What's this about?
Files and credentials live in each user's VM and are not shared with Meta's ad systems, but Meta can access data when needed to operate or secure the service. Sanitized trajectories may train models by default unless the user opts out; a confidential VM intended to make Meta access cryptographically impossible is planned later this year.
What exactly is a “confidential VM”?
It uses hardware-backed encryption and attestations so even the cloud operator should not be able to read the running workload. Today's ordinary isolation limits access through policy and software; confidential computing aims to make that limitation technically verifiable.
Why is this worth noting?
A personal agent sees unusually sensitive context. The launch architecture is materially safer than handing a model raw passwords, but “stored in your VM” is not the same as “Meta cannot access it,” and users should make that distinction consciously.