Meta's new model is Muse Spark, and meta.ai chat has interesting new tools

Simon Willison · email · 2026-04-10 source ↗ Reader 🖥️

Agent Harness AI-Driven Vulnerability Discovery Evals Mythos Open-Weight Models Project Glasswing Software Supply-Chain Security

The AI frontier is advancing simultaneously on two fronts — model capability (Meta's Muse Spark, Z.ai's GLM-5.1) and model danger (Anthropic's Mythos finding decades-old vulnerabilities at scale) — and the industry's response to both fronts reveals how the relationship between open and closed AI is being renegotiated under pressure from security realities.

theoretical · mixed — A newsletter combining expository reporting on new AI releases with first-person exploratory narratives. The author's goal is understanding ('here is what these things are and what they mean') rather than prescription. However, the Glasswing section edges toward practical assessment ('these security risks are credible and the restricted-release trade-off is reasonable').

Structure

Part	Role
Muse Spark announcement and benchmarks	Evidence that Meta has returned to frontier-competitive models, but via a closed/hosted model rather than open weights
Pelican test and tool exploration of meta.ai	First-person investigation demonstrating the model's capabilities and, more importantly, the sophistication of Meta's tool harness (16 tools including visual grounding, code interpreter, sub-agents)
Open weights future speculation	Context establishing the tension between Meta's open-source history and this closed release
Anthropic Project Glasswing / Claude Mythos	Central evidence for the danger thesis — a model too capable at finding vulnerabilities to release publicly, with verified real-world results
Corroborating quotes from security practitioners (Kroah-Hartman, Stenberg, Tarreau)	Independent confirmation from the open-source security community that AI vulnerability research has qualitatively shifted
Axios supply chain attack postmortem	Concrete case study of the human attack surface — social engineering of open-source maintainers
Links section (syntaqlite, Google AI Edge Gallery, GLM-5.1, quotes)	Supporting evidence and counterpoints: AI as creative tool (GLM-5.1 pelicans), AI enabling long-deferred projects (syntaqlite), AI usage patterns (ChatGPT health data), GitHub growth statistics

Key terms

Muse Spark
Meta's first post-Llama 4 frontier model release — hosted, not open weights, competitive with Opus 4.6 and GPT-5.4 on selected benchmarks
pelican test Evals
Willison's personal benchmark for LLM capability: generating an SVG of a pelican riding a bicycle. Used as a quick qualitative assessment of model competence
visual grounding
A tool in Meta AI's harness that analyzes images to identify, label, locate (bbox/point), and count objects — a native model capability exposed via tool call, not Segment Anything
Project Glasswing Project Glasswing
Anthropic's program for restricted release of Claude Mythos to selected security partners, with $100M in usage credits and $4M in donations to open-source security organizations
Claude Mythos Mythos
Anthropic's unreleased model with cybersecurity capabilities so strong that Anthropic chose not to make it generally available — can autonomously find and chain vulnerabilities
tool harness Agent Harness
The set of tools (browse, code interpreter, image gen, visual grounding, sub-agents, etc.) wired into a chat interface that extend a model's capabilities beyond text generation
supply chain attack Software Supply-Chain Security
An attack where a malicious dependency is injected into a widely-used software package by compromising a maintainer's credentials through social engineering

Propositions

explicitMeta has returned to frontier-competitive model performance with Muse Spark, after Llama 4's relatively weak showing a year agoconf: high
explicitMeta's Muse Spark represents a strategic shift from open weights to a hosted, closed modelconf: high
implicitdevelopedThe tool harness surrounding a model (browsing, code execution, image analysis, sub-agents) is becoming as important as the model itselfconf: high
refines ←LLMs Corrupt Your Documents When You Delegate · p5 — Qualifies the harness-as-important-as-model claim: agentic tool use adds nothing on delegated document-editing fidelity.
explicitAI models have crossed a qualitative threshold in vulnerability research, shifting from generating 'AI slop' reports to finding real, high-severity bugsconf: high
explicitcontestedAnthropic's decision to restrict Claude Mythos rather than release it publicly is a warranted response to genuine security risk, not just marketingconf: high
contradictsAll of AI's New Models and Tools · p7 — Willison argues the Mythos restriction is a warranted response to genuine security risk, against the framing of safety-gated releases as capability-signaling marketing.
contradictsThree reasons to think that the Claude Mythos announcement from Anthropic was overblown · p4 — Willison's judgment that the restriction reflects genuine risk is incompatible with Marcus's claim that the public was deliberately played into overestimating Mythos.
explicitcontestedClaude Mythos can autonomously chain multiple vulnerabilities into working exploits at a rate that is qualitatively different from previous modelsconf: high
contradictsThree reasons to think that the Claude Mythos announcement from Anthropic was overblown · p3 — Autonomous multi-vulnerability chaining at a qualitatively different rate contradicts Marcus's incremental-improvement reading.
explicitThe volume of legitimate AI-generated vulnerability reports is creating a resource crisis for open-source maintainersconf: high
explicitAI's value in software development is highest for tedious, well-specified implementation work and lowest for open-ended architectural designconf: high
implicitThe security landscape for open-source software is entering a period of compounding threats: AI-discovered vulnerabilities plus sophisticated social engineering targeting maintainersconf: medium
explicitMeta's closed release of Muse Spark may be temporary; future versions may return to open weightsconf: medium
explicitMuse Spark achieves frontier performance with over an order of magnitude less compute than Llama 4 Maverickconf: medium
explicitEveryone likes using AI tools to try doing someone else's profession but is less keen when someone else uses it for theirsconf: high

