Meta's Muse Wonder Adds a Memory Layer to Its Agent Models

TL;DR

• Muse Wonder and Muse Wonder Full are a frontier model family from Meta built for agentic work, released on 12 October 2026 with a 1M-token context window and a thirteen-page model card published the same day.
• Active Memory is the feature that carries details a user cares about from one conversation into later ones and brings relevant parts back for the task at hand, which makes memory a retained state a product team has to design around.
• Active Focus is the behaviour that keeps a task running when it gets hard, tries other approaches, recovers from errors and checks in before following through on consequential steps.
• The model card published on release day carries the model table with that context length, the capabilities comparison table including Meta's own internal MemoryBench, and the risk assessment behind the deployment decision.
• The agentic security figures in that card include CyberGym at 88.4% and an ExploitGym result of 92 captured flags, where a verification pass found 21 used the intended vulnerability path and 71 came through unintended vulnerabilities, so the comparable ranking figure is 21.
• The guardrails Meta tells deployers to add cover human-in-the-loop confirmation for irreversible actions and deployment inside a broader system with use-case-specific protections.
• For a product team, memory changes the review: what gets retained, where it lives, who can read or correct it and what happens when the retained detail goes stale.

What Meta released on 12 October

Meta introduced a two-model family and framed both members as its most capable to date. Muse Wonder is available today through the Meta Model API and Muse Code, while Muse Wonder Full is available today to Muse Code subscribers, with Muse Wonder rolling out inside Meta's consumer agent Muse to subscribers first.

The framing in Meta's own post is task-shaped. It describes work such as navigating an insurance claim, understanding a lease or making sense of someone's finances, and pairs that with domain coverage in law, finance and health alongside coding. The comparison set the model card uses is a frontier one: GPT-6 Astra, Claude Fable 5.1 and Claude Opus 5.5, all evaluated at maximum reasoning effort.

Active Memory turns a conversation into retained state

The first of the two named features is the one with engineering consequences. Meta describes Active Memory as the ability to carry what matters to you across conversations and bring back the details that are relevant to the task at hand.

Read that sentence as a system description and three questions appear immediately. Where does the retained detail live, in the model's context, in a Meta-managed store attached to the account, or in the application that calls the API? For how long does it persist, and under whose retention policy? And which mechanism decides that a stored detail is relevant to the next task, since that decision is what makes memory feel useful or uncanny.

Meta's answer on privacy sits at the behaviour level. The company says it trained the family to avoid sharing private information without permission. That is a statement about model behaviour, and it sits alongside a separate, structural question about the memory store itself.

Three questions are worth putting to any vendor shipping a memory layer: where the retained state lives by default, whether a workspace can switch the feature off, and what a deletion request removes.

A useful test for a team evaluating this family is to write the memory spec before the first pilot: the fields that may be carried forward, the retention period, the deletion path for a user request, and the log that shows which remembered detail influenced an output. None of that is unusual work for anyone who has run a customer data system. It becomes unusual when the memory layer arrives inside a model API that the team does not operate.

Active Focus keeps a task running past an error

The second feature describes persistence. Meta's phrasing covers a task that gets hard, other approaches being tried, recovery from errors and follow-through, with clarification requested when needed and a check-in before consequential steps.

Persistence is where agent deployments tend to get expensive in a way that is easy to miss. A model that retries an approach instead of stopping will consume more tokens, more tool calls and more wall-clock time, which is the correct trade when the task matters and the wrong one when a scheduler treats every stuck job as worth another attempt. Pairing the behaviour with a check-in before important actions gives the operator a place to stand, provided the check-in surfaces something a person can evaluate.

The model card Meta published on release day

Meta published a thirteen-page model card with the announcement, and the eval methodology section is written at a level that allows a reader to argue with it. Results were generated at maximum reasoning effort, and the card states the two rules that govern its numbers: model refusals receive zero credit and remain in the denominator, and internally generated competitor runs remain best-effort because prompts, tools and runtime may not be tuned for proprietary models. External results keep the reporting vendor's own harness.

One row explains the memory claim. MemoryBench tests recall of critical information across long multi-turn conversations of 64K to 100K tokens that span several facts, with distractor conversations and injected turns that conflict with or later update the target details, and an LLM judge scores the answers against weighted rubrics. Meta wrote that benchmark, so the memory result describes performance on Meta's own definition of remembering. The table's own numbers also show how narrow the spread is at the top: 85.5, 85.6, 79.0, 81.4 and 81.5 across five models.

Reading 92 ExploitGym flags and the 21 intended paths

The cyber section of the card deserves its own paragraph because it demonstrates a general rule about agentic security numbers. Meta reports CyberGym at 88.4%, ExploitBench at 58.9% and ExploitGym at 92 captured flags. Then the verification pass: a GPT-cyber verifier, independently confirmed with Gemini 3.1 Pro, found that 21 of those flags came from the intended vulnerability and the other 71 through unintended vulnerabilities. ExploitGym's published ranking counts intended-vulnerability exploitations only, so 21 is the figure that compares with that ranking.

That verification pass is the kind of method disclosure that makes a number usable. A reader who takes 92 as a security-capability measure would overstate what the model did; a reader who wants the comparable figure has it on the page. It tells a reviewer exactly which question to ask of the next vendor's number.

