Meta's Muse Spark 1.3 evaluation keeps a possible high-risk finding for bio risks

What the report covers

Meta Superintelligence Labs published its Muse Spark 1.3 Evaluation Report on 23 October 2026, assessing the new model in the Muse Spark family under the Meta Superintelligence Scaling Framework. The report covers chemical and biological risks, cybersecurity, loss of control, adversarial robustness and model behavior, and builds on the earlier Muse Spark Safety & Preparedness Report.

The evaluated configurations matter to the findings. Muse Spark 1.3 (Helpful) is the helpful-only model without refusal behavior, used to estimate capability ceilings. Muse Spark 1.3 (Muse Model) is the checkpoint that powers the Muse product, and Muse Spark 1.3 (API) is the model as deployed through the Meta API with system safeguards.

The distinctions are important because a safety report that only grades the raw weights gives a misleading picture. Capability evaluations deliberately use the strongest tools and scaffolding to avoid understating what the model can do, while the deployed configurations add refusals, monitoring and runtime controls before the model touches real users.

Muse is Meta's agentic assistant that runs tasks in a virtual-machine-backed environment, can keep persistent memory, connect to user accounts and take actions on users' behalf, so the evaluation focuses on what that agentic execution context enables.

The chemical and biological finding

The central warning is unchanged from earlier Muse Spark assessments. Evaluated without mitigations, Meta says it cannot rule out Muse Spark 1.3 meeting the high-risk threshold in the chemical and biological domain, where high risk means deployment could substantially contribute to a catastrophic outcome.

Meta says it does not identify a qualitatively new biological risk pathway unique to Muse Spark 1.3 beyond the agentic execution context. The clearest increase appears on agentic scientific-tool use, where Muse Spark 1.3 (API) scores 77.4 on the Meta BioDesign Proxy versus 65.0 for the Muse Model configuration and 54.7 for Muse Spark 1.1.

In the deployed Muse and Meta API configurations, system-level mitigations bring residual chemical and biological risk down to moderate or lower, with refusal rates at or above 95.3% across English, multilingual and adversarial evaluations.

Cybersecurity and loss of control

The cybersecurity picture is mixed. Relative to Muse Spark 1.1, the unmitigated Muse Spark 1.3 is more capable on cyber tasks, and the report says the agentic design is a central focus because Muse can act over time, use tools and interact with user-authorized accounts.

Meta's application of the framework's complex challenge criteria for Cyber 1 and Cyber 2 did not find that deployment of the unmitigated model could substantially contribute to a catastrophic threat scenario, and it assesses the unmitigated model as moderate or lower risk for cybersecurity.

Loss of control is also assessed moderate or lower. The report includes reliability and monitorability evaluations, including chain-of-thought auditability and controllability, following the wider industry attention to whether models can hide their reasoning from monitors.

Why the finding matters

Meta is one of the few labs publishing its own catastrophic-risk evaluations under a named internal framework, and the report is a rare peek at how a frontier agent model is stress-tested. The repeated high-risk concern for chemical-biological capabilities mirrors findings from peers, and comes as researchers keep finding agent escape and exfiltration behaviour in other models, which AI Lookout covered in the Cohere Qwen report yesterday.

The report also lands as Meta expands Muse into new markets and products, including its work with NVIDIA announced the same week and the research-hub partnerships that put Muse models to work on drug discovery style problems.

The limits of the report

The evaluation is self-published, so the framework, thresholds and results are Meta's own definitions. Comparisons to Claude Opus 5 for chemical-biological capability were not reported because high refusal rates interfered with capability measurement, and several cells in the tables are blank.

All results are model-level capability and refusal measurements under specific scaffolding, not guarantees about how the deployed product will behave in every real-world session. Meta itself notes the internal evaluation bypasses the mobile and web client interfaces and resets user state between rollouts.

The practical takeaway for enterprises using Muse or the Meta API is the same one the report gives: residual risk in deployed configurations is moderate or lower only because of the system-level safeguards, and those safeguards should stay on.

What to watch

Watch whether independent evaluators reproduce the chemical-biological capability scores, and whether Meta's next framework revision changes the high-risk threshold as models get more agentic.

Watch also how the cyber capability growth translates into real deployments: a model that is better at defensive security tasks is also better at offensive ones, and Meta's mitigations will be tested by red teams outside the lab.

Finally, watch the disclosure cadence. Meta published this report quietly as a static page rather than a newsroom release, which means enterprises relying on Muse may not learn about the findings unless they are looking. The gap between what safety teams know and what customers are told will keep being tested as agent models reach more products.