Arguments

Anthropic's restricted release of Claude Mythos is a reasonable trade-off, not mere marketing strength: high

Explicit premises:

Mythos can autonomously develop working exploits at a rate 100x higher than Opus 4.6
It has found vulnerabilities in every major OS and browser
It found a 27-year-old OpenBSD TCP SACK bug
Multiple credible security practitioners independently confirm AI vulnerability research has qualitatively shifted
Duplicate vulnerability reports are now appearing — multiple people finding the same bugs with AI tools

Implicit premises:

If defensive use of these capabilities (finding and fixing bugs) is this productive, offensive use would be proportionally dangerous
The time between a model being released and malicious actors replicating its capabilities is short enough that a head start for defenders matters

Inferences:

Other frontier labs (OpenAI, Google) likely have or will soon have models with similar offensive security capabilities
The window for 'responsible disclosure at scale' via programs like Glasswing is closing as capabilities proliferate

Meta has returned to frontier competitiveness after Llama 4's disappointing reception strength: medium

Explicit premises:

Artificial Analysis scored Muse Spark at 52, vs. 18 and 13 for Llama 4 models
Benchmarks show it competitive with Opus 4.6, Gemini 3.1 Pro, and GPT 5.4
It achieves this with 10x less compute than Llama 4 Maverick

Implicit premises:

Third-party benchmark aggregators like Artificial Analysis are more trustworthy than self-reported benchmarks
Being closed-source was a necessary trade-off to achieve competitive performance quickly

Inferences:

If Meta can achieve frontier performance with 10x less compute, the cost of frontier models is dropping faster than expected

The sophistication of AI tool harnesses is converging across major providers strength: medium

Explicit premises:

Meta AI has 16 tools including code interpreter, browser, image gen, visual grounding, sub-agents, and file editing
These patterns match ChatGPT (code interpreter), Claude (text editor, artifacts), and Gemini
File editing tools are 'becoming a common pattern across any file-equipped agent harness'

Implicit premises:

Tool harness design is an increasingly important competitive axis, not just model quality
Users evaluate AI products as the combination of model + tools, not model alone

Inferences:

The differentiator between AI products will increasingly be in tool integration quality and unique first-party data access (e.g., Meta's content_search across Instagram/Threads/Facebook)

AI is most valuable for implementation work and least valuable for architectural design decisions strength: medium

Explicit premises:

Lalit Maganti's first vibe-coded prototype worked as proof of concept but lacked coherent architecture
AI made procrastination on design decisions easy because refactoring was cheap
The second, human-directed attempt produced a robust library
Implementation has objectively checkable answers; design does not

Implicit premises:

The ability to defer decisions cheaply is not the same as the ability to make good decisions
Good architecture requires a kind of judgment that current AI lacks — choosing between multiple valid options based on long-term consequences

Open-source maintainers face compounding security threats from AI-discovered vulnerabilities and AI-enhanced social engineering strength: high

Explicit premises:

Vulnerability reports have gone from 2-3/week to 5-10/day for the Linux kernel
The Axios maintainer was targeted with a sophisticated, individually tailored social engineering campaign
The social engineering involved cloned company identities, fake Slack workspaces, and staged video calls

Implicit premises:

Open-source maintainers are typically under-resourced relative to the attack surface they defend
The same AI capabilities that find vulnerabilities could also be used to craft more convincing social engineering campaigns

Inferences:

The open-source funding and maintainer support problem is now a security emergency, not just a sustainability concern

