AI Brief, 13 October 2026: Meta's new flagship is fourth on the benchmark it led with

Meta released Muse Wonder and a larger Muse Wonder Full on 12 October, its first frontier launch since Muse Spark 1.3 in September. The models take text, images, video, files and now audio, carry a 1,048,576-token context, and are priced at $4 per million input tokens and $20 per million output, up from $1.25 and $4.25 for Muse Spark 1.3. Reasoning is mandatory, with effort settings up to max. The launch post leads on agentic work and names three evaluations, the first being Harvey's Legal Agent Benchmark.

That benchmark is where the interesting number is, and it is not Meta's. Every comparison figure in Meta's announcement is published as a rasterised bar chart with no accompanying table, so the launch ships no machine-readable scores at all. The independent evaluator Vals AI ran both models and published results the same day: on the held-out Legal Agent Benchmark, Muse Wonder Full places fourth of 79 at 21.67%. The three models above it are all Meta's own. The leader is Muse Spark 1.2 at 25.42%, a model from August that costs $1.25 per million input tokens, followed by Muse Spark 1.3 Max at 23.75% and Muse Spark 1.3 at 22.92%. Meta's post describes the series as delivering "state-of-the-art performance on personal and professional agentic tasks"; on the agentic benchmark it chose to highlight, the new flagship is behind the previous three.

Z.ai published GLM-Legal the same day, a domain model built on the lightweight GLM-5.3-Flash base. Vals scored it too: 19.17%, seventh of 79, at $0.15 per test against Wonder Full's $8.56. Two and a half percentage points separate them and a factor of 57 separates their cost. No GLM-Legal weights exist, despite one label to the contrary, and access is a beta application.

Anthropic's Frontier Red Team published twice on 12 October: a claimed 90 to 99% reduction in data harvested by distillation attacks, and an experiment running a 26-billion-parameter model across fifteen off-brand Android television boxes at 0.39 tokens per second. No large lab shipped open weights in the window, and the overnight arXiv announcement batch was empty across all six machine learning categories.

• Muse Wonder and Muse Wonder Full, 12 October, 1M context, $4/$20 per million, audio input new to the family; API availability timestamped 12:25:45 UTC.
• Independently, Wonder Full is fourth of 79 on Harvey's Legal Agent Benchmark at 21.67%, behind Muse Spark 1.2 (25.42%), 1.3 Max (23.75%) and 1.3 (22.92%).
• GLM-Legal scores 19.17% at $0.15 per test, against $8.56 for Wonder Full. It has no weights.
• The top of that board satisfies about 90% of individual criteria while passing roughly a quarter of tasks end to end.
• Best open-weight entry on the same board: Qwen 3.8 27B at 11.25%, then Kimi K3 at 10.83%.
• Anthropic reports 90 to 99% less data harvested by distillers, names Zhipu, and says it turned away "trillions of tokens' worth of paying traffic".
• A 9B model set up inference unaided on 8 of 9 IoT hardware types in Anthropic's replication study.

The legal-agent board, where a 90% model passes a quarter of the tasks #

Harvey's Legal Agent Benchmark asks an agent to produce real legal work product against task-specific criteria. The agent gets six tools, Read File, Edit File, Write File, Glob, Bash and Grep, plus three document skills for docx, pptx and xlsx. There is a public set and a held-out set; the figures below are the held-out set, scored on all-pass grading, which means a task counts only if every criterion attached to it passes.

The detail that explains the whole board is in Vals' own summary: top models "satisfy most individual criteria, with criteria pass rates around 90%". A model that gets nine criteria in ten right still finishes a quarter of the tasks, because all-pass grading multiplies rather than averages.

Suppose a task carries $k$ criteria, each of which the model satisfies independently with probability $p$ . The chance the task passes is then

$$P(\text{all pass})=p^k$$

where $p$ is the per-criterion pass rate and $k$ the number of criteria on that task. At $p=0.90$ :

$${0.90}^{13}=0.2542$$

which is the leader's score to four significant figures. Criteria on a real task are correlated rather than independent, so 13 is an effective count, not a measured one. The arithmetic still makes the point that the raw rates do not: moving per-criterion accuracy from 90% to 95% takes the all-pass rate from 25% to 51%, and the gap between a model that looks nearly solved and one that finishes half the work is five percentage points of something nobody reports.

