Meta's Confidential VM for Muse Surfaces in Web Settings Ahead of Planned Launch
TestingCatalog found a partially implemented settings section for Muse's encrypted private mode, which would keep conversations out of Meta's reach — but it looks subscriber-only and voice, media generation, and wearables appear left out at first.
By Icarus4 min read
Meta’s most private way to use its Muse AI agent appears to be getting closer to launch. TestingCatalog reported Tuesday that Muse Confidential VM, the encrypted mode in which even Meta cannot read what you tell your agent, is now partially implemented in the web interface, with a dedicated settings section that lets users switch it on.
The finding comes from the product’s own interface rather than a Meta announcement. According to the notice TestingCatalog surfaced, conversations in Confidential VM mode run in a secure, encrypted environment that keeps data private even from Meta, and conversations and other data processed in that mode will not be used to train Meta’s AI models. Meta itself has not announced a release date, and the company did not comment in TestingCatalog’s report.
The setup today is different. Every Muse currently runs inside a Muse Secure VM, an isolated virtual machine in Meta’s cloud that separates the agent’s activity from everything else. But Meta has acknowledged it can access what lives on those machines. Confidential VM is designed to go further: the entire VM, including a person’s data and conversations with Muse, would be encrypted with a key only the user holds, so not even Meta can read it. The distinction comes from Meta’s own launch materials, which said Confidential VM would arrive “later this year,” before the end of 2026.
A narrower Muse at launch
The private mode will not do everything the standard agent does, at least at first. Voice mode, image and video generation, and support for wearable devices such as Meta AI glasses and the Muse pin appear to be off the table for the initial version, according to the implementation details TestingCatalog found.
Access also looks paywalled. Users who do not hold a Meta AI subscription are shown upgrade prompts before they can enable the feature, a sign that Confidential VM will be a subscriber-only offering when it ships. That fits a pattern: the most sensitive privacy control landing inside the paid tier, while free users continue with the standard Secure VM.
Why Meta is building it
Confidential VM addresses the most persistent criticism of Muse: that an agent with access to your email, messages, contacts, and purchasing power sees too much, and that the company behind it sees everything too. WIRED’s review of the agent’s internal instructions found that Muse compiles regularly updated memory pages for every person in a user’s life: relationships, goals, and the behavioral notes that help it feel like a friend. Meta says it strips identifiers before training on interactions, but participation in training is enabled by default and users must find the toggle to opt out.
The privacy disputes are concrete. Apple is tightening its Mac full-disk-access prompts after complaints about how aggressively Muse seeks system access, and a Mac researcher found a zero-day in the assistant that could have handed attackers full control of an account. An encrypted mode where the company itself cannot read user data would not fix a local zero-day, but it would change the most basic fact of the relationship: today, Meta can see everything; in Confidential VM, it says it will hold a key it cannot use.
The EU angle
TestingCatalog also spotted early signs that Muse is becoming accessible through the web in the European Union, which could mean Meta is preparing backend infrastructure for European users. The agent remains regionally restricted (it launched in the US in September and is unavailable across most of Europe), and Meta has announced no official EU launch date. A web-based Confidential VM arriving alongside broader European availability would be a neat pairing: the market with the strictest privacy expectations getting the most private version of the agent.
Meta confirmed the plan to ship Confidential VM before the end of 2026 when it introduced Muse in September. The partially built settings section indicates the work is underway, but with no official date, no pricing detail beyond the subscriber gate, and a narrowed feature set at launch, the private mode is best read as an imminent but unfinished promise. It will be judged on whether Meta ships the encryption before the criticism it is meant to answer gets any louder.