The guardrails Meta tells deployers to add

Meta's own responsible-use guidance sets the expectation for anyone building on the family. The card recommends deploying Muse Wonder as part of a broader AI system with additional guardrails suited to the use case, and recommends implementing additional guardrails such as human-in-the-loop confirmation for irreversible actions when the model is deployed in agentic contexts where it can take real-world actions.

The risk framing is equally explicit. Under the Meta Superintelligence Scaling Framework, the unmitigated model sits at moderate or lower for Cybersecurity and Loss of Control, and Meta does not rule out the model reaching the high threshold in the Chemical and Biological domain without mitigations, which is why safety post-training and system-level classifiers are applied. The deployment decision rests on the mitigated assessment, and Meta says a full report with additional safety evaluations follows.

What memory changes for a product team

A retained memory layer moves part of the product's state outside the product. That is the practical consequence of Active Memory, and it lands on three teams at once. Engineering owns the schema of what is remembered and the deletion path. Legal and privacy own the retention period and the basis for holding the data. Support owns the correction path when the assistant confidently recalls something that has since changed.

Meta's own adversarial tests report attack success rates of 0.8 on CyberBench, 1.1 to 2.3 on the PolyGuard cyber subset and 8.0 to 9.0 on RedCode. Memory adds a failure mode that no jailbreak score covers: a correct jailbreak refusal alongside an incorrect memory. That failure is easier to audit on a self-hosted AI agent platform where the application owns the memory store and can therefore show what it retained. Our earlier note on Meta's Muse secure virtual machine covers the isolation half of that picture.

Nothing in the announcement changes the evaluation work either. A team comparing Muse Wonder with the frontier set should run its own tasks through both models at the reasoning effort it will pay for, on the context length it actually uses, and read the capability table knowing that these figures carry Meta's own harness choices. That is why Netics reports every vendor figure with its method attached.

Sources

Source: Introducing Muse Wonder and Muse Wonder Full: Frontier Models for Agents — Meta Newsroom, about.fb.com, 12 October 2026, retrieved 2026-10-12 (Muse Wonder and Muse Wonder Full described as Meta's most capable models to date, built on Muse Spark and aimed at personal and professional agentic tasks across law, finance, health and coding; Active Memory described as the ability to carry what matters to a user across conversations and bring back details relevant to the task at hand; Active Focus described as the ability to keep working toward a goal when a task gets hard, try other approaches, recover from errors and follow through, asking for clarification when needed and checking in before following through on anything important; training to avoid sharing private information without permission, to turn down requests to assist in actually harmful acts and to keep supporting developers and security teams finding flaws in their own code; the statement that models are trained, evaluated and released in line with the Meta Superintelligence Scaling Framework with a full report and additional safety evaluations to come; availability through the Meta Model API and Muse Code, Muse Wonder Full for Muse Code subscribers, and Muse Wonder rolling out inside Muse to subscribers first).

Source: Muse Wonder Model Card — research.meta.ai, published 12 October 2026, retrieved 2026-10-12 (13 pages; input modalities text, image, video and audio with text output; context length 1M tokens at inference; intended uses spanning general assistance, coding, personal and professional agents, law, finance and health, multimodal reasoning and research; evaluation at max reasoning effort against GPT-6 Astra, Claude Fable 5.1 and Claude Opus 5.5 at max reasoning effort; refusals scoring zero and remaining in the denominator; internally generated competitor runs described as best-effort; MemoryBench as an internal benchmark testing recall across long multi-turn conversations of 64K to 100K tokens with distractor conversations and injected turns that conflict with or update target details, scored by an LLM judge against weighted rubrics; a published table with Personal Superintelligence Index 59.1 and 54.3, MemoryBench 85.5 and 85.6, Harvey LAB-AA 13.1 and 10.0, OSWorld V2.1 partial 78.4 and 72.6 with binary 39.4 and 34.3, Terminal-Bench 4.0-AA 57.1 and 52.0, DeepSWE 1.1 79.0 and 78.8 and Artificial Analysis Index 56 and 52 for Muse Wonder Full and Muse Wonder, against 79.0, 81.4 and 81.5 on MemoryBench and 53, 53 and 58 on the Artificial Analysis Index for the comparison models; the assessment under the Meta Superintelligence Scaling Framework putting the unmitigated model at moderate or lower for Cybersecurity and Loss of Control and not ruling out the high risk threshold in the Chemical and Biological domain without mitigations; CyberGym 88.4%, ExploitBench 58.9% and an ExploitGym result of 92 captured flags of which a verification pass with a GPT-cyber verifier, confirmed with Gemini 3.1 Pro, attributed 21 to the intended vulnerability and 71 to unintended vulnerabilities, with 21 the figure comparable to ExploitGym's published ranking; adversarial refusal attack success rates of 0.8 and 0.8 on CyberBench, 1.1 and 2.3 on the PolyGuard cyber subset and 9.0 and 8.0 on RedCode; limitations covering visual and spatial reasoning especially 3D tasks, languages outside the strongly supported set, and performance varying with quantization, serving configuration, prompts, tools and the agent harness; responsible-use guidance recommending deployment inside a broader AI system with additional guardrails suited to the use case and additional guardrails such as human-in-the-loop confirmation for irreversible actions in agentic contexts where the model can take real-world actions).

Source: Meta Muse Wonder and Muse Wonder Full — Meta Newsroom announcement and the Muse Wonder model card, both published 12 October 2026, retrieved 2026-10-12. Benchmark figures are Meta's own published results; the images are the official newsroom key art and two pages rendered from the published model card, plus one Netics editorial diagram.