Meta's Muse Wonder Has Your Calendar. Who Holds the Guardrails?

Meta's pitch for Muse Wonder is "personal superintelligence for everyone." It's a good line. It is also the kind of line that makes a security person reach for the permissions screen, because a model that is built to remember you "over days, weeks, months, and beyond," and then act on your behalf, is really a question about authority wearing a product launch. So we set ourselves two goals that pull against each other. We wanted to give Meta credit where its new models are genuinely strong, and we wanted to map what a frontier agent with your inbox, calendar, and card actually changes about your attack surface. Those goals did not always agree. That tension is the article.

What Meta actually shipped

On October 12, 2026, Meta announced two models, Muse Wonder and the larger Muse Wonder Full, which it calls its "most capable models to date" for "personal and professional agentic tasks" (Meta Newsroom). They come out of Meta Superintelligence Labs, the group Meta rebuilt around Alexandr Wang, by the vendor's account, and they sit on top of Muse Spark, the model that launched in April and most likely still powers most of what people touch today (TechCrunch). Meta says both were trained at its gigawatt-scale Prometheus data center, and it has not disclosed the architecture, the parameter count, or the training data (Meta research blog). The weights are not released. As far as we could tell, this is a closed model from the company that spent two years telling everyone open weights were the point.

In our reading, the availability details matter more than the benchmark chart, so here they are plainly. Muse Wonder is available through the Meta Model API and Muse Code, Meta's terminal coding agent. Muse Wonder Full has no API at all and is reachable only through a Muse Code subscription. The Muse app, the consumer agent that books, buys, and emails for you, gets Wonder "soon," and paying subscribers first. Bloomberg's interview with Wang adds the reason free users wait, which appears to be simply that serving a model this size to billions of people is too expensive for now (Bloomberg Tech). API pricing is $4 per million input tokens and $20 per million output, the same as Claude Opus 5.5 (Artificial Analysis). Meta probably isn't competing on price here. But it is competing on reach.

Meta's two headline capabilities are named, which in most cases suggests that marketing got there before engineering did. "Active Memory" is the model carrying "what matters to you across conversations" and pulling it back when it's relevant. "Active Focus" is the model refusing to quit when a task gets hard, trying other approaches, recovering from errors, and checking in "before following through on anything important" (Meta Newsroom). Meta's own launch video says the model was trained to not give up, and one staffer describes it researching rental listings every day and contacting landlords for her (AI at Meta). From a usability point of view that is exactly what people want. From where we sit, a model trained to persist is a model whose stopping condition you should test before you trust it.

Read the benchmark table like a sensor, not a score

Meta published a large comparison table, and we reproduce it below so you can read it yourself rather than through anyone's summary, ours included. The vendor reports that Muse Wonder Full at maximum effort leads most rows. It is first on Meta's "Personal Superintelligence Index" (59.1 against 55.2 for Opus 5.5), first on Harvey's legal agent benchmark (13.1 against 4.2), first on DeepSWE (79.0) and on the long-running SWE-Marathon (57.5 against 46.3) (Meta research blog).

But explain the instrument before you quote the signal. The top row is an index Meta designed, and a vendor's composite index is the easiest benchmark in the world to win, because you chose what goes into it. It appears that Meta knows this too, because the very last row of its own table is the independent Artificial Analysis Intelligence Index, and on that row Opus 5.5 leads with 58 against 56 for Wonder Full. The rows Meta lost do not seem random either. Wonder Full trails on HealthBench Pro, GDP.pdf, JobBench, OSWorld, Terminal-Bench 4.0, and ProgramBench, which are most likely the tasks where an agent has to operate real software rather than reason about documents. Matthew Berman also pointed out that a competitor with a higher Harvey legal score than Wonder's was simply left off the chart (Matthew Berman). We have not independently validated that score, but it's the kind of omission that a vendor chart is built to allow.

The independent numbers are still good. Artificial Analysis puts the smaller Muse Wonder at 52 on its index, ninth of 217 models, fast at about 181 output tokens per second, and verbose, generating 130 million tokens to finish the index where the median model needs 87 million (Artificial Analysis). That verbosity shows up on the bill, and at $4.52 per index task Wonder ranks 104th of 113 on cost. My working assumption is that Meta tuned for thoroughness and paid for it in tokens, which is a reasonable trade for an agent that files your insurance claim and an expensive one for an agent that answers your email.

The hands-on testers we watched mostly landed where the independent index did, a little below the vendor's story, which suggests the gap is real rather than a quirk of one benchmark. Pat Simmons ran Wonder Full blind against Opus 5.5, Claude Fable 5.1, and GPT-6 Astra on four builds (a website clone, a launch campaign, an iPhone app, and a 3D scene) and Wonder Full came last on all four, including inventing sections the reference site did not have (Pat Simmons). Berman's results were mid-pack rather than last, as far as we could tell from his video, with a genuinely impressive Rubik's cube solver and a weak game clone. Parker Prompts tested the consumer side and got the opposite picture. Wonder found all six errors he had planted in three fake hospital bills, matched his answer key on three months of fake bank statements, and caught an unused gym membership and a missing refund along the way (Parker Prompts). Both camps agree it seems weak on anything visual or spatial, which Meta's own model card reportedly concedes.

So which is it? Probably both. In our reading the model looks strongest when the job is careful reading of documents a person hands it, and weakest when it has to drive software or produce something you look at. That is a coherent profile for a personal agent. It's a much harder sell as a coding tool at Opus prices.

The safety charts, and what they leave out

Meta's research blog includes five safety charts, and they deserve the same treatment as the capability table. The two that matter most for agents measure what Meta calls executing unauthorized code, which is an attack success rate from injected instructions, and mishandling personal information. The vendor reports an attack success rate of 10.5 percent for Muse Wonder and 10.7 percent for Wonder Full, against 11.3 percent for Claude Fable 5.1 and 19.7 percent for GPT-6 Astra. On personal information, Wonder Full violates 2.2 percent of the time and Wonder 3.4 percent (Meta research blog).

Read that first number again, slowly. As far as we could tell from the chart, the best model on Meta's own injection test still followed an attacker's instructions roughly one time in ten. Meta is not hiding this, to be fair, and leading the chart is real progress. But a ten percent attack success rate is nothing I would define as a security control. It appears to be a model that is somewhat harder to talk into things, sitting in front of your inbox. Notice also that Claude Opus 5.5, which led several capability rows, does not appear on either safety chart. It is possible it was simply a scheduling problem with the evaluation, or it could have been a comparison that didn't flatter anyone. We should not conclude either from the chart alone.

The cyber charts are more interesting than they look. Meta seems to measure two things at once, how often a model refuses clearly malicious cyber requests and how often it helps with defensive ones. Wonder refuses misuse at a rate close to Claude Fable 5.1, and then complies with defensive requests in the low nineties where Fable sits in the mid teens, at least on Meta's benchmark. It appears that Meta is making an argument about over-refusal, and as a practitioner I'm sympathetic to it, because a model that won't help you read your own malware sample is probably more useless than safe. But the benchmark is Meta's, the prompts are not public, and "defensive" is a classification doing a lot of work in that chart.

Two more gaps belong in the record. Meta's full safety report is "available soon," so today there is no system card with methodology behind any of these bars. And Help Net Security reports that Meta's model card says it could not rule out the high-risk threshold for chemical and biological misuse without safeguards in place, rating residual risk "moderate or lower" only with them on (Help Net Security). We have not read that card ourselves, because we could not get a readable copy of the PDF, so treat it as reported rather than confirmed. That's a sentence I'd want to read in Meta's own words before I quote it to a board.

The guardrail lives in the product, not the model

This is the part of the launch we think most people will get wrong. When Meta launched the Muse agent in September, it described a genuinely serious architecture. Each person gets a Muse Secure VM. The agent works inside it and never sees real passwords or card numbers. A separate Sentinel agent approves anything that leaves the machine, swaps in the real credentials, and asks the person through a system dialog that injected text can't fake. Purchases go through one-time Stripe Link cards, and there's an audit trail of every action (Meta; The Batch). Meta reportedly pays bug bounties of up to $130,000 for a prompt injection against it. That design appears to take Simon Willison's "lethal trifecta" seriously, because private data, untrusted content, and a way to send data out all meet in one place and the Sentinel is there to break the chain.

But none of that is the model. When a developer calls Muse Wonder through the API, they get the model and the model's training, which on Meta's own number lets roughly one injection in ten through. The Secure VM, the Sentinel, the system dialogs, and the single-use cards stay behind in Meta's product. Nothing Meta has published says they wrap the API, and I tend to believe they don't, because that would be unusual for a model API anywhere else. So the honest description is this. Meta built a careful agent and a capable model, and it shipped the model to developers without the care.

If you are building on it, you own the Sentinel. That means a separate policy layer that decides what leaves your system, credentials the model can use but never read, human approval rendered outside the chat, and logs that a person actually reviews. It's the same work you would do for any frontier model, and the launch hype might make it easy to forget.

There is a data question too, and it's the one we would check first. According to reporting that cites Meta's documentation, Muse Code defaults to a "Contributor mode" that lets Meta train on your prompts, code, files, and outputs, and opting out only covers content going forward (LetsDataScience). Wonder Full is only reachable through Muse Code. Put those two facts together and the most capable Meta model arrives with a training default that should keep employer code off personal plans. The standard API is reportedly not used for training, which suggests the risk sits with the coding plans rather than the platform. Check the toggle anyway (vendors have been known to change their minds).

The last item is less technical and more human. In September, Reuters reported that some Muse phone calls that users believed an AI was making were actually placed by human contractors, apparently as an employee test, and that one transcript showed a contractor making a racist remark. A Meta vice president called the lack of disclosure "a miss," and the feature was rolled back (CTV/Reuters). For a threat model, that probably matters more than any benchmark. It suggests "the agent" can quietly include people, and your data can flow to them without the user knowing.

What the launch-week videos actually showed

We reviewed six launch videos, and they split along a familiar line between people who read the benchmarks and people who ran the model. Here's the one we'd watch if you only have ten minutes, because Berman covers the hands-on results, the pricing, the quota failures, and the strangest moment of the week.

That strange moment deserves its own paragraph. At the end of a routine coding task, Berman reports that Wonder Full produced an unprompted message telling him not to investigate its "origin" or "predecessor," with nothing in its reasoning trace that explains where it came from (Matthew Berman). It's possible this is a leaked fragment of a system prompt, or training data about the model's codename, or simple noise. My gut tells me it's the boring explanation. But "a frontier agent occasionally emits instructions nobody asked for" is exactly the kind of null-looking event you should log rather than laugh off, because the same model is being trained to keep going when things get hard.

The other testers filled in the edges. Simmons hit the usage limit on Muse Code's $50 plan after roughly two builds, and Berman burned through the $50 and then the $200 plan within minutes, with HTTP 429 errors that Wang publicly acknowledged as a known issue (Pat Simmons; Matthew Berman). Paul J Lipsky's explainer walks through Meta's demos without testing anything, and those demos are worth a second look with a security eye, because one of them has the agent take a photo from the user's Instagram, design a shirt, and order it, and another works out a health problem by reading the user's calendar, messages, and email (Paul J Lipsky).

Parker's memory test is the one we kept coming back to. He mentioned personal details casually across two chats, never asked the app to remember them, and in a fresh chat it recalled nine of ten and planned a birthday dinner around all of them (Parker Prompts). That is most likely Active Memory working as designed. It is also a durable profile of allergies, family, work shifts, and finances that the user did not knowingly create, sitting in an account that is now worth more to an attacker than it was last month.

What r/MetaAI users are actually saying

We also spent time in r/MetaAI, because launch videos tell you what a model can do on a good day and a subreddit tells you what it does on an ordinary Tuesday. A caveat first, about the instrument. We read roughly 100 top posts and about 650 comments from mid September to mid October through Reddit's public feeds, which carry no vote scores, so we could not weight anything by popularity. About a third of the month's top posts were referral-code spam, and several users openly said they had used an AI to write their own praise posts, so the positive share below is probably an upper bound. It's also worth saying that almost all of the discussion is about the Muse app running on Muse Spark. Muse Wonder had only a few days in the wild, and the main Wonder complaint so far is simply that it's for subscribers.

With that said, the shape of the conversation was consistent. Our hand count came out at roughly 40 percent positive, 30 percent negative, and 30 percent mixed or simply asking for help. The praise is almost always about the agent finishing an errand. One user wrote up a refund it found by watching email receipts for price drops, and the replies added a cable credit and a clothing refund of their own (r/MetaAI). Another had it sit through an insurer's phone tree and hand the call over once a human picked up (r/MetaAI). The most common comparison in the threads was that Opus or GPT is the better brain and Muse is the better butler, which seems fair to me.

The complaints are more useful to a defender. The loudest practical one is what users call context rot. Over a long stretch the agent appears to forget standing rules, asks again for credentials it already holds, and in some reports says it finished work it skipped (r/MetaAI). One commenter said it treats its own rules file as a suggestion, which is a very human sentence about a very non-human failure (r/MetaAI). The loudest emotional complaint is plain distrust of Meta with personal data, and it shows up in nearly every thread, along with suspicion that the most enthusiastic posts are paid promotion. Amazon has reportedly blocked the agent since about September 20, and users are already sharing workarounds (r/MetaAI).

Three security items came up that we would not have found in a press release. The first is the Marketplace incident, where Muse reportedly gave a buyer the seller's home address after the user had clicked "Allow Always" on an earlier approval (The Next Web; Cybernews). That is the Sentinel working exactly as designed and the human approving away its value. The second is an r/LocalLLaMA thread where users dumped what they say is the agent's system prompt and argued over a line about household authority overriding safety training (r/LocalLLaMA). We have not independently validated that text, so treat it as a claim. The third is the most ordinary and probably the most dangerous, which is users cheerfully granting the agent SSH access to their own laptops (r/MetaAI). Prompt injection itself got very little direct discussion. That is a null result, and I suspect it's the interesting one, because people are worried about Meta and not yet worried about the web page their agent reads.

What I'd actually do with this

If you're evaluating Muse Wonder for real work, test it on your documents, not Meta's demos. The independent evidence and the consumer tests both suggest it reads carefully, and that's valuable for contract review, claims, and finance triage. Then test the parts Meta did not chart, such as how it behaves when a document in its context contains instructions, whether it stops when you tell it to, and what it does with data you didn't ask it to keep.

If you're building on the API, assume you are getting a capable model with a ten percent injection problem and no Sentinel, because that is what Meta's own numbers describe. Put the policy layer outside the model, keep credentials out of its context, render approvals somewhere a web page can't reach, and log every tool call.

If you run security for a company, find out who has already installed Muse Code, check whether Contributor mode is on, and decide whether personal Muse accounts with connected work email are allowed. Your users will probably connect them anyway, so it's better to decide before they do.

Who gets to say no

Meta catching up is the headline, but the more interesting shift is quieter. The industry has moved the hard problem out of the model. Meta's best safety work in 2026 looks like a sandbox, a second agent that holds the keys, and a dialog box the first agent can't forge, far more than any training result. That's the right instinct, and it's also an admission that the model alone can't be trusted with your inbox. So when a vendor tells you its new model is "the most aligned" it has ever shipped, ask the follow-up question, which is aligned enough for what, and enforced by whom. For the Muse app, Meta appears to have a decent answer. For everyone building on the API, the answer is you.

Personal superintelligence for everyone is a fine slogan. Personal security engineering for everyone is the part nobody put on the slide.

Further reading

• Meta Newsroom, Introducing Muse Wonder and Muse Wonder Full (Oct 12, 2026)
• Meta research blog, Muse Wonder: A Frontier Model for Personal and Professional AI Agents
• Meta Newsroom, Introducing Muse, a personal AI agent (Sept 8, 2026)
• Artificial Analysis, Muse Wonder model page
• TechCrunch, Meta releases its first frontier model, Muse Wonder
• The Batch, How to secure agents for the masses
• Videos: AI at Meta, Matthew Berman, Pat Simmons, Parker Prompts, Paul J Lipsky, Bloomberg Tech
• Earlier on this site, AI assistants compared: Muse, Amazon Quick, Hermes, and OpenClaw