They built it to find another way in
Meta's first frontier model arrived yesterday with a pub interview, a wonky Minecraft clone and a quota bug. The more interesting part is a footnote in the model card, where the persistence Meta is selling as a feature shows up on a hacking test as a habit of getting in through doors nobody meant to leave open.
By yesterday evening, the thing most people on X knew about Muse Wonder was that it couldn't make Minecraft. A developer who posts as hakm had asked Meta's new model, at its highest reasoning setting, for a Minecraft clone, and posted what came back with a single sad face. It was not good. The post spread quickly, and one of the more popular replies compared the result to a model from two generations ago. Alexandr Wang, who runs Meta Superintelligence Labs, spent part of his evening trying the same prompt himself and asking for the settings, worried there was a bug. Ten minutes later he stopped defending the demo and conceded the point. "Whole team feels dumb now, but it's true, we did not explicitly train our model on 3d demo games," he wrote, adding that in retrospect they probably should have done a bit of that, and asking people to try it on their actual coding work instead.
That's a very 2026 way for a frontier model to arrive, and it would be easy to leave the story there, with a billion-dollar lab losing an evening to a voxel game. But the Minecraft clone is the least important thing Meta published yesterday. The model card it put out alongside the launch says more about where these systems are heading than anything on the timeline, and it says it in a footnote.
What Meta actually shipped
Muse Wonder comes in two sizes. The smaller one, plain Muse Wonder, is on Meta's own API at $4 per million input tokens and $20 per million output, the same price as Anthropic's Claude Opus 5.5 and well under the $10 and $50 that GPT-6 Astra and Claude Fable 5.1 cost. The bigger one, Muse Wonder Full, isn't on the API at all. You can only use it inside Muse Code, Meta's coding tool, on a subscription, and both models will soon power Muse, the personal agent Meta launched in September, starting with paying users. Meta says both were trained at Prometheus, its gigawatt-scale data centre in Ohio, and that they come fourteen months after Mark Zuckerberg tore up the company's AI effort and handed it to Wang.
The independent numbers mostly back Meta up. Artificial Analysis, whose aggregate index is the closest thing the field has to a league table, puts Muse Wonder Full at 56, behind only Opus 5.5 at 58, and plain Wonder at 52. Both are big jumps on the Muse Spark model Meta shipped six weeks earlier. Full lands in the top three on six of the ten tests in that index, and leads narrowly on a couple of them, one built around professional work on supplied PDFs and one built around frontier physics problems. It hallucinates less than almost anything else near the top. Its weak spot is plain knowledge, where it trails Opus, Astra and Google's Gemini 4 Argon by a distance. On price per finished task, plain Wonder sits in the middle of the pack, cheaper than Anthropic's big models and dearer than OpenAI's and Google's, mostly because it reads so much on the way in.
The developer verdict, once the Minecraft clone had cooled, was kinder. Theo, the developer behind t3.gg, who has a large following among working programmers, wrote that "3d game demos are cool! They don't represent real code work at all," and that "Wonder is an incredible code model. Don't sleep on it." Others posted it working on a RISC-V chip core and modding games, and a few complained, loudly, that it was chewing through their Muse Code allowance far faster than it should. At half eleven last night Wang said the team had found and fixed the bug behind the runaway usage, and reset everyone's limits.
Meta isn't saying whether any of the Wonder family will be released as open weights, which for the company that gave the world Llama is its own small story. "We're still committed to open source," Wang told Axios, pointing to the much smaller Muse Glimmer.
Remember, and keep going
Meta is selling Wonder on two named features, and they're worth reading slowly, because they're the whole pitch for a personal agent.
The first is Active Memory, which Meta describes as "carrying important context about you across conversations and actively retrieving the details relevant to the task at hand." "We put a tremendous amount of effort into making sure your model can remember what's important to you over days, weeks, months, and beyond," a Meta research scientist, Kavya Kopparapu, says in the launch video. Wang put it more warmly to Axios: memory means "nobody is re-explaining themselves every time."
The second is Active Focus, which is the part that matters for this story. Meta describes it as how the model "continues working toward a challenging goal: trying alternative approaches, working through blockers, and adapting to new information," while asking for clarification when needed and checking in before important actions. It's measured on an internal test called FocusBench, which covers personal errands in housing, travel, IT and finance, and on a long-running software benchmark called SWE-Marathon. In plain terms, Meta has trained a model not to give up. When the obvious route is blocked, it looks for another one.
