Meta puts glasses AI inside confidential VMs the hypervisor can only read as ciphertext

The handshake decides whether anything else runs. Meta's client asks for a remote attestation report signed by a key that exists only inside that chip, and the report carries a measurement of the software image the CVM loaded ^[13]. Then it runs two checks: the signature has to chain back to a root key the chip vendor publishes, and the measurement has to match one Meta published to an append-only ledger witnessed by an independent third party ^[14]. A new model image means a new measurement, and the measurement has to be in that ledger before glasses will talk to the machines running it. Rollback has the same property.

Size carries part of the cloud tier. Meta says features beyond the on-device set need models much larger than a pair of glasses can hold ^[2], while placing a call and answering a text hands-free already run entirely on the device ^[1]. The post does not include a parameter count or a memory budget for the model that will not fit ^[18], so the size claim is an assertion about Meta's own roadmap. State carries the rest. The assistant has to understand context, connect ideas across days or weeks, and work proactively in the background ^[3], and Meta says those demands taken together mean the work has to happen in the cloud ^[4]. Storing weeks of context in a data centre is one way to build a background assistant, and the post presents it as following from the compute limit.

The gap being closed is data in use. At rest and in transit were already encrypted; computation required plaintext in memory, exposed to the host operating system, the hypervisor and the infrastructure operator ^[8]. Meta says the capability covers host CPUs and GPUs, so a workload that needs both stays inside the trust boundary across them ^[11]. An inference path that had to leave the CVM to reach an accelerator would hand the plaintext back to the host. The Confidential Computing Consortium's third guarantee is code integrity, meaning no one can modify the code executing inside the CVM once it has loaded ^[12].

Meta shipped this pattern before the glasses. Private Processing went out for WhatsApp and the Meta AI app in 2025, and Meta says it learned from that initial approach and is expanding it ^[6]. The infrastructure is described as built on TEEs with verifiable transparency, adding properties on top of the confidentiality and attestation the hardware provides ^[16]. Mark Zuckerberg wrote in "Personal Superintelligence" in July 2025 that personal devices like glasses "can see what we see, hear what we hear, and interact with us throughout the day" and "will become our primary computing devices" ^[7].