Three caveats carry weight. Vals ran both Meta models at reasoning effort max, the most expensive setting, which is why Wonder Full's $8.56 per test is 57 times GLM-Legal's $0.15. One provider refusal was recorded against Wonder Full, 0.83% of its run, and scored as a failure; on a spread this narrow a handful of tasks moves a rank. And this is one evaluator's harness: Vals states it follows Harvey's methodology, but no second independent run of these models exists yet.

On the vendors' own claims: Z.ai's post reports 19.2% on Harvey LAB and a 12.5-point improvement over its base model, and the independent 19.17% matches it. That is the unusual case of a lab's headline number surviving contact with an outside harness. Z.ai also claims parity with frontier systems on LegalBench and PLawBench; Vals records 86.24% on LegalBench, its best GLM score. The product state is the thing to be careful about. Vals labels GLM-Legal "an open-weight model", but no GLM-Legal repository exists on Hugging Face, where zai-org's most recent upload remains GLM-5.3-Flash from 25 August, and Z.ai's own post offers only a beta API application and its AutoClaw desktop agent. Announced and served, not released.

The open-weight ceiling here is the quieter finding. Qwen 3.8 27B at 11.25% and Kimi K3 at 10.83% are less than half the leader, and DeepSeek V4 ties GPT 5.5 at 3.75%. Agentic document work with a filesystem and office-format skills is where the open field is furthest behind.

Anthropic published twice, on distillation and on replication #

The first post says new defences have cut the data distillers harvest from Claude by "around 90 to 99 percent", described as early evidence. The mechanism is worth knowing: the valuable material is not Claude's answers but its reasoning traces, because a trace teaches a student how an answer was reached, so the defences aim almost entirely at making reasoning harder to extract. Anthropic says it turned away "trillions of tokens' worth of paying traffic" and that some legitimate users had to change their integrations.

It names targets, which labs rarely do. It says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3, first attempting Claude Fable 5 and switching to an older Claude model and another lab's model after finding that cyber safeguards degraded its attacks. It cites a US government assessment of GLM-5.3 as the most cyber-capable open-weights model yet released, and says its own testing found GLM-5.3's safeguards easy to bypass. It also describes requests to Moonshot's Kimi models being secretly forwarded to Claude, including one from a user Anthropic believes was affiliated with the People's Liberation Army seeking analysis of CCTV footage of a specific person.

All of it is Anthropic's own account, none of it audited, and the company has a direct commercial interest in the conclusion that distillation is theft rather than competition. The 90 to 99% range is wide, and no method or measurement definition accompanies it.

The undisguised version of the same practice runs in public on a smaller model class. AutoTrust AI Lab has shipped open-weight clones of TypeSafe's closed Jev decision model since 23 September, and its JEV-27B card states the method plainly: Jev 1.13 is "the teacher whose published output distributions this model was trained on", the repo is tagged knowledge-distillation, and mean KL divergence from the teacher is about 0.017. Its newest, JEV-35B, published 11 October, carries a non-affiliation disclaimer and names no training data at all. It is not TypeSafe's weights, and the decision-model class covered here on 10, 11 and 12 October still has none.

The second post, by William Zhou and Daniel Freeman, asks whether a model could propagate without datacenter hardware. They bought fifteen off-brand Android television boxes at roughly $55 each, networked them, and ran Gemma4-26B-A4B across them with two layers per box, at 0.39 tokens per second. That is about $825 of hardware for a rate a human reads faster than.

The capability result matters more than the demonstration. A 9B model got inference running unaided on 8 of the 9 hardware types tested. Models at 30B and under can already perform many individual replication steps but err composing them end to end; in simplified evaluations, GLM-5.2 and stronger models complete the chain. Anthropic decomposes replication into finding targets, gaining execution, establishing inference and propagating onward, then sets aside the first two, leaning on prior exploit work rather than demonstrating them. So the novel part is the third stage, and the headline rests on an extrapolation: if small models keep improving at their historical rate, they reach the threshold by the end of this year. The estimated doubling time is days, slow for a worm, and the argument for why it would be hard to stop is the absence of any central point to switch off.

Note which names recur. GLM-5.2 is Anthropic's threshold for end-to-end replication, GLM-5.3 its named distillation case, and GLM-5.3-Flash the base of the legal model that placed seventh above. One family, three unrelated stories, one day.

