Weekly News Roundup: CW42 - Three releases, three price tags

Three labs put a model on the table this week, and the pattern was the same each time: a price, a benchmark table, and a gap between the two that only shows up if you read the second page. Meta’s Muse Wonder scores 56 on Artificial Analysis, a number that belongs to a version the API does not sell, Google’s Gemini 4 Argon is cheap until 30 November and then is not, and DeepSeek’s Flash refresh beats two flagships on the benchmarks it selected. The security stories had less to do with what models can do than with who could reach them, from a renderer sandbox to a conference room to the provider keys behind a coding tool.

tl;dr

• 🧠 Muse Wonder arrives, and the weights follow: Meta lists $4 and $20 per million tokens on the API, the 56 that circulated belongs to the subscription-only Muse Wonder Full while the callable model scores 52, and Muse Spark Open shipped its weights three days later.
• 🔷 Gemini 4 Argon opens to everyone: Google made it globally available on 13 October at an introductory $2 and $10 until 30 November, then $4 and $20, with the free tier left out.
• 💸 The cheap tier gets cheaper: GLM-Legal lands 7th of 79 on Vals’ independent Harvey LAB run at $0.15 a task, two OpenCode slots go free for a limited time, and DeepSeek’s Flash refresh holds its prices while beating two previous-generation flagships on its own selected benchmarks and trailing Opus 5 by 9.5 points on Terminal-Bench.
• 🧨 XBOW builds a Chrome chain in six days: three bugs chained into code execution outside the renderer sandbox, Google’s first $250,000 full-chain reward, and about $40,000 in API charges by XBOW’s own accounting.
• 🔐 What Anthropic measured, and what got taken: Anthropic reports a 90 to 99% distillation reduction with no third-party verification, GLM-5.2 is the only open-weight model to finish a replication cycle in an upper-bound test whose intrusion step was deliberately trivial, an engineer was charged over a recording device, and a Console breach may have exposed provider keys for 1.4% of OpenCode Console users.
• ⚡ Maia 300 and the megawatt claim: Microsoft’s 40% more tokens per megawatt has no disclosed baseline, the announcement post says per watt, and production starts in 2027.
• 🖥️ Local inference on hardware you already own: Pi turns NVIDIA’s llama.cpp recipes into presets on an RTX Spark laptop, and PS5LM’s own table puts a jailbroken PlayStation 5 at about 20 tokens a second in a GPU build on roughly 2-bit weights.

Muse Wonder arrives, and the weights follow

Meta’s first frontier family arrived on 12 October with two models behind one pricing table. Muse Wonder runs through the Meta Model API and Muse Code at $4 for input and $20 for output per million tokens, with cached input at $0.20, a 1M-token context, text, image, video and audio in and text out, trained at Meta’s Prometheus data centre. Muse Wonder Full is the other one: Muse Code only, on the Power Usage and Maximum Usage plans, and not served through the API at all. Meta frames the pair around Active Memory, which carries context across conversations, and Active Focus, which keeps working through blockers, and calls it the step after Muse Spark.

The number that travelled fastest was 56. Artificial Analysis does score a Muse model at 56 on its Intelligence Index, but the 56 belongs to Muse Wonder Full at maximum effort, which is the model nobody can call. Muse Wonder (max), the one the API serves, scores 52. At 56, Wonder Full ties Claude Sonnet 5.5 rather than taking a clean second place, two points behind Opus 5.5 at 58, and the API model’s cost comes out at an estimated $4.52 per index task. Artificial Analysis also reports gains over Muse Spark 1.3 at 48 on all ten index evaluations, with the biggest jumps in the agentic ones: Terminal-Bench 4.0 from 33% to 57%, and GDPval-AA up 176 Elo. The “Fable-class” label on the circulating post is the poster’s; Meta’s own comparison set is Fable 5.1 and GPT-6 Astra, and Artificial Analysis places Fable 5.1 at 53.

Three days later Meta put weights on the table. Muse Spark Open is 816B total parameters with 42B active, a mixture of experts at 256 experts per layer and 8 active per token across 62 layers, with a 1M context, multimodal in and text out. The checkpoints come in BF16 at about 1.5 TB and in NVFP4, which needs at least 700 GB of VRAM. Small enough for two Apple M5 Ultra Mac Studios with 512 GB of unified memory each through MLX, and hosted by Baseten, Fireworks, Groq, Modal, Nebius, OpenRouter and Together. The licence is Meta’s own Muse Model License rather than an OSI one, and “most capable US open-weight model” is Meta’s claim scoped to US labs, which leaves Chinese open-weight models outside the comparison.

