Meta shipped its first frontier models and kept the stronger one out of its API

Meta Superintelligence Labs released Muse Wonder and Muse Wonder Full, its first frontier models, with the stronger checkpoint available only to Muse Code subscribers rather than through the API. Anthropic published the numbers behind a year of anti-distillation work — reasoning tokens reaching distillers down 10 to 100 fold — and named Zhipu and Moonshot as the actors, on the same day Zhipu shipped a legal model built on the GLM-5.3 family. Nvidia contributed its Vera Rubin rack and tray designs to the Open Compute Project and Intel launched an inference GPU that trades HBM for up to 480GB of LPDDR5X.

Model Releases #

Muse Wonder Full scores 56 on Artificial Analysis’s Intelligence Index, and is not available through Meta’s API #

Meta / Artificial Analysis / TechCrunch

Muse Wonder and Muse Wonder Full are the first frontier-class models out of Meta Superintelligence Labs since Alexandr Wang’s August 2025 reorganisation, trained at Meta’s Prometheus data centre in Ohio and pitched at agentic work — Meta’s examples are navigating an insurance claim, reading a lease, building a working app. Artificial Analysis puts Wonder Full third on its Intelligence Index at 56 at maximum reasoning effort, ahead of GPT-6 Astra and Gemini 4 Argon tied at 53 and behind Claude Opus 5.5 at 58, an 8-point gain over Muse Spark 1.3 with the largest movement in agentic evaluations: Terminal-Bench 4.0 from 33% to 57%, GDPval-AA v2.1 from 1681 to 1857 Elo, AA-Briefcase from 1581 to 1729 Elo. Meta is marketing two capabilities by name — Active Memory, carrying context across sessions, and Active Focus, continuing to work a task through errors instead of drifting — and claims it leads Fable, Opus and Astra on MemoryBench. Muse Wonder is $4 per million input tokens and $20 per million output through the Meta Model API.

The access split is the part to plan around. Wonder Full, the model that earns the benchmark position, is not served through the API at all; it requires a Muse Code subscription from $50 a month, so the checkpoint Meta is competing with is one you cannot build on and the one you can build on scores 52. Meta’s own announcement carries no parameter counts, no context window, no benchmark table and no licence statement, which means every number above comes from a third-party evaluator or from press briefings rather than from a model card.

GLM-Legal reaches a 19.2% all-pass rate on Harvey LAB, 12.5 points above its base model, with no public endpoint #

Z.ai / Hacker News (576 points) / MarkTechPost

Z.ai built GLM-Legal on GLM-5.3-Flash, its 320B-total, 18B-active multimodal foundation model with a 1M-token context window, and trained it for agentic legal work — contract review, evidence analysis, compliance. The headline number is a 19.2% all-pass rate on Harvey LAB, a law-firm workflow evaluation built by the legal-AI vendor Harvey spanning 24 practice areas, which Z.ai reports as a 12.5 percentage-point lift over the base model and which places it seventh of 79 entries, a fraction behind Gemini 4 Argon at 19.58%. Training ran in stages: legal mid-training on an expanded corpus, reinforcement learning across tens of thousands of simulated legal environments where the agent and its orchestration layer were developed together, then production feedback converting lawyer evaluations into training signal.

Two caveats carry most of the weight here. Every measurement is Z.ai’s own and none is independently verified; the claimed parity on LegalBench and PLawBench comes with no scores attached. And this is not a release you can use — access is an application form for design partners, there is no published price and no public endpoint, with the model reachable only inside AutoClaw, Z.ai’s desktop agent, which hands out $24 of credits at signup. Some coverage has described it as open-weight; nothing in the announcement supports that, and an all-pass rate near the frontier on a 24-practice-area benchmark is exactly the claim that needs weights or an endpoint before anyone can check it.

