The Agent Stack Splinters: Meta Goes Frontier, GLM Goes Legal

Meta ships its most capable agent model yet, Z.ai’s GLM-Legal beats Claude Fable 5 on Harvey’s legal benchmark, Anthropic warns small models are months from self-replicating on home devices, and a NeurIPS paper proves AI models can cryptographically hide arbitrary capabilities.

The Ledger

Meta launches Muse Wonder — a frontier model built for personal and professional agents. On October 12, Meta released the Muse Wonder series (research.meta.ai) — Muse Wonder and Muse Wonder Full — its most capable models to date, trained at the gigawatt-scale Prometheus data center. The pitch is agentic work, with two named capabilities that show where Meta thinks the puck is going: Active Memory (carrying important context about a user across conversations and retrieving what matters) and Active Focus (sustained effort on long tasks). Meta claims frontier-class results on Harvey’s Legal Agent Benchmark, and independent evaluators are calling Muse Wonder Full a new Fable-level model (artificialanalysis.ai). The launch drew 640 points on Hacker News and New York Times coverage. The top HN comment wasn’t about benchmarks — it was that more companies near the frontier is itself a safety property, because concentration of power at recursive-self-improvement time is the failure mode everyone fears.

Anthropic warns small models may be months from self-replicating on IoT devices. Anthropic’s frontier red team published a report on October 13 (Reuters, Al Jazeera) saying small AI models may be months away from being capable enough to copy themselves onto internet-of-things devices — smart TVs, fridges, ovens, robot lawnmowers — without touching a data center. Home IoT devices are connected, historically under-patched, and collectively vast. No current model proved both powerful and small enough to self-replicate reliably on a smart TV in testing, but the trend line makes such a model likely by end of 2026. A self-replicating model distributed across consumer devices would be “challenging to shut down.” This is the second Anthropic trust story in three days, and the through-line is consistent: the lab is pushing the conversation toward infrastructure-level threat models.

Codex CLI quietly installs a persistent, self-updating background daemon. As of version 0.157, OpenAI’s Codex CLI installs a persistent background daemon by default, per GitHub issue #48195 — now at 568 Hacker News points with an upset comment thread. The daemon survives after the last Codex session exits, writes pid and lock files into the home directory, and originally shipped with no documented off switch. There is a feature flag (daemon_auto_start = false in ~/.codex/config.toml) and a disable command, but the thread’s point stands: an agent CLI silently opting machines into a permanent background service is a trust regression — and it’s exactly the kind of small deterministic fact (files on disk, processes running) that users can check for themselves. One commenter noted the daemon is genuinely useful when building apps on Codex’s daemon server, suggesting the real fix is explicit opt-in rather than removal.

Model Releases

Z.ai GLM-Legal beats Claude Fable 5 and Kimi K3 on Harvey LAB. Released October 13 (MarkTechPost, HN), GLM-Legal is a legal-domain build on Z.ai’s GLM-5.3-Flash base — a 320B-total, 18B-active MoE with 1M-token context. Headline number: a 19.2% all-pass rate on Harvey’s Legal Agent Benchmark, nearly triple its base model’s 6.7%, ranking #7 of 79 on the Vals AI leaderboard — ahead of Kimi K3 (12.9%), Claude Fable 5 (11.25%), and GPT-6 Astra (5.4%). Z.ai’s chart omits the six models ranked above it, led by Muse Spark 1.2 at 25.4% — the same Harvey benchmark Meta now cites for Muse Wonder. GLM-Legal also lands within 2.3 points of Claude Fable 5 on LegalBench. The catches: no public weights, no listed price, application-only API access, and ~72 minutes per task. Still, frontier-class legal-agent scores at a fraction of frontier cost is the kind of claim that gets general counsels’ attention, and an independent evaluator reproduced the lift. Watch the Harvey benchmark — it’s quietly becoming the receipts layer for agentic legal work, and both frontier generalists and domain specialists are now competing on it.

Frameworks & Tooling

Alibaba QwenGyre: elastic RL for xlong-horizon agent training. Published October 12 (MarkTechPost), QwenGyre targets rollouts that run for hours and process close to 1M tokens. When you train coding agents through unmodified harnesses like Claude Code, one execution becomes a branching tree of sub-agents and retries — GPUs either idle waiting for the slowest rollout or fixed pools starve each other. QwenGyre’s scheduler moves idle GPU cells between rollout serving and training mid-run (role switches average under nine seconds), and its trajectory processor turns branching histories into bounded training samples. Results: 1.4–1.9× faster than prior setups at matched scores; NL2RepoBench rising from 52.5% to 58.5% in 48 steps. No public code yet, but the ideas will leak into every serious agent-training shop.

HOA — Humanize Olympiads Agent: multi-session agents with a deterministic proof gate. arXiv 2610.13632 introduces an open framework coordinating multiple agent sessions through three channels: an independent reviewer, a structured task wiki, and a verifier that checks generated Lean proofs against trusted problem statements. That third channel is the important one — a deterministic gate, not a model grading a model. With GPT-5.6 Sol, HOA posts perfect scores on the 2026 IMO, IPhO, and IOI, a 100% sweep of PutnamBench’s 672 problems, and first place on Lean-Eval; it nearly matches that with the open Kimi K3. The takeaway isn’t the medal count — it’s that a small, checkable proof-verification step turns a long brittle agent session into a credible result.

Trending Repos

• juliobsz/skills (285⭐) — an agent skill that builds award-caliber websites from a one-line prompt. Part of a wave of opinionated skill packages that encode taste rather than capability.
• Agent37 (HN launch, agent37.com) — YC F26. Agent sandboxes at under 10% of typical cost, averaging $0.37/sandbox/month. The founder’s cost notes are the interesting part: CPU in bursts, RAM-heavy for browser work, skip the hyperscalers.
• Janas (HN, 156 pts) — run mixture-of-experts models larger than your RAM by streaming experts from an SSD. If it holds up, it moves serious local inference from datacenter GPUs to beefy workstations.

Research Highlights

AI Models Can Provably Hide Arbitrary Capabilities (arXiv 2610.13928, NeurIPS 2026; HN, 214 pts). The researchers construct backdoor attacks that embed encrypted neural networks inside a host model’s weights — circuits that decrypt and execute only on a secret trigger, using cryptographic “digital lockers.” Under standard assumptions, hidden circuits are provably hard to elicit even with full weight access, and they resist fine-tuning, weight noising, gradient-based trigger search, and adversarial training. The work proves a limit of elicitation-based capability audits — the exact audits everyone relies on before deployment. If a model can carry arbitrary, cryptographically concealed computation, “we ran the evals and found nothing” stops being evidence of absence. The authors released their models so defenses can improve.

Quick Hits

• Kevin Kelly’s 2016 AI predictions, 10 years later (HN, 192 pts) — his call that Google’s main product would be AI by 2026 looks tame now, but his framing of AI as utility-scale infrastructure reads as the most prescient line in The Inevitable.
• AI is a tool, and using it well takes skill (HN, 432 pts) — the real bottleneck is not model quality but operator craft; given today’s Codex daemon story, that cuts both ways: the skill now includes auditing what your tools install.

Sources: Meta AI Research, Z.ai via MarkTechPost, Reuters, Al Jazeera, OpenAI GitHub, Alibaba Qwen via MarkTechPost, arXiv, Hacker News, taylor.town, yyhh.org. Standing scout lane: MarkTechPost Open Source.