the TEE, and the storage engine runs inside the boundary too, because an external database would leak behaviour through access patterns alone.

From transparency to agentic AI

Because operators cannot look inside, engineers can attach no debugger and log no model inputs or outputs during a fault; observability relies on aggregate signals such as CPU utilization, memory allocation, network latency and hardware failure rates.

Every CVM image used in production is registered in a public ledger, creating tamper-evidence, and the binaries are available to researchers for audits alongside firms such as NCC Group. Meta is also widening its bug bounty to cover Private Processing on AI glasses.

Meta frames the work as groundwork for assistants that act across sessions and modalities, where machines must attest to one another. Capabilities will grow, but the privacy boundary, Meta says, stays intact.