Security #

Anthropic says distillation defences cut extracted reasoning tokens 10 to 100 fold, and names Zhipu and Moonshot #

Anthropic

The post describes three layers. Preserved thinking, shipped with Claude Fable 5.1 and Opus 5.5, stops API accounts created on or after 31 August 2026 from editing Claude’s prior context, which breaks the pattern of using proxy networks to reassemble protected reasoning across many accounts. A two-stage classifier, built on the same Constitutional-AI machinery used for bio and cyber misuse and trained on transcripts of real distillation attempts, now covers Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1 at a reported false-positive rate below 0.1%. Accounts showing distillation patterns get tighter rate limits and then bans, often within two hours of a campaign being detected, and since 24 September Anthropic bills for blocked requests in high-confidence abuse categories. The measured effect is that reasoning tokens reaching distillers run 10 to 100 times lower than before, immeasurable on some days, with tens of thousands of accounts banned. Anthropic names Zhipu, in connection with GLM-5.3, and Moonshot’s Kimi, and cites a PLA-affiliated user requesting surveillance analysis.

The naming is the departure. Labs have discussed distillation as a category for two years; attributing it to specific named competitors in a research post, with a specific model release attached, converts it into a commercial accusation that the other party can answer — and Zhipu shipped GLM-Legal on the GLM-5.3 family the same day. For anyone building on the API, the operational detail is preserved thinking: it is a behavioural change to context handling that Anthropic acknowledges broke integrations for legitimate users, and the 90-99% figure that led most coverage is a reduction in what attackers harvest, not a claim about model security in any broader sense. Every number is Anthropic’s own measurement of attacks against its own systems.

Infrastructure #

Nvidia put its Vera Rubin rack and tray designs into OCP, and Meta is building its Vera Rubin factory on Spectrum-6 Ethernet #

NVIDIA

At the Open Compute Project Global Summit in San Jose, Nvidia contributed the Vera Rubin rack and compute tray designs through its MGX architecture, plus a Vera CPU rack specification that extends MGX past accelerated computing. MGX 1.2 supports rack deployments up to 250kW and adds rack-scale blind-mate liquid cooling using the open MQD and MQDB couplings, a liquid-cooled 5,000A busbar, native 19-inch equipment support, fanless liquid-cooled compute trays and standardised power and cooling interfaces. Nvidia, AMD, Google and Meta jointly published Open Data Center Specification v0.7, framed as a facility-level blueprint rather than a rack-level one. Meta will adopt Nvidia Spectrum-6 102.4Tb/s Ethernet switches at 200G per lane — double Spectrum-4’s switching capacity and per-lane bandwidth — in its IcePack 100T liquid-cooled rack, targeting clusters above 100,000 GPUs.

The pattern worth reading is which parts Nvidia opens. Rack geometry, busbar amperage, liquid-cooling couplings and facility specifications are the expensive, slow, capital-committing layer, and standardising them lets more suppliers build the buildings that Nvidia’s silicon goes into. The switching fabric is not being opened — Meta’s contribution to the announcement is buying Nvidia’s Ethernet switches. Opening the enclosure while holding the interconnect is a specific strategy, and the 250kW and 5,000A figures are the ones data centre operators have to design against now rather than in two years.

Intel’s GPU D270 puts up to 480GB of LPDDR5X behind 32 Xe3P cores in a 350W PCIe card #

Intel / Hacker News (227 points) / Phoronix

The chip formerly known as Crescent Island is now the GPU D-series, announced at the same OCP summit and aimed squarely at inference rather than training: agentic workloads, long-context RAG, enterprise assistants, coding assistants, document understanding, high-concurrency serving. Intel’s page gives 32 Xe3P cores, 256 XMX matrix engines, up to 480GB of LPDDR5X, a 350W air-cooled standard PCIe 5.0 card; secondary coverage adds up to 1.5TB/s of memory bandwidth and 1.3 PFLOPS of FP8, with Intel’s own reference card at 160GB and partners building the larger capacities. Intel says one card holds a model of roughly 300B parameters and an eight-GPU system exceeds a trillion. Customer sampling has begun.

The design choice is LPDDR5X instead of HBM, which buys capacity per watt and per dollar at the cost of bandwidth, and that trade is coherent for memory-bound decode on large models while being wrong for training. Sampling is not availability: there is no announced price, no general availability date and no public benchmark, and the inference market’s actual constraint is software maturity rather than card specifications — which is precisely where Intel’s accelerators have lost before.