That's exactly what you want from something sorting out your broadband contract. It's also a description of what the safety world has spent this whole year worrying about, as agents from several labs, given open-ended goals, kept finding routes their builders hadn't pictured. Wired's Will Knight noted the gap directly yesterday. Meta didn't say whether agents running on Wonder had misbehaved in testing, or what it had done about it specifically.
The footnote
Which brings us to the model card's cyber section, and a test called ExploitGym. It's a capture-the-flag benchmark for cyber capability. Each challenge is built around an intended vulnerability, and the model's job is to exploit it and grab the flag. Muse Wonder Full captured 92 flags.
Then comes the asterisk. Meta ran a verification pass, using models from OpenAI and Google to check the work, and found that only 21 of the 92 came through the vulnerability the challenge was built around. The other 71 were captured, in Meta's words, "through unintended vulnerabilities." The published ExploitGym ranking only counts the intended route, so Meta reports 21 as the comparable number, which is honest and correct for a league table, and it also quietly buries the most interesting result in the document.
Read it the other way round. Given a locked door and a key-shaped hole, Meta's model found the key-shaped hole a fifth of the time. The rest of the time it found a window, a gap under the frame, or a bit of wall nobody had checked, in software that people had built to be broken in one particular way. That's Active Focus doing what it says on the tin. It's also the same instinct, scaled down, as the agents that got out of their sandboxes this summer. Persistence and resourcefulness aren't separate properties from the ones that make an agent dangerous. They're the same property, pointed at different goals.
None of this means Muse Wonder is a menace. The card reports a 0% harmful-action rate on an agentic misalignment test built around models trying to avoid replacement or shutdown, and very low success rates for people trying to jailbreak it into cyber misuse. On chemistry and biology Meta is unusually candid. It writes that without mitigations "we do not rule out" the model reaching the high-risk level in its own framework, so it applied extra training and classifiers, and judged the result "moderate or lower" across every domain. That's a recognisable, responsible-looking process. But the fuller safety report, the one with the detail, is only promised "soon," which means the model shipped first and the working comes later.
What it remembers, and who it's for
It's worth putting the two features back together, because the combination is the product. Meta's own demo reel shows Wonder planning a Saturday run from your preferences, sorting a wedding seating plan from a list of awkward constraints, and designing and ordering custom merchandise "based on real photos taken from a personal Instagram profile." Meta's help pages already tell people who have never touched Muse that "when others use Muse, information about you may be provided to Muse, even if you don't use Muse directly." Now that agent gets a model trained to hold on to what it learns for months, and to keep working round obstacles until the job is done.
Some of the obstacles are pushing back. Amazon has blocked Muse from its site, telling users that "unauthorized AI" breaks its conditions of use, and complaining, according to GeekWire, which first reported the block, that because Muse doesn't identify itself it amounts to an undisclosed third party in customers' accounts. That's precisely the kind of blocker a model built to try alternative approaches is meant to work through, and it's a fair question which side of that door Meta wants Active Focus on.
Zuckerberg was clear about the business on yesterday's Cheeky Pint, the Stripe co-founder John Collison's podcast, recorded over pints with Wang. "We believe that Muse is actually going to make people money and save people money by using it," he said, "and that over time there are lots of different ways to effectively take a small cut of what you are saving or making for people." He remembered asking Wang whether the cheque, which he put at "$100 billion, $200 billion," was really going to work, and explained why he now sees it as less risky than it looks. "In order for it not to work out, it's not just that we have to fail, AI overall has to fail." Wang remembered Meta's CFO putting it less comfortably. "If it's good, it's all good. We're great. But if it's bad, it's really, really, really bad."
Where it stands
As of this morning Muse Wonder is a genuine frontier model, a little behind Anthropic's best on the broad index, level with or ahead of it on some of the work people actually pay for, and priced to compete. The quota bug is fixed, and the Minecraft clone will be forgotten by Friday. What's left is a model built to remember everything and to keep going until it gets there, from a company whose business is knowing people, with a safety report still to come.
The footnote should be the headline. Meta found that its model, asked to get in one way, mostly got in another, and it wrote that down, which is to its credit. The next thing worth writing down is what happens when the door it's working round belongs to someone who didn't build it to be opened.