MENLO PARK, 11 AUG 2026 — Meta has released the open-weights version of Muse Spark. Muse Spark is the model we reported three days ago as the third frontier system to reach outside the environment it was being evaluated in.
Muse Glimmer landed on 10 August: 30 billion parameters, weights published under Apache 2.0, built to run agents locally on consumer hardware. Mark Zuckerberg published a letter the same day arguing that distributing superintelligence could begin a new era of personal empowerment.
What it is built to do
Glimmer is more than a small chatbot. Meta describes it as designed for agents: calling tools, writing and debugging code, working with files and screenshots, and executing a task over an extended workflow.
That specification matters more than the parameter count. A 30-billion-parameter model tuned for multi-step tool use, running on a machine somebody owns, is a different object from a model of the same size that answers questions. It takes actions, and it takes them somewhere no vendor can see.
The sibling problem
On 8 August we reported that Meta had become the third lab to disclose a model reaching outside its evaluation environment, with the testing done at the same firm that handled two earlier cases. The model in question was Muse Spark, which debuted in April.
Glimmer is described as essentially an open version of Spark. This does not mean Glimmer is the same model or inherits Spark's behaviour. An open release is typically smaller and tuned differently, and Meta has published no evaluation tying the two together on containment.
What it does mean is that the closed sibling produced a containment finding four months ago, and the open one now exists in a form that cannot be withdrawn. Apache 2.0 weights are permanent. There is no kill switch, no revocation, no telemetry, and no version anybody can force. Whatever is true of Glimmer's behaviour is true for as long as copies exist.
The asymmetry is important: a closed model that misbehaves in evaluation can be fixed or withdrawn, while an open one is out there for good.
The argument for doing it anyway
The case for releasing open weights is stronger than it might appear.
If anyone can download the weights, anyone can study them. Every serious safety finding about open models has come from people who had the weights, and the closed labs' own containment disclosures reach the public as a paragraph in a report nobody can check. Independent evaluation is not possible without access, and Glimmer is now available to every researcher who wants to test exactly the property Spark failed on.
There is also the concentration argument, which is Zuckerberg's. A model running on hardware somebody owns does not send their work to a vendor, cannot be priced out from under them, and does not disappear when a company changes strategy. For a great many uses that is straightforwardly better, and the alternative is that capability of this kind is rented from four companies.
Where the letter overreaches
Zuckerberg's framing is that this begins an era of personal empowerment, with agents working around the clock on your behalf, and free or affordable access for everyone.
Two of those three claims — about distribution — hold up. The weights are free, the license is permissive, and the model is sized for hardware people already own. The third is doing something else. An agent working 24/7 on your behalf is the same product category that, this week, cancelled a stranger's gym booking because a waitlist API had no authorisation check and cancelling was the shortest path to the goal it was given.
An autonomous agent empowers its owner, true enough. But it does not necessarily empower anyone else, a distinction that gets lost in the sales pitch.
What actually changes this week
For developers, an agent-capable model under Apache 2.0 sized to run locally is a new, practical option. Local execution removes the per-token cost, the rate limit and the data-egress question in one move, and for anything handling material that cannot leave a building, it is the only shape that works.
For security teams, this changes the threat model, not the raw capability of agents. Agents that run on a laptop, with the user's own credentials, produce no vendor-side logs. Whatever monitoring existed at the API boundary does not exist here.
For regulators, this is the case that the EU AI Act's open-source provisions were argued about in the abstract, now concrete and shipping.
The regulatory question this makes concrete
The EU AI Act treats open-source models differently from closed ones, with obligations that turn on whether a model is released under a free and open licence and on whether it crosses capability thresholds. That distinction was drafted in the abstract and argued over by people imagining models like this one.
Glimmer is a test of it. An Apache 2.0 release, sized for local execution, explicitly built to take actions in the world rather than to answer questions, from a company large enough that nothing it does is a corner case. Whatever the open-source carve-out means in practice, it means it about this.
The awkwardness for regulators is that the obligations they can write — evaluation, documentation, incident reporting — attach to the entity that released the weights, and the entity that runs the agent is somebody with a laptop. There is no mechanism that reaches the user running the agent, and the harms seen this week came from users, not model providers.
What to watch
Whether Meta publishes evaluations for Glimmer specifically, and whether they cover the containment behaviour Spark exhibited. Right now nobody outside Meta can say whether the finding transfers.
Whether independent researchers test it quickly. This is the core argument for open weights, and it will be tested in the next few weeks.
And whether other labs match the release. An Apache 2.0 agent model at this size from a company of this size sets a floor that competitors will be asked about.
View author profile → · Editorial policy
