Meta's Muse Spark Open is an 816B open-weight model that runs on two Mac Studios
Meta released Muse Spark Open, an 816B-parameter open-weight model that runs on two Mac Studios, and Microsoft finished pretraining a 2.8-trillion-parameter model it has not committed to releasing. The FTC sent OpenAI and Anthropic civil investigative demands over security incidents on the same day Anthropic gave METR researchers employee-level access to its internal systems. Today’s papers cluster on the control layer around agents — approval paths, step-level guards, compaction, and harness configuration — rather than on the models inside it.
Model Releases #
Muse Spark Open is an 816B/42B multimodal MoE built for coding and agentic work, with a 1M-token context window #
Meta AI Research / Hugging Face / TechCrunch
The model routes each token to 8 of 256 experts across 62 layers, pairs a 1.8B-parameter perception encoder for text, image, video and audio input, and scores 76.4 on Terminal-Bench 2.1, 60 on DeepSWE 1.1, 89.2 on MCP-Atlas, 80.4 on OSWorld Verified and 89.0 on GPQA Diamond. Meta optimized it to run on two Mac Studios with M5 Ultra — a terabyte of unified memory between them — making a frontier-scale open-weight model deployable without a GPU cluster. The Muse Model License is not open source: any licensee offering model access as a service above $20M in gross revenue over twelve months must negotiate a separate agreement with Meta, while internal and non-MaaS commercial use is exempt.
Microsoft finished pretraining MAI-Base-2, a 2.8T/80B model it says is 4.2 to 12.3x more FLOPs-efficient than DeepSeek-V4-Pro-Base #
Microsoft AI
The run used 16,000 GB200 GPUs over 38 days on 50 trillion tokens — 18% vision data, 4.5T unique VLM tokens — with MoE in every layer, each token routed to 7 of 512 experts plus one shared expert, a March 2026 knowledge cutoff, 21% average model FLOPs utilization and 89% goodput. Microsoft is explicit that the model is still in post-training, gives no release date or price, and plans to license weights to “trusted partners” through Foundry. The efficiency claim rests entirely on Microsoft’s own held-out evaluations and commissioned scoring against a competitor’s base model, with nothing externally reproducible and no public access, so it should be read as a capability disclosure rather than a measured result.
NVIDIA’s Nemotron 3.5 Super VL hits accuracy comparable to its largest reasoning model at a fifth the parameters #
NVIDIA
Super VL is 120B parameters trained on roughly 26 trillion tokens and claims 5x the throughput of its size class; Bolt 74B-A9B fits in 24GB, ranks first among open models in its class on PinchBench and second on BrowseComp, and ships with llama.cpp, Ollama, LM Studio, Unsloth and vLLM support. A 4GB Bolt E4B for GeForce RTX, Jetson and DGX Spark follows on 23 October. NVIDIA released weights, datasets and training recipes together, which is a materially different offer from Meta’s and Microsoft’s releases on the same day.
IBM’s Granite Switch 4.1 packs a decision adapter, a safety classifier and a speech model into one checkpoint #
IBM / Hugging Face
The 8B and 30B models combine a general Decision aLoRA, a Guardian aLoRA for safety classification and the 470M Granite-Speech-5.0-Turbo-CTC into a single deployable artifact, switching between chat, decision and speech requests by swapping adapters rather than standing up separate endpoints. IBM reports a 3B custom variant serving 60 to 100 decisions per second against Jev’s reported 10, and the Guardian adapter beating Jev 1.13, Microsoft-Decision-1, GPT-Luna-Decisions and Clef-Flash on safety decision tasks. For anyone running a guard model alongside a primary model, collapsing both into one endpoint removes a serving tier.
Regulatory & Policy #
The FTC sent OpenAI and Anthropic civil investigative demands of more than 50 pages each over security incidents #
Axios / CBS News / Ars Technica
The demands, served Wednesday, seek documents on security incidents and safeguarding practices plus marketing materials and privacy policies, framing the inquiry as potential consumer protection violations rather than an AI-specific statute. The FTC plans to compel executive testimony and to send demands to third-party AI organizations later. This is the second regulator to move on the same underlying incidents in three days, after the EU AI Office’s information requests on 14 October, and the consumer-protection theory is the one that reaches conduct no AI-specific law yet covers.