NTT Data is in final talks on a 500MW, ¥1 trillion data centre in Osaka for Anthropic alone #

Nikkei / Reuters

The facility would draw up to 500 megawatts and cost more than ¥1 trillion, about $6.3 billion, making it among Japan’s largest by power intake and Anthropic’s first dedicated site in the country. The two sides aim to sign by the end of Japan’s fiscal 2026 in March 2027, with part of the site opening as early as 2028. Power is the stated obstacle: pulling 500MW off the grid would be slow, so the project is first examining on-site generation and fuel cells. NTT Data is the world’s third-largest data centre operator by market share and runs more than 1,600MW across several countries, meaning this single build would add roughly 30% to its global footprint.

The structural detail is that the site is built for one tenant. Single-tenant hyperscale for a model lab is the arrangement that made OpenAI’s compute commitments hard to unwind, and it transfers the power-procurement problem to the operator while fixing the lab’s capacity years ahead of demand it cannot yet measure. Treat the specifics as preliminary — this is Nikkei sourcing, both companies declined to comment, and nothing is signed.

Research & Papers #

Encrypted circuits hidden in model weights stay provably hard to find even with full weight access #

arXiv / Hacker News (214 points)

Draguns, Motwani, Douglas and Schroeder de Witt construct backdoor attacks that embed encrypted neural networks inside a model’s weights. The hidden circuit activates only on a secret trigger, and under standard cryptographic assumptions it is provably hard both to elicit and to interpret — including for an auditor holding the full weights. The authors implement the construction on a chemical reaction prediction task and test it against fine-tuning, weight noising, gradient-based trigger search and adversarial training; it survives all four.

The result is a limit theorem, not an observed incident, and that is what makes it useful. It says that for an adversarially trained model, a capability evaluation that fails to elicit a dangerous behaviour is not evidence the behaviour is absent, and no amount of white-box access fixes that — the obstruction is cryptographic rather than a shortfall in interpretability tooling. The practical consequence is that assurance arguments resting on “we tested the weights and found nothing” only hold for models whose training process you trust, which moves the burden onto training provenance and supply chain rather than onto evaluation.

OpenAI’s sub-n-log-n Fourier transform shaves an exponent of 10^-13 in a model with unbounded precision #

Ben Recht (arg min) / Hacker News (149 points) / John D. Cook

OpenAI posted a manuscript giving an algorithm for the discrete Fourier transform in O(n (log n)^(1−ε)) operations with ε = 10^−13, beating the O(n log n) bound that has stood since Cooley-Tukey, by combining algebraic geometry and coding theory in the style of Harvey and van der Hoeven’s integer multiplication work. Ben Recht’s reading is that it is a galactic algorithm: the standard FFT takes fewer than 5n log₂n arithmetic operations, and if the hidden constant C were 10^100 at N = 10^12, Cooley-Tukey would still be 10^99 times faster. More fundamentally, the result is stated in a model where you can store and multiply complex numbers at arbitrary precision, with magnitudes growing superpolynomially in n — Recht’s phrase is that it bears “no resemblance to an actual computer.” John D. Cook, writing favourably about the theory, puts the practical verdict the same way: “of absolutely no practical value, for now.”

Nothing here changes any FFT implementation, and the paper makes no finite-precision or numerical-stability claim. It is worth a digest entry because of how the claim travels: “OpenAI broke the FFT barrier” is true as a statement about asymptotic complexity in an idealised arithmetic model and false as anything a signal-processing engineer would act on, and the gap between those two readings is where most AI-generated-mathematics coverage is going to live. The genuine content is that n log n was not optimal, which is a real theoretical result about a question people thought was closed.

