Oct 13: Meta's Muse Wonder and Anthropic's AI Worm Warning

Meta launched Muse Wonder and Muse Wonder Full, closed models near the top of the leaderboards. Anthropic researchers warn that small AI models could soon spread copies of themselves across cheap devices, and Anthropic says new defenses cut distillation of Claude by 90 to 99 percent. Also: Epic reportedly tells its Disney game team to stop writing code by hand, plus Microsoft's Maia 300 chip and a hack of French supermarket fridges. **Meta launches Muse Wonder, its first closed frontier models** Muse Wonder Full ties Claude Sonnet 5.5 at 56 on the Artificial Analysis index, but it runs only inside Muse Code, and neither model has downloadable weights. Meta AI Research · Artificial Analysis · VentureBeat **Anthropic: small AI models could soon spread across cheap devices** In a sealed test network, GLM-5.2 spread a worm to every machine in 4 of 5 runs, and small models could reach that level before this year ends, though no such worm has been found in the wild. Anthropic · AI Weekly **Anthropic says distillers now extract 90 to 99 percent less** New defenses protect Claude's reasoning, and Anthropic again names Zhipu, which it says tried to distill Claude Fable 5 while building GLM-5.3. Anthropic · Reuters (via BusinessWorld) · Decrypt **Microsoft unveils Maia 300 inference chip** Microsoft claims 40 percent more tokens per megawatt than leading GPU systems and plans to make Maia the main inference system for its products from 2027. Official Microsoft Blog · The Verge **Microsoft's Claude spending for Copilot set to top 2 billion dollars** Citing one source, The Information reports that Copilot chief Charles Lamanna pushed Satya Nadella to pay for Claude after complaints about Excel and PowerPoint work. AI Weekly · AI Weekly **Hackers heat fridges in hundreds of French supermarkets** Hackers took over Danfoss refrigeration controllers, heating fridges at about 150 Intermarché stores to 50 degrees Celsius and hitting 80 Carrefour stores. Help Net Security · ABC News (Australia) **Broadcom's Hock Tan compares AI investors to casino gamblers** Tan said many AI investors do not understand what they are putting money into, rejected the idea that OpenAI is overvalued, and said capital may become the biggest bottleneck. Bloomberg via Yahoo Finance · The Standard (Hong Kong) **Brad Smith calls for global AI safety rules led by Britain** Microsoft's president wants legal incident reports, warnings to victims of rogue agents, emergency brakes and outside sign-off before release. BBC **Zhipu releases GLM-Legal agent** Built on GLM-5.3-Flash, GLM-Legal passes about 19 percent of tasks on Harvey's legal agent benchmark, and Vals AI ranks it seventh of 79 models. Z.ai · Vals.ai **Codex CLI now runs a background server by default** Since version 0.157, the server keeps running after users close Codex, and a GitHub issue asks OpenAI to switch the default back. GitHub · GitHub **Epic goes AI first as engineers debate AI-written code** Epic reportedly told its Disney game team "No more hand-written code," while a Harvard study, QGIS's ban on AI contributions and Rich Hickey's essay suggest more code does not mean more finished software. Bloomberg (via Yahoo Finance) · Ars Technica · QGIS · Rich Hickey (LinkedIn) · yyhh.org *The most important news from Silicon Valley and AI. 15 minutes, every weekday morning.* **Transcript** Good morning. It's Tuesday, October 13, and this is the Valley Morning Briefing. Today: Meta released Muse Wonder, a closed model near the top of the leaderboards. Researchers at Anthropic say small AI models could soon copy themselves across cheap devices. The company also says distillers now extract 90 to 99 percent less from Claude. And Epic reportedly told its Disney game team to stop writing code by hand. Let's start with Meta. On Monday, Meta launched two new AI models, called Muse Wonder and Muse Wonder Full. Independent tests put the larger one near the top of the leaderboards. The models come from Meta Superintelligence Labs, the group Alexandr Wang has led since Mark Zuckerberg rebuilt Meta's AI work about 14 months ago. Meta trained both at Prometheus, its gigawatt-scale data center in Ohio. Zuckerberg called Muse Wonder a family of frontier models for personal and professional agent work. Meta says the models remember what matters to a user across conversations, and keep working toward a goal when they hit a problem. On the Artificial Analysis Intelligence Index, Muse Wonder Full gets a score of 56. That ties Claude Sonnet 5.5 and beats GPT-6 Astra and Gemini 4 Argon. Only Claude Opus 5.5 scores higher, at 58. Meta's previous model, Muse Spark 1.3, came out six weeks ago and scored 48. Vals AI, another independent leaderboard, puts Muse Wonder Full in fifth place, ahead of every OpenAI model. Artificial Analysis says Muse Wonder Full has one of the lowest hallucination rates among the top models. General knowledge is still a weak spot. But Muse Wonder Full is harder to get. It is not on Meta's API, and runs only inside Muse Code, Meta's coding agent, on plans that cost 50 or 200 dollars a month. By default, those plans let Meta train on users' code. The API offers the smaller Muse Wonder, at the same price per token as Claude Opus 5.5 and twice the price of GPT-6.1 Sol. Wang told CNBC it would be priced meaningfully below OpenAI and Anthropic. Artificial Analysis found that it costs less per task than Anthropic's models. It costs more than OpenAI's models, because it reads so many input tokens. Meta's Llama models helped make open-weight AI popular. Neither of the new models has downloadable weights, so Meta's best models are now closed. Some early tests were less positive. Dan Shipper, the CEO of Every, called the result on Every's senior engineer benchmark disappointing. That benchmark