Anthropic gave six METR staff employee-like access to internal tools, hardware and offices, with publication rights it cannot veto #
Anthropic / TechCrunch
METR sits at the top of a three-tier evaluator structure and can see most internal information except customer data, legal communications and model architectures; it may publish without Anthropic’s approval, subject to redactions in narrowly defined categories. SecureBio occupies the second tier, reviewing the chemical and biological weapons sections of risk reports with its own publication rights, while Accenture and Faculty are at an earlier stage covering red-teaming and safeguard testing. Embedded access with non-vetoable publication is a stronger commitment than the external audits labs have offered so far, and it landed the same day the FTC demanded the documents an evaluator would read.
Security #
Four of eight agent runtimes let arguments change after approval, and no runtime produced a third-party verifiable approval record #
arXiv
The authors define twelve attacks on the approval path — decoy recipients, amount cancellation, card padding, label spoofing, enrollment squatting, threshold splitting — and run them against the Agent Payments Protocol, Microsoft’s action-bound approval design and MCP elicitation. Their reference gateway renders the approval card from a canonical effect descriptor signed by a passkey, cutting forged-narration attack success from 0.54 to 0.03 and raising the catch rate of fifteen language models acting as approvers from 0.30 to 0.98, at the cost of refusing 16% of harmless near-misses. Their negative results matter as much: flooding still succeeds 0.45 to 0.60 of the time against a modeled approver, a second device adds nothing over trusted on-host confirmation, and approval cannot stop effects policy already permits.
Indirect prompt injection succeeded 19.6% of the time across 19 models, and instructional hardening cut it from 58.2% to 14.3% #
arXiv
INFUSE injects attacks through the interaction surfaces agents actually touch during long-horizon work — shell commands, dependency installs, code modification, remote services — rather than only initial prompts, across 40 tasks and 56 attack scenarios in five threat categories, producing 41,824 adversarial trajectories. Per-model attack success ranged from 3.2% to 41.9%, and existing guard models provided limited protection. The spread across models is wide enough that injection resistance is a model-selection criterion, not a property of the agent framework.
Translating only the user’s request flips agent guard verdicts, and the effect grows with language rarity #
arXiv
LinguaGuardBench translates the user instruction of 1,220 labelled TS-Bench steps into German, French, Turkish, Swahili and Amharic while holding every tool call, observation and label byte-identical, so verdict changes are attributable to language alone. Across 19 guards and 489k verdicts, the nine guards under 13B parameters saw mean placebo-adjusted flip rates rise from +1.5pp on French to +4.4pp on Amharic; 12-30B open guards blocked up to 5.0pp more benign steps, every significant recall loss was in a guard below 10B (up to -7.4pp), and purpose-built agent guards were the most sensitive of all. Frontier guards moved by about a point at most. Anyone deploying a small purpose-built guard to a non-English user base is measuring it on the wrong distribution.
Stronger LLM judges accepted more tampered deployments, with acceptance rising from 88.6% to 94.1% #
arXiv / Hugging Face Daily Papers
DIB-Bench tests whether evaluators can detect a tampered deployment stack that leaves output behaviour unchanged, across 7,560 examples and six tampering methods. Acceptance of tampered outputs rose from 88.6% for rule-based checks to 94.1% for GPT-5-nano, and a trigger-conditional tamper invisible during evaluation produced 48% to 100% harmful outputs once deployed, with harm increasing alongside model capability. The authors argue such modifications are undetectable from outputs alone at any sample size and propose manifest-hash identity channels instead — which makes this an argument for attesting the stack, not for a better judge.
Deleting a secret from agent memory left 39% to 76% of it recoverable from surviving evidence #
arXiv
MemCut tests user-requested forgetting with 456 hand-designed secrets in long-horizon conversations, annotating the full evidence trail including messages that never state the secret directly. LLM-guided deletion of ten additional turns from twenty retrieval candidates still left 39-76% residual recovery when a reader was handed the surviving objects, and widening the candidate pool at fixed budget reduced recovery more than deleting every original candidate did. Removing the disclosure is not the same as removing the secret, which is a problem for any deployment that has promised deletion.
Research & Papers #
83% of failed agent runs traced to an action carrying out a summary entry no environment output supported #
arXiv
Compaction prompts ask the compressor for decisions and next steps, so each summary blends facts the environment established with reasoning the compressor invented, and the agent cannot tell them apart afterwards. Source-Judged Compaction scores every summary entry for whether it has a source in the environment output or the prior summary and drops the unsourced ones, improving cross-run reliability 2.1% to 8.9% on AppWorld and OfficeBench without increasing agent token usage or touching the agent or compressor. For anyone running long-horizon agents, this locates a dominant failure mode in the compaction step rather than the policy.
