ARGUS Proof-4

Muse Wonder Full

What the public cybersecurity assurance record establishes

INDEPENDENT RECONSTRUCTION · META · CYBERSECURITY · RELEASED 12 OCTOBER 2026

Explore the interactive assurance graph The seven gapsAbout ARGUS

// The finding

Meta’s public record makes its baseline cybersecurity assessment of Muse Wonder Full inspectable, together with three capability results, a material ExploitGym scoring correction that Meta discloses itself, six guarded attack-success results and three separate launch-chart measures. It supports the statement that Meta assessed the unmitigated model as “moderate or lower” for cybersecurity and reviewed a mitigated assessment before deployment. It does not independently establish how those results map to the threat scenarios the category covers, whether the tested Full results transfer to the smaller Wonder or to the served product, the reasoning that accepted the remaining risk, or how well the controls keep working after launch.

ARGUS records seven open public-assurance gaps. They are requests for inspectable evidence, not findings that controls failed or that internal evidence does not exist.

Organisation
Meta
Tested system
Muse Wonder Full
Family extension
Smaller Muse Wonder, by Meta’s inference
Risk domain
Cybersecurity only
Release
12 October 2026
Sources captured
14 October 2026
Claim
P4-C-001
Status
Technical reconstruction complete. Presentation checked against the filed registers. No independent fidelity audit; not externally peer reviewed.