asks a model to rebuild a messy codebase from scratch. Meta's model scored 52 percent, and GPT-6.1 Sol scored 71. Shipper's post does not say which of the two Muse Wonder models was tested. Carl Franzen of VentureBeat wrote that Meta is back in the race. He also wrote that Meta's launch table mixes in-house tests, scores supplied by other vendors, and different coding tools. The benchmarks for memory and focus come only from Meta's own testing. Last Wednesday, we reported TIME's finding that Muse, Meta's agent app, builds detailed files on its users and the people they mention. Meta says Muse Wonder will soon power that app, first for paying subscribers. The company says a full safety report will follow soon. Researchers at Anthropic say that, within months, small AI models could be able to spread copies of themselves across cheap internet-connected devices. They name smart ovens and no-name Android TV boxes as examples. William Zhou and Daniel Freeman of Anthropic's Frontier Red Team published the work on Monday. No such AI worm has been found in the wild. AI safety researchers have long worried about a model that spreads itself without human control. This study asks whether that could happen on cheap, poorly secured devices. A worm would carry the model weights with it and run them on each hacked device, so there would be no central point to switch it off. The team ran three separate tests. First, they bought 15 TV boxes for about 55 dollars each. They split a Gemma 4 model with 26 billion parameters across the boxes themselves. The whole cluster ran it at under half a token per second. Second, they asked small models to get another model running on unfamiliar hardware. A small Qwen model managed it on 8 of the 9 hardware types they tried. Third, they built a sealed network of 8 emulated Android machines in Google Cloud and planted a worm on one of them. Only one of the open-weight models they tested, GLM-5.2, spread reliably. It reached every machine in 4 of 5 runs. The other models failed. The researchers call this result an upper bound. The entry port had no password. And GLM-5.2 itself ran on an outside server, because the machines were too small. But the researchers point out that the Mirai botnet spread simply by trying factory default passwords. Right now, the models that can do this are too big to run on the devices, and the models that fit on them are not capable enough. If small open models keep improving at their past rate, they will match GLM-5.2 before this year ends. Zhou and Freeman call that a rough projection. Some findings favor defenders. Such a worm would be slow, and would take days to double in size. Even across 2 million TV boxes, the size of the Kimwolf botnet, it would have the computing power of about 40 H100 chips. And moving gigabytes of weights between devices would show up in internet providers' traffic data. But small models also improved when they passed notes to their next copy. Their success at setting up a model rose from 45 percent to as high as 84. Anthropic's own proposed defenses rely on internet providers and device security, such as quarantining infected customers and Britain's rules against default passwords. Last Wednesday, we covered Nathan Lambert's argument against banning open-weight models. The newsletter AI Weekly expects this work to add pressure on open-weight releases. Anthropic said on Monday that new defenses have cut the data that copycat labs pull out of Claude by about 90 to 99 percent. In distillation, a lab sends millions of requests to a stronger model and trains its own model on the answers. Anthropic says distillation itself is a normal training method. It objects to covert campaigns that run on fake accounts and stolen payment details. The most valuable data is Claude's reasoning, the thinking it writes out before it answers, so that is what the new defenses protect. Claude already shows users only a summary of its reasoning. In an Anthropic test, a model trained on full Claude Opus 4.8 reasoning scored about 80 percent on SWE-bench Verified. A model trained on the summaries scored about 72. So attackers began asking Claude to reveal its full reasoning. One lab tried 12,000 different tricks. The new defenses work in three ways. First, on Claude Fable 5.1 and Claude Opus 5.5, accounts opened since late August can no longer edit the earlier conversation. That was a common trick to unlock hidden reasoning. Second, a new filter catches requests that try to extract the reasoning. Anthropic says the filter is about as strong as the one that blocks help with bioweapons, and that it wrongly blocks fewer than one request in a thousand. Third, accounts that keep trying face tighter limits and bans. Anthropic says it has banned tens of thousands of them, often within two hours of a campaign starting. The 90 to 99 percent figure is Anthropic's own estimate, and it covers only its own platform. Distillers also go through cloud platforms and resellers, so Anthropic is asking those companies to act too. It says it has not yet faced a highly sophisticated and persistent attempt to get around the defenses. Anthropic also lists the costs. It turned away trillions of tokens of paid traffic, and some developers had to update their integrations. Customers now also pay for the rare request that gets blocked. The post again names China's Zhipu, also known as Z.ai. Anthropic says Zhipu tried to distill Claude Fable 5 while it was building GLM-5.3. When the safeguards of Claude Fable 5 got in the way, Zhipu switched to an older Claude model and to another lab's model. That account first appeared in Anthropic's September report, which named seven Chinese labs. Zhipu did not immediately respond to Reuters. Since Anthropic first named Chinese labs in February, critics have called its complaints hypocritical. Tory Green, a