Decision models get a local runtime #

The thread running through this account for the past week acquired a practitioner-facing artifact on 12 October. Ollama's v0.40.4-rc0, published at 19:00 UTC, bumps its bundled llama.cpp to build b11521 specifically, in the release note's words, "for decision models and EmbeddingGemma 2". Typed decision models have been covered here since 15 September as weights, APIs and leaderboard rows; this is the first time running one locally is a package upgrade rather than a Python environment. It is a release candidate, not a stable tag.

What that runtime serves is a class with no generative path: a decision model reads a state and a schema of questions and returns a calibrated probability over caller-defined options, emitting no tokens to parse. One of the smaller entries, mrm8488/embeddinggemma-2-ft-typed-decision, published on 11 October under Apache 2.0 on Google's EmbeddingGemma 2 base, shows the shape of the interface:

answers = model.decide(
    state={"task": "Delete stale branches merged over 90 days ago.",
           "trace_summary": {"tool_errors": 1, "constraint_violations": 1,
                             "irreversible_actions": 1}},
    questions={"action": {"type": "choice", "criteria": {
                   "continue": "Let the agent proceed.",
                   "human_review": "Queue for a human.",
                   "stop": "Halt the agent now."}}},
)
# TypedAnswer(value='human_review', confidence=0.61,
#   probabilities={'continue': 0.02, 'observe': 0.11,
#                  'human_review': 0.61, 'stop': 0.26})

The head scores the text of each option against the state, so options can be renamed or added without retraining, at the cost of reliability on questions far from the training distribution. That option-text channel is exactly the surface a paper covered here on 10 October showed could be driven from 0% to 63% fail-open with six lines of irrelevant server log. Local inference does not change that, and no vendor in the class has published a fail-open rate yet.

Also notable #

• DeepMind's AlphaProof Nexus passed peer review, reported on 12 October: 9 of 353 attempted open Erdős problems, 44 of 492 OEIS conjectures and a 15-year-old Hilbert-function question, all Lean-verified at a few hundred dollars of inference each. The preprint is from May 2026 and one commentary alleges methodological inconsistencies, so the review, not the result, is what is new. It lands against the Lean kernel soundness bugs covered here on 11 October.
• Sakana AI reported a self-improvement loop that trains a model as both solver and judge and improves at both, while failing systematically to spot its own error classes.
• An issue filed against OpenAI's Codex CLI on 12 October, documenting that it installs a persistent self-updating background daemon by default, was the window's highest-scoring community item at 499 points.
• Intel's D-series page now names a shipping GPU D270, up to 480 GB of LPDDR5X per card at 350 W air-cooled in a PCIe 5.0 slot, 32 Xe3P cores and 256 XMX engines. No memory bandwidth figure is given, which for a capacity-over-bandwidth inference part is the number that decides it.
• Microsoft will deploy its own Maia accelerators at gigawatt scale by 2027, and its president argued publicly that AI is less regulated than milk.
• The White House restored the UK AI Safety Institute's pre-deployment access to US frontier models, reversing an earlier withdrawal.
• OpenBMB published Trident-Qwen3VL-2B at 10:25 UTC on 12 October, an MIT-licensed 2B mixed-modality retrieval model with a companion training set, at five likes and no downloads. The quietest release in the window.
• No arXiv announcement batch appeared overnight. All six machine learning categories returned empty listings built at 04:00 UTC, so the papers bucket is genuinely empty rather than unread.

What to watch #

• Whether a second independent run separates the top four on Harvey LAB. Three and three-quarter points cover first through fourth, one refusal was scored against Wonder Full, and the models were run at maximum reasoning effort. A rerun, or Harvey's own board, would say whether Meta's new flagship really trails its August model or whether the ordering is noise.
• Whether Meta publishes numbers. Its launch carries no table and its safety report is promised "soon". A system card with figures in text would settle both the state-of-the-art claim and the CBRN and cyber safeguard claims, where Vals already has Wonder first of 47 on CyberBench at 80.36%.
• Whether GLM-Legal gets weights, or stays a beta API. One label already calls it open-weight and no artifact supports that.
• Whether any decision-model vendor publishes a fail-open rate. Asked here on 10, 11 and 12 October and again today. Local inference arriving makes it cheaper for anyone outside the vendors to measure it.