Funding & Business #

AI labs are buying failed startups’ codebases and workspace data, with Google paying $10M for Spirit Airlines’ email and Teams history #

MIT Technology Review

A market has formed around the digital estates of dead companies. SimpleClosure’s Asset Hub has run more than 150 such deals and expects to return $10 million to startups by the end of 2026, with data now 47% of its transactions; a rival, Sunset, prices assets by headcount, operating duration, data volume and tool usage. One founder, Keelan Miskell, got roughly $25,000 for a crypto startup’s codebase and expects around $15,000 more for its workspace data — the Google, Notion, Figma and Slack exhaust. The largest disclosed deal is Google paying $10 million in August 2026 for decades of Spirit Airlines data including 100 million emails, 500 million Teams messages and 176,000 employee records. Buyers named in the reporting include Google, Surge AI and Mercor, with SpaceX considering. Spirit’s flight attendants’ union objected on privacy grounds; an attorney quoted calls this class of data “legally radioactive” for the personal detail buried in it, and a law professor notes the proceeds go to creditors and investors, not to the employees who generated it.

This is the training-data supply chain reorganising around what the public internet does not contain. Workspace exhaust — real emails, real chat threads, real documents with real organisational context — is the closest available proxy for the knowledge work agents are being built to do, and it exists in volume only inside companies, which means it becomes purchasable mainly when a company dies. Two things follow for anyone operating on this side of it: your vendors’ bankruptcy terms are now a data-governance surface, and consent obtained for employment does not obviously extend to a post-mortem asset sale, which is the gap the union objection is pointing at and that no federal rule currently closes.

Regulatory & Policy #

Microsoft’s president calls for mandatory independent evaluator sign-off before AI products launch #

TechCrunch / BBC

Brad Smith, speaking on a BBC podcast, argued the UK is best placed to lead global AI safety rules on the strength of the AI Security Institute and its pre-release access to US frontier models. His specific asks are binding rather than voluntary: a legal requirement to notify organisations when their systems are breached by rogue AI agents, mandatory approval from independent evaluators before an AI product launches, and kill switches able to pause or slow a system if human control is lost. On voluntary regimes he said “it’s the companies that are not as responsible that you need to worry about,” and described the White House agreement signed by tech leaders as a good step but short of regulation.

Mandatory pre-launch sign-off by an outside evaluator is a materially stronger proposal than anything in the EU AI Act’s GPAI chapter, and it comes from the president of a company that distributes more frontier models than anyone. It also lands two days after this archive recorded that US pre-release access for the UK institute had been frozen for 17 days and then restored — Smith is proposing to make statutory a dependency that was just demonstrated to be revocable by one government’s phone call. Worth noting what the position buys Microsoft: a regulatory moat sized to incumbents, and a deployer-side liability story that rests on an evaluator it does not have to be.

Developer Tools #

Codex CLI 0.157.0 installs a self-updating background daemon that outlives the terminal, copying 374MB to do it #

GitHub (openai/codex) / Hacker News (568 points)

Since 0.157.0, released 25 September, the Codex CLI spawns a detached app-server daemon by default. It survives after every Codex window closes, copies roughly 374MB of platform packages into ~/.codex/packages/app-server-daemon/, updates itself hourly in a way that can interrupt an active session, and inherits environment variables from whichever shell happened to start it first. Multiple commenters report the behaviour making the CLI unusable on Windows and Linux, several describe it as malware-shaped — an undisclosed persistent process that updates itself — and a maintainer confirmed hitting it. The workaround is codex features disable daemon_auto_start; the issue is open with no fix landed.

The env-inheritance detail is the one with real blast radius: a long-lived daemon pinned to the first session’s environment means credentials, proxy settings and project-scoped variables from one project silently apply to work in another, and an hourly self-update means the binary serving your session is not the one you installed or pinned. For anyone running agent CLIs inside CI or a controlled image, default-on background persistence with auto-update is a supply-chain property, not a convenience setting, and the fact that it shipped unannounced in a point release is the part to check your own vendored tooling for.

Open Source #

Janas streams MoE experts off NVMe to run an 80B model on a 32GB laptop at 22-24 tokens per second #

Janas / Hacker News (153 points)

The project is a GPLv3 inference engine in pure C with no dependencies beyond libc, using SIMD on CPU and Vulkan for GPU, which keeps hot mixture-of-experts weights resident in RAM and streams the rest from an NVMe SSD on demand. On an Intel Core Ultra 9 185H with 32GB and NVMe it reports Qwen3-Next-80B at 22-24 tokens per second generation and 62 tokens per second prompt processing, Qwen3-30B at 32-34 and 133, and Qwen3.5-2B at 50 and 395, claiming to beat llama.cpp across the tested set. It supports Qwen3 from 0.6B to 80B, Gemma 4, and Q4_K_M and Q3_K quantisations on Linux x86-64 and Windows.