co-founder of the AI infrastructure firm IO.Net, wrote at the time: "You trained on the open internet and then call it distillation attacks when others learn from you." Anthropic says its concern is fraud, and models that are released without strong safeguards. Its September report also says some Chinese labs sent their own users' private requests to Claude without asking them. Now, the quick hits. Microsoft unveiled Maia 300, the third generation of its in-house AI inference chip. Microsoft says that from 2027, Maia will be the main inference system for its products. Memory bandwidth is about two and a half times that of Maia 200, while compute is only about a third higher. Microsoft claims the chip delivers 40 percent more tokens per megawatt than leading GPU systems. It does not say which GPU, and outsiders cannot test the chip. The Information reports, citing one source, that Microsoft's spending on Claude in Copilot is set to top 2 billion dollars a year. Copilot chief Charles Lamanna pushed Satya Nadella to pay for Claude after customers complained that Copilot was not good enough at Excel and PowerPoint work. Claude did better at those tasks. It also costs more. Microsoft is still weighing Anthropic against OpenAI on quality and margins. Hackers took over refrigeration controllers in hundreds of French supermarkets on Sunday night. At about 150 Intermarché stores, they heated fridges to 50 degrees Celsius overnight. Carrefour says 80 of its stores were hit. Paris prosecutors say the attack also caused fires. The controllers are made by the Danish company Danfoss, which says the affected units ran outdated firmware. France's national cybersecurity agency is investigating. Broadcom CEO Hock Tan said on Monday that many AI investors do not understand what they are putting money into, and compared them to gamblers in a casino. He blamed the investors, and rejected the idea that OpenAI is overvalued. Tan also said capital may become the industry's biggest bottleneck. Microsoft President Brad Smith told the BBC: "Your washing machine is subject to more safety rules than AI." Smith wants global rules, led by Britain. They would include legal incident reports, a duty to warn victims of rogue agents, emergency brakes, and outside sign-off before release. He called the White House's voluntary pledge a necessary step that is no longer sufficient. Yesterday, we covered Satya Nadella's own call for an emergency brake. Zhipu, the lab named in Anthropic's distillation post, released a legal agent called GLM-Legal on Monday. It is built on Zhipu's small GLM-5.3-Flash model. It is not clear whether GLM-Legal's weights are open. The agent passes about 19 percent of tasks on Harvey's strict legal agent benchmark. That is almost three times the score of the base model, and Vals AI ranks it seventh of 79 models. Last Wednesday, we reported Mistral's claim of 15 percent on the same test. Since version 0.157, OpenAI's Codex CLI starts a background server by default. The server keeps running after users close Codex, and it updates itself every hour. The feature first shipped as opt-in in September. Users report killed tasks, reset permissions and environment variables leaking between projects. A GitHub issue asks OpenAI to switch the default back, and OpenAI has not replied there. Bloomberg reports that Epic Games has delayed its Marvel and Star Wars shooter with Disney, and told the team to build it AI first. One of the game's directors wrote to staff: "No more hand-written code." Developers are to use tools such as Anthropic's Claude, with humans guiding the work. All art will come from AI workflows. Bloomberg says this is the first time a major game company has tried to build a title mainly with AI. Some developers were stunned, and some joked about asking Claude to fix its own mistakes. This week, engineers were already arguing over whether AI-written code means more finished software, or mainly more code that humans then have to review. On the AI-first side, Epic's communications director, Jake Jones, said the company is embracing AI-accelerated development, led by its developers as the creative drivers. The project had fallen behind, partly because Epic underestimated the staff and time it needed. A programmer who signs as Huahai makes the broader case, in a reply to an essay by Rich Hickey. Huahai writes that compilers and spreadsheets also do work on their own, and that they are still tools. The question, the reply argues, is whether a skilled person directs the AI, tests its output and rejects what is wrong. On the skeptics' side is a study by the Harvard researchers Fiona Chen and James Stratton, with data from more than 700 software companies. After firms adopted coding agents, lines of code rose 30 percent. But the rate at which teams finished features did not change in a statistically significant way. The time from pull request to merge rose by about half. And the share of pull requests sent back for changes nearly doubled. The study's data ends in March, and agents have improved since then. Open-source maintainers report the same problem. Last week, the mapping project QGIS banned AI contributions. Under its old rule, which required a human in the loop, about 40 of 50 AI-assisted pull requests were closed without being merged. The project also lost a valued contributor. Hickey's own essay argues that a tool is something you control with constant feedback, and that this is how skill grows. By that test, the essay says, AI is automation, and people who hand off the work miss learning how to think. Hickey writes: "A drive-thru is not a tool for cooking, it is automation for avoiding cooking." That's the Valley Morning Briefing for Tuesday, October 13th. If you enjoy the show, the best way to help is to send it to a friend. Thanks for listening, and see you tomorrow.