A reply under the launch post put the distance between a table and a trial in one line: “I don’t find the model to be anywhere near what the benchmarks would suggest.” That is one reader’s experience against a vendor table, and the Artificial Analysis scores above are the nearest thing to a second opinion available this week.

The takeaway: the price on the API is the part anyone can check, and the model that carries the 56 is not the one that price buys.

Gemini 4 Argon opens to everyone

Google moved Gemini 4 Argon from a limited release to global availability on 13 October, in Koray Kavukcuoglu’s post on the Google blog. It is in the API through AI Studio and the Gemini platform, in Antigravity for AI Ultra subscribers, and in the Gemini app and AI Mode in Search for Ultra and Pro subscribers. The free tier is not included, and neither is AI Plus at launch.

Google lists the introductory pricing at $2 for input and $10 for output per million tokens with cached input 95% off, held until 30 November 2026, when it returns to $4 and $20. The model id is gemini-4-argon and the context is 1M unified input and output tokens. The first step was a 30 September release to Fairwind cyber defenders, and the launch material still leans on cyber work.

Every performance figure here is Google’s: first on the Vals Index, 87% on ERQA, shortcut attempts down to 2%, a 0.7% attack success rate on the Gray Swan indirect prompt injection benchmark, and under 1% bio sub-task unlocking in external red teaming. No independent run of them turned up this week. CW41 covered two Google releases, an embedder and an image model; this one is the frontier tier, at a price that doubles on 30 November.

The cheap tier gets cheaper

The week’s lowest per-task number came from a legal model. GLM-Legal is built on GLM-5.3-Flash, 320B total with 18B active, and Z.ai reports 19.2% all-pass on the Harvey LAB benchmark, 12.5 points above the base model’s 6.7%.

Vals AI ran it independently and got 19.17%, which puts it 7th of 79 at $0.15 a task against $10.55 for Gemini 4 Argon and $19.23 for Claude Fable 5. On LegalBench the same model scores 86.23% against Fable 5’s 88.56%, so “matches frontier models” is parity on the older benchmark and a lead only on Harvey LAB. Four Meta models score higher on Harvey LAB, Muse Spark 1.2 at 25.42%, Spark 1.3 Max at 23.75%, Spark 1.3 at 22.92% and Muse Wonder Full at 21.67%, and none of them appears in Z.ai’s comparison chart. Access is application only: no published price, no weights, not yet in AutoClaw, and at 1 hour 12 minutes per task it was the slowest run in Vals’ top ten.

Two days later the cheap tier stopped being a price at all. DeepSeek V4.1 Flash appeared as a free slot inside OpenCode on 15 October, and GLM 5.3 Flash followed on the 16th, both for a limited time and both served by a zero-retention provider. Free is a separate slot rather than a price cut: the paid deepseek-v4.1-flash stays at $0.30 and $1.20 on OpenCode’s list, and paid GLM 5.3 is $1.40 and $4.40 next to paid GLM 5.3 Flash at $0.15 and $0.50. The free slots carry 200K of context rather than 1M, a detail reported by users and by third-party testing rather than in the docs.

A third-party test on 16 October got an HTTP 403 FreeTierError from the raw endpoint, which points at the free path working inside the OpenCode app and not against the API directly, and that is testing rather than a stated policy. One paying subscriber reported a rate-limit error on the free entry while the paid one stayed chargeable, which is a single report.

Then DeepSeek closed the week with a model refresh at September’s prices. DeepSeek V4.1 Flash-1017 lists at $0.15 and $0.60 per million tokens off-peak, $0.30 and $1.20 at peak, with cache hits at $0.003 off-peak, unchanged from V4.1-Flash. On DeepSeek’s own table it beats GPT-5.6 Sol at 73.0 and Opus 5 at 74.0 on DeepSWE v1.1 with 77.0, and beats both on Automation-Bench with 60.5 against 45.8 and 50.3. The same table has it losing Terminal-Bench 4.0 at 42.3 to Opus 5’s 51.8, HLE without tools at 42.6 to 56.3, and ProgramBench at 29.1 to 37.0. “Beats GPT-5.6 Sol and Opus 5 on selected coding and agent benchmarks” is literally true, and the selection quietly skips a 9.5 point Terminal-Bench loss. Both comparators are previous-generation flagships; Opus 5.5 and GPT-6.1 Sol are the current ones.