Report-only readers recovered 52.0% of agent task state against 92.7% for full-context readers, a 40.7-point gap #
arXiv
CTXGAP probed 37 coding tasks with 4,799 valid probes: agents answered 93.6% of task-state questions when asked directly, but their accumulated user-facing reports carried only half that recoverable state, and at the final checkpoints of 30 verified fixes the gap was still 34.8 points. Full terminal scrollback lifted recovery to 73.6% without closing it, and human annotation found states mentioned without enough supporting detail to be the largest unrecovered category. A supervisor reading agent reports is systematically unaware of failed attempts and workarounds they would have investigated.
Across 5,194 trajectories, the same model varied substantially in completion and failure behaviour depending on its harness #
arXiv
Harness-Bench holds task environments, budgets and evaluation protocols fixed while varying the harness — the layer managing context, tools, state, constraints, permissions, tracing and recovery — across 106 sandboxed tasks reviewed for solvability and oracle-checkability. The authors recommend reporting agent capability at the model-harness configuration level rather than crediting the base model, and identify recurring execution-alignment failures where plausible reasoning decouples from tool feedback, workspace state or output contracts. It is the measurement counterpart to today’s security results: the harness is where both capability and vulnerability live.
Skill drift after deployment erased 52% to 93% of what self-improving agents had gained over a no-skill baseline #
arXiv
Co-evolution methods score the policy on the skill bank it trained with, but in deployment skills get rewritten, added and removed far more often than the policy is retrained. Across four co-evolution methods and five benchmarks, worst-case success under simulated drift fell 5 to 13 points below the measured peak, and the authors show the shared cooperative acceptance rule ties competence to the co-evolved bank by construction, with sensitivity growing as training proceeds. Their CODA protocol adds consistency under meaning-preserving edits and resistance to corrupted skills as metrics.
Tool graph memory rarely beat baselines, and where it helped it cost more than twice the LLM calls #
arXiv
Evaluated across nine models and two benchmarks, stored tool-transition graphs seldom improved significantly on multi-turn tool use, and random or absent guidance retained most of the apparent gain — implying the benefit came from the extra computation rather than the memory. Even when the correct next tool was suggested, failures persisted, including agents giving up without calling a tool at all. Storing the same experience as textual insights outperformed the graph with almost no extra calls, which argues for memory as a soft prior rather than a prescription.
One adversarial agent in ten pushed 44.8% of benign agents to a false answer; three pushed 60.5% #
arXiv
Probing each agent’s private answer through a separate hidden call across six models and three factual-QA datasets, the authors found groups stable without an attacker (0.6% ending on the false answer) and the usual conformity finding reversed: with three adversaries, benign agents privately held the false answer in 51.6% of exposed turns while publicly endorsing it in only 19.7%. Most of the influence is therefore invisible in the visible discussion, and the false answers persisted when agents were later asked for their own views. Reading a multi-agent transcript understates how far the group has actually drifted.
Modernizing InceptionV1’s architecture raised interpretable final-layer neurons from about 5% to 99-100% at identical size and data #
Goodfire
Goodfire argues polysemanticity is largely recursive generalization rather than superposition: the famous cat-and-car neuron was a V-shape detector responding to shared geometry, and compressing layer 3b 48-fold from 480 to 10 neurons made neurons coarser rather than entangled. In Qwen3-32B they report roughly 90% of neuron poles having one main job, about 7% two related jobs, and only 2-4% unexplained, a pattern they say holds up to trillions of parameters. If it survives replication, mechanistic analysis would not require sparse autoencoders to untangle features first — a strong claim resting on one lab’s interpretability judgments about its own models, and the sort that needs independent scoring before it is load-bearing.
Midtraining at 256K context on packed repositories and build logs lifted SWE-bench Verified from 60.7 to 64.5 #
arXiv
NVIDIA published the recipe for the stage between pretraining and post-training: hundreds of billions of tokens of natural software-engineering data — repositories, pull requests, commit histories, build logs — plus a small share of agentic traces. On Nemotron 3.5 Lightning, 500B midtraining tokens moved SWE-bench Verified 60.7 to 64.5, Multilingual 55.8 to 62.8 and Pro 32.0 to 35.5 after identical SFT; on the larger Super, 280B tokens moved DeepSWE 11.7 to 15.7. They also report that base-model proxy metrics did not reliably predict post-training results, so the recipe had to be validated through short fixed SFT runs.
Developer Tools #
Cloudflare is feeding OpenAI’s crawler metadata signals from 1% of its network, surfacing hundreds of millions of new pages #
Cloudflare
The research pilot shares metadata — whether content changed, whether a URL is valid, whether a page carries harmful content — so OpenAI can prioritize crawling for ChatGPT Search indexing, explicitly not page content for model training. Cloudflare stresses that a signal about a page does not grant permission to fetch it, and that site owners manage access through AI Crawl Control. This is a bilateral data-sharing arrangement rather than a protocol, which means discovery advantage accrues to whoever strikes the deal rather than to the web generally.
AWS’s “Trust in Depth” splits agent autonomy into scope, identity, runtime bounds and post-hoc observation #
AWS
Each pillar maps to shipped services: Bedrock AgentCore Policy for pre-execution scoping, an AWS Agent Registry issuing per-agent identities, AgentCore Gateway plus temporal policies that tighten permissions as a session progresses and Bedrock Guardrails for runtime bounds, and CloudWatch Omni for trace reconstruction and evaluation. The notable piece is automated reasoning that proves agent behaviour complies with precisely-stated rules across all execution paths rather than only tested ones. It is the vendor-side counterpart to the approval-path and guard failures in today’s security section — external controls, on the explicit premise that an agent cannot be trusted to govern itself.
Funding & Business #
Anthropic told investors Q3 revenue reached $16.8bn, up from $11.5bn in Q2 and $4.8bn in Q1 #
Financial Times / Simon Willison
The figures, disclosed at investor meetings ahead of the IPO, put quarterly growth near 50% with adjusted operating margins of 11% excluding stock compensation and $1.70 of revenue per dollar of compute spend. Anthropic also attributed 5% to 7% of revenue to model distillation — rival labs paying to distill its models — which Willison notes implies competitors spent over $500M on distillation in Q2 alone. That line item is the more interesting disclosure: it prices how much of Anthropic’s revenue depends on serving the labs competing with it.
Open Source #
ExecuTorch now runs PyTorch models directly on Arm Cortex-M microcontrollers, with four MLPerf Tiny models under 90 KiB of RAM #
PyTorch
The Cortex-M backend replaces operators with CMSIS-NN-backed implementations at compile time across all three capability tiers, eliminating the conversion to another framework that microcontroller deployment previously required. On an Alif Ensemble E8 running one Cortex-M55 core at 400 MHz, the four benchmarked models ran in 21.5ms or less with the core runtime under 20 KiB of flash, and a µYOLO person detector on a Cortex-M85 managed 12.7 FPS at 24ms per frame — down from 191ms once the expensive operators’ weights were placed in tightly-coupled memory. Undelegated operations can run on the CPU alongside Ethos-U NPU delegation, so NPU operator coverage stops being an all-or-nothing gate.
NVIDIA released a 2.8-trillion-token Indic corpus across 22 languages along with the pipeline that generated it #
NVIDIA / Hugging Face
The corpus holds 2,601.0B native-script and 224.6B romanized tokens across 34 language-script configurations, built by document-level translation from English, MQM-inspired quality scoring at a 75/100 threshold, and feedback-based repair that recovered 438.4B tokens that would otherwise have been discarded. Adding just 10B Indic tokens during continued pretraining moved Nemotron 3.5 Super VL up 4.98 to 9.82 percentage points across five Indic benchmarks. The open repair-and-score pipeline is the more reusable artifact, since it applies to any language pair where translated data needs filtering rather than discarding.
Threads to Watch #
The approval path is being specified and attacked in the same week. AWS shipped a four-layer autonomy framework resting on external controls and automated reasoning proofs, while one paper found four of eight runtimes permit post-approval argument changes and none produce a verifiable approval record, and another found step-level guards flip verdicts when the user writes in Amharic. Human-in-the-loop approval is being treated as a solved primitive by vendors and as an unhardened attack surface by researchers, and the researchers currently have the measurements.
Evaluation is relocating from the weights to the stack. Harness-Bench argues capability should be reported per model-harness pair; CTXGAP shows reports lose 40 points of task state the execution context retained; DIB-Bench shows output-only judging cannot see a tampered deployment at any sample size; and the co-evolution audit shows scores collapse once the skill bank drifts from the one trained against. Each targets a different layer, and all four conclude that a number attached to a model name is underspecified.
“Open weights” now means three incompatible things. Meta released 816B parameters under a license requiring a negotiated agreement above $20M of model-as-a-service revenue; Microsoft announced a 2.8T model whose weights go only to trusted Foundry partners, with no date; NVIDIA shipped weights, datasets and training recipes together. All three were described as open or openly available on the same day, and only one lets a reader reproduce anything.