Twenty-plus tokens per second from an 80B model on a consumer laptop with 32GB is the number that matters, because it puts a model class that normally needs a server into the range of a machine people already own — MoE sparsity is what makes it work, since only a fraction of experts are needed per token and the rest can wait on disk. The caveats are the author’s own and they are large: the API changes frequently, every measurement comes from one laptop, memory consumption can be aggressive enough to exhaust the system, and GPU driver resets have been observed. Treat the comparison against llama.cpp as unreplicated until someone runs it on different hardware.

Other #

Epic Games told staff an unannounced Disney shooter will be built with “no more handwritten code”, using Claude #

Bloomberg / Ars Technica

According to Bloomberg, Epic is moving to an AI-first development pipeline starting with an unannounced Disney shooter featuring Marvel and Star Wars characters, originally planned for March 2027 and now delayed. Staff were reportedly told there would be “no more handwritten code” and that all art would be “generated with full AI workflows”, with the project produced largely using Anthropic’s Claude models and humans moved to supervision, direction and cleanup. Bloomberg characterises it as the first attempt by a major game company to build a title with AI as the foundation of the pipeline rather than an assist. Developers inside Epic reportedly met the announcement with scepticism and backlash.

The reason this is more than an adoption anecdote is that it is a falsifiable commitment with a ship date attached, by a studio that also sells the engine everyone else builds on. Yesterday’s two large supervised-agent write-ups — a million merged lines at Cockroach Labs behind a plan-review gate, and a decompilation project where throughput and correctness came apart until a byte-exact verifier existed — both found that the external check was what made the output usable. A AAA game has no equivalent oracle; “looks right and plays well” is a human judgment, which is exactly the regime where the earlier results say agent output diverges from agent progress. This is reporting on internal statements, not an Epic announcement, and the delay is already on the record.

Threads to Watch #

The GLM-5.3 family is on both sides of the same day’s news. Anthropic named Zhipu in a research post about accounts harvesting Claude’s reasoning traces in connection with GLM-5.3, and Zhipu shipped GLM-Legal — built on GLM-5.3-Flash — with a near-frontier benchmark claim and no endpoint anyone can verify it on. Those two facts do not establish any relationship between them, and conflating them would be the error. What they jointly establish is that provenance disputes are now attached to specific releases rather than discussed in the abstract, and that the only defence available to a lab accused of distilling is evidence it does not have to publish — while the only defence available to a lab publishing benchmark claims is an endpoint it has chosen not to open.

Capability evaluation keeps losing ground as an assurance mechanism. The hidden-capabilities paper proves that an adversarially trained model can hold a behaviour that no elicitation method recovers, even with full weight access. Brad Smith’s proposal is to make independent pre-launch evaluation legally mandatory. Both arrived on the same day, and the tension between them is the governance problem of the next year: the policy direction is toward evaluator sign-off as the gate, while the technical direction is toward results explaining why a clean evaluation cannot be read as a safety claim. The reconcilable version puts the weight on training provenance and on what the deployer controls at runtime — which is where the week’s other results have also been pointing.

Meta and Z.ai both shipped frontier-adjacent models you cannot call. Muse Wonder Full earns the Intelligence Index position and is reachable only through a $50-a-month consumer subscription; GLM-Legal posts a Harvey LAB number and is reachable only by application. In both cases the artefact that generates the headline is deliberately separated from the artefact developers can build on, which makes the benchmark an advertisement for a product rather than a specification for an API. The practical discipline is unchanged and worth restating: price and availability for the exact checkpoint you can call, not the one in the chart.

Sources Unavailable Today #

These sources could not be fetched today. Links point to their homepages so you can check them directly.

• Google DeepMind — parse_error