DeepSeek also opened the Search and Fetch APIs to everyone at $0.75 per 1,000 successful requests each, with server-side calls through DeepSeek Harness, Claude Code and Codex free until billing starts on 31 October 2026 at 16:00 UTC.

XBOW builds a Chrome chain in six days

XBOW published the write-up on 13 October under the title “Zero to Calc in Six Days”, credited to Brendan Dolan-Gavitt. The chain combined a V8 compiler bug, an animated-WebP decoder bug and a memory-safety bug in Crashpad, and turned JavaScript running in an ordinary tab into code execution outside the renderer sandbox. Google paid the first $250,000 Chrome full-chain reward under the rules that took effect in April 2026.

The workflow is the part worth reading. Six days, 2 to 7 August 2026, run as parallel campaigns rather than one agent working end to end: broad search, V8 memory corruption, V8 sandbox escape, renderer sandbox escape, and integration. Agents on gpt-5.6-sol searched, tested and built stages while the researchers picked targets, challenged results and decided which components to join. XBOW puts the API bill for those six days at about $40,000.

For scale, the post notes that a Chrome full chain used to take a team of four six to nine months, and that XBOW’s own first submission took two months. An AMA with the author ran on 14 October and no transcript turned up.

The shop’s earlier write-up explains what the day count is really measuring, and it was published outside this edition’s window: No Time to Pwn went up on 28 September. It describes CVE-2026-72018, an out-of-bounds write in the Linux kernel’s SMC-D driver reachable by an unprivileged user with CAP_NET_ADMIN, turned into root from a primitive of 16 zero bytes at a partially controlled offset with no separate leak. XBOW’s argument is about the judgment call rather than the primitive, since a human would likely have rated the primitive too weak to chase. Both write-ups stop at what was crossed, and so does this section.

The thread from CW41’s cyber section is the same question a week on. That edition measured whether models can find and reason about vulnerabilities at all, with the best system at 0.229 File F1; this one shows what a research shop does with the capability, splitting the search across agents while its researchers choose the targets and join the results.

The takeaway: the six days are not a claim that agents do this alone. They are a claim about how much faster a small team moves when it splits the search across agents and keeps the judgment for itself.

What Anthropic measured, and what got taken

Anthropic published two research posts on 12 October, and the more alarming one is careful about its own limits. The self-replication study, by William Zhou and Daniel Freeman, put 11 open-weight models through a replication task across emulated Android nodes. GLM-5.2 was the only one that completed the full cycle, reaching 8 of 8 nodes in 4 of 5 trials. The intrusion step was deliberately kept trivial, the nodes were the redroid Android emulator, and Anthropic calls the result an upper bound in a simplified evaluation.

The physical half of the story is smaller and stranger: 15 off-brand Android TV boxes at about $55 each ran Gemma4-26B-A4B spread across them at 0.39 tokens per second, and a 9B model got inference running on 8 of 9 hardware types. The scale is what makes the experiment worth reading about. Anthropic says there is no full rogue replicator today, that doubling times would be measured in days, and that a Kimwolf-sized botnet of two million devices would host about 133,000 copies of a 26B model, worth at most roughly 40 H100s. Models at 30B and under complete many of the steps and mischain them. “Months away” is Anthropic’s projection, not a measured date.

The distillation post carries the number everyone quoted. Anthropic reports a 90 to 99% reduction in harvested data since its defenses went in, with reasoning-token extraction down 10 to 100 fold. The 20,000-plus fake accounts that travelled with the coverage come from Anthropic’s February 2026 report on a single proxy network, not from this post.

The mechanism is “preserved thinking”, which stops API accounts created after 31 August 2026 from editing Claude’s prior context, plus a two-stage classifier with false positives below 0.1% and bans within two hours of a detected campaign. The post names Zhipu, distilling cyber capability into GLM-5.3 after switching away from Fable 5 when safeguards degraded its attacks, and Moonshot, forwarding Kimi requests to Claude including a surveillance-analysis request it links to the PLA, and cites CAISSI’s assessment of GLM-5.3 as the most cyber-capable open-weight model released. Anthropic’s own supporting result: a model distilled from full reasoning transcripts scored 80.4% on SWE-bench Verified against 71.8% from summarized reasoning. No third party has verified the 90 to 99%, and Anthropic says it turned away paying traffic and that some legitimate users were caught in enforcement.