Narratives

Willison's pelican test across Meta AI's Instant and Thinking modes, followed by progressive tool exploration (generating a raccoon image, analyzing it with OpenCV, then visual grounding, then bounding boxes)
→ Demonstrates the depth of Meta's tool harness through a hands-on exploration narrative. Implicitly argues that the tool ecosystem is as interesting as the model, and that transparency about tool names (Meta not hiding them) is commendable.
Nicholas Carlini discovering a 27-year-old OpenBSD TCP SACK bug using Claude Mythos, verified via git blame showing the surrounding code is from 1999
→ The most concrete evidence that AI vulnerability research represents a qualitative shift. The 27-year age of the bug makes the capability viscerally impressive and the threat credible.
The Axios maintainer (Jason Saayman) being socially engineered through a fake company, cloned Slack workspace, staged MS Teams meeting, and a RAT disguised as a software update
→ Demonstrates the sophistication of supply-chain attacks targeting individual maintainers. Implicitly argues that security is a human problem as much as a technical one.
Lalit Maganti spending eight years procrastinating on syntaqlite, then building a vibe-coded prototype in weeks with AI, then throwing it away and rebuilding from scratch with human-directed architecture
→ Illustrates the dual nature of AI assistance: it overcomes activation energy for tedious work but actively harms high-level design thinking. Supports the proposition about AI's implementation vs. architecture strengths.
GLM-5.1 producing an excellent pelican SVG with animations, but the animation breaking the pelican's position — then fixing it correctly when told about the bug
→ Demonstrates the state of open-weights models: capable of impressive output but with integration failures that require human correction. Also shows models can self-correct when given specific feedback.

Questions addressed

✅ Is Meta back in the frontier model competition?
Yes — Muse Spark scores 52 on Artificial Analysis vs. 18/13 for Llama 4, placing it behind only Gemini 3.1 Pro, GPT-5.4, and Opus 4.6. But there are caveats: it's closed, not open weights, and lags on agentic benchmarks.
✅ What tools does Meta AI's chat harness provide?
16 tools including browser/search, Meta content search, image generation, code interpreter (Python 3.9), web artifact creation, visual grounding, sub-agents, file editing, and third-party account linking.
✅ Is Anthropic's decision to withhold Claude Mythos justified or is it marketing?
Willison concludes it's warranted, based on the verified OpenBSD bug, the 181/0 exploit success rate comparison with Opus 4.6, and independent corroboration from kernel/curl/haproxy maintainers.
⭕ How should the industry respond to AI-powered vulnerability discovery at scale?
Willison suggests Glasswing's approach (restricted access + funding for defenders) is reasonable but notes $100M + $4M may not be sufficient. He calls for OpenAI to be involved too.
⭕ Will Meta return to open-source releases?
Alexandr Wang promises plans to open-source future versions, but no firm commitment or timeline.
⭕ What happens when the volume of legitimate vulnerability reports exceeds maintainers' capacity to handle them?

Gaps

incompleteThe newsletter identifies the vulnerability report tsunami but does not explore what happens when defender capacity is overwhelmed. If reports go from 2-3/week to 5-10/day and continue scaling, the current model of volunteer maintainers triaging reports breaks. Willison notes the problem but offers no analysis of structural solutions beyond 'more money and more maintainers.'
Read next: Research on open-source sustainability funding models; analysis of whether AI itself can triage AI-generated vulnerability reports (an arms race dynamic)
closed byYou Probably Won’t Read This Article…and That’s OK — Supplies the missing structural analysis that gap flags as absent: frames the maintainer-overload dynamic as the latest instance of a recurring 'scarcity gate collapses → new institutional gate gets invented' pattern, and evaluates the two live candidate structural responses (lean harder on human-centric gates vs. build an AI-based gate), showing why each fails on its own terms rather than simply calling for 'more money and more maintainers.'
incompleteThe article does not address whether Meta's shift from open weights to closed hosting is driven by competitive pressure, safety concerns, or compute economics. The 10x efficiency claim is stated but not analyzed — if frontier performance is achievable with 10x less compute, that should make open-weight releases more feasible, not less.
Read next: Meta's AI strategy documents; analysis of the economics of open-weight vs. API-hosted model distribution
incompleteThe Glasswing section does not address the offensive/defensive asymmetry: Anthropic gives defenders a head start, but the underlying capabilities will inevitably proliferate. How long is the defensive window, and what happens when it closes?
Read next: Thomas Ptacek's 'Vulnerability Research Is Cooked'; cybersecurity literature on offense-defense balance with new capability categories
incompleteThe article treats the Axios social engineering attack and the AI vulnerability discovery trend as separate stories, but does not connect them: AI could make social engineering attacks on maintainers more scalable and convincing, compounding both threats simultaneously.
Read next: Research on AI-enhanced social engineering; analysis of combined technical+social attack vectors
incompleteThe GitHub activity statistics (275M commits/week, 2.1B Actions minutes/week) are presented without analysis of how much is AI-generated. If a significant fraction is AI-driven, these numbers may indicate code volume inflation rather than genuine productivity gains.
Read next: GitHub's own analysis of Copilot-attributed commits; research on whether AI-generated code volume correlates with software quality

Meta's new model is Muse Spark, and meta.ai chat has interesting new tools

Structure

Key terms

Propositions

Arguments

Narratives

Questions addressed

Gaps

Related documents