The same week had an incident no model caused. On 13 October the Justice Department announced that Abdulrahman Alfozan, 35, a Saudi national and US permanent resident who had been an OpenAI engineer since July 2025, was arrested on 9 October and charged with intercepting oral communications. The device was found on 30 September: a Seeed XIAO ESP32-S3 Sense board, about $14 at retail, wrapped in toilet paper and plugged into the USB port behind a television in an executive conference room, its contents encrypted. A second, similar device turned up in his bag on 5 October. The complaint describes chatbot queries about building and concealing a continuous audio recorder, about Wi-Fi connectivity and SD-card encryption, and internal tool queries about meeting rooms and calendars. OpenAI says it used its own models to understand the device and where it came from, referred the matter to the FBI and terminated the employee, and that it has no indications of exfiltration of weights, source code or customer data. That last one is the company’s own check.

The week closed with the credential story. On 17 October OpenCode told customers that a breach “related to a large scale distillation attack” had touched 1.4% of OpenCode Console users, all of whom were emailed that morning, that only users with external providers linked were affected, that the incident was ongoing and that it was working with Anthropic, OpenAI and Google. The email describes unauthorised access to a legacy system in the process of being decommissioned and says provider keys “may have been exposed”. Two corrections travel with it. “Keys stolen” is stronger than the company’s own wording, which cannot confirm misuse. And the scope is OpenCode Console, the hosted gateway that stores provider keys, not the coding agent: co-founder Dax Raad says keys used in the regular app never reach the company. The post is OpenCode’s only first-party account: it has not published how access was obtained, how long it lasted or how many keys, and there was no status-page entry or GitHub advisory at the time of writing. Reports of unexpected provider bills, one at $100 in a day, are user reports.

The takeaway: a measured defence and a reached-for credential are different problems. Anthropic’s numbers are about slowing a lab that harvests carefully, while the device and the legacy system are about what one employee and one decommissioning schedule could reach.

Maia 300 and the megawatt claim

Microsoft announced on 12 October that it will scale its Maia family to multi-gigawatt deployments starting in 2027, and introduced Maia 300 alongside. The post frames the scaling as the point where Maia becomes the primary inference system for Microsoft’s own products and services. Scott Guthrie’s post says the new chip delivers 40% more tokens per megawatt than leading GPU-based systems, and the company’s EMEA release says the same thing. The X post that carried the announcement says “per watt”, which is a different claim by six orders of magnitude, and it is the version a lot of people read.

What is in production is Maia 200, which Microsoft says delivers up to 1.7x more tokens per watt for built-in AI in Teams and Copilot and is deployed in the US, Europe and Australia. Maia 300 production deployments begin in 2027. Microsoft gives its shape for the reader who wants it: multi-chiplet with compute on TSMC N2P, eight HBM4 stacks at 288 GB and 18 TB/s inside a 950 W TDP, 96 accelerators in a 167 kW rack, up to 7x rack-scale token throughput over Maia 200 and more than 2.5x performance per watt.

The 40% has no disclosed baseline. No competing GPU is named, no model, no serving configuration, no batch or latency envelope, and Maia is not rentable as an Azure instance, so nobody outside Microsoft can test it.

Local inference on hardware you already own

Pi added a local path on 13 October. The docs describe how NVIDIA’s Local AI Inference Recipes bridge into llama.cpp: a recipe’s llama-server command becomes a preset ini, loaded with --models-preset, so a tuned recipe arrives as a single router model entry that Pi’s /llama and /model commands manage. One trap: llama-server has to start without --model or -m to stay in router mode. NVIDIA’s playbook puts Qwen3.8-27B at 24 to 48 GB of memory.

The next day brought a cheaper host. PS5LM runs Qwen3.8-27B on a jailbroken Sony PlayStation 5 at just over 20 tokens per second, and the project’s own table is specific about how: UD-Q2_K_XL at 9.2 GiB with 32k of context and 20.3 tok/s, UD-IQ2_XXS at 6.8 GiB with 64k and 20.7 tok/s. Both are roughly 2-bit quantisations, and full precision would need about 54 GB, which will not fit on a 16 GB console. Smaller models move faster, with Gemma 4 E4B at 61 tok/s and Llama 3.2 3B at 124. The build uses llama.cpp’s Vulkan backend on the console’s RDNA 2 GPU with 11.4 GB of shared memory from 16 GB of GDDR6 at 448 GB/s, needs a jailbroken console on firmware 7.00 to 13.60 which voids the warranty, exposes OpenAI and Anthropic compatible endpoints on port 8081, and pulls about 86 W while the 27B model generates.

Replies to the post argued that the project page used to describe a CPU-only payload at 13 to 21 tok/s on a 0.8B model, which was true of an earlier version; the current repository documents the GPU build. The useful part of that exchange is the qualification. The 27B figure depends on the GPU port and on 2-bit weights, and a 2-bit model at this size trades quality for fit. Prompt processing is the other cost, reported at 35 to 50 tok/s of input, which turns a long coding prompt into minutes before the first token.

Elsewhere this week

Away from the main thread this week. Smaller things, each worth its own line.

Obsidian built a Mermaid renderer of its own and shipped it as a package anything can use. Pele takes Mermaid syntax and returns SVG with zero runtime dependencies, themes through CSS variables so colours change without a re-render, and covers every diagram type in Mermaid 12.1.0 with its own layout engine rather than Mermaid’s. The project’s table puts the bundle at 230 kB gzipped against 1.6 MB, render times at 0.05 to 0.3 ms against 6 to 82 ms, and no direct dependencies against 23, which is where the “500x” headline comes from. It is MIT, built for the next Obsidian version, and usable by anything that wants Mermaid without the runtime.

Xbox started a lab and published the memo rather than a product. The group is game makers, engineers and scientists under CTO Scott Van Vliet, with no products, no dates and no team size. What it does have is Asha Sharma’s framing: games get decompiled and rebuilt for hardware they were never designed for, Windows builds get ported to Apple Silicon or into a browser through WebAssembly and WebGPU, and agents suit games for the same reason they suit coding, because they can write, run and test the result. Her number is 72 billion hours of play a year, about five times global coding time. The memo never uses the word AI.

Apple’s new home display is HomeView: a 7 inch screen at $299, pre-orders from 13 October and on sale 13 November, with a wall-mounted variant at the same price. It recognises up to six people by face, runs an A18 with Secure Exclaves, and ships in eight countries but not the EU, because Siri AI is unavailable there. It is John Ternus’s first launch as CEO that is not an iPhone.

TinyFish is now a Hermes plugin, which brings search and fetch into the agent on a path the company advertises at $0. The demo that came with it fills an empty spreadsheet, and the company’s own numbers from 7 October put it at 300,000 users, up from 100,000 in September, with 83.8 million search requests and 1.46 million agent runs in thirty days. “For $0” describes the plugin, not unlimited free usage.

Cisco’s DefenseClaw Edge Connector moves the fast decisions to the device: Cisco puts an ALLOW or BLOCK decision at microseconds, unseen tool calls escalate to the main DefenseClaw instance, and the connector denies when that instance cannot be reached. The demo is a Raspberry Pi robot, and in the injection scenario the request is blocked before the model runs, so no inference happens. The latency figure is the vendor’s, and the project docs are Apache-2.0.

Kurt Kaufmann, who runs application security at Blizzard, gave a talk at CruiseCon AI & Privacy 2026 that trade press covered on 14 October. No transcript or recording of the talk was published, so the quotations here are as that coverage reports them. His useful distinction is that AI is good at reconstructing an unfamiliar architecture, the trust boundaries, data flows and authorization paths, and that what it produces is a working hypothesis rather than a verified map. Testing the Mythos system against Blizzard titles produced a handful of verified findings instead of the expected avalanche, which he counts as a success because unreproducible findings never reached engineering. His summary of the tool: “simultaneously one of the most useful and most confidently stupid tools I have ever worked with”.

Felix Rieseberg’s essay on ambition splits the idea into four kinds, Speed, Altitude, Depth and Range, and works them through a QBR example that asks what changed this quarter, why, what to do about it, then names the three most urgent decisions and argues both sides of each. His most portable rule: use an outside judge rather than asking the model to grade itself. He works on Claude and says so.

Anatomy is a Claude skill that invents a machine from one line of description and draws it: the repository builds solid isometric parts, adds WebGL for fire, water and plasma, audits its own geometry and reads screenshots of every joint. Two things the post gets wrong are worth fixing here. These are solids, not wireframes, and nothing rotates by default; the rotation is an optional 3D mode marked beta. The project says a figure takes a long session and that it is not a chart library. It was posted on 10 October 2026, before this edition’s window, and the thread’s suggestion that it could become an official Hermes skill got a yes from the author.

Closing

Every release this week arrived with a price and a benchmark table, and the two did not always agree. The claims that held up were the checkable ones, like Vals’ independent run of GLM-Legal at $0.15 a task, or Artificial Analysis scoring two Muse models separately instead of one.

That’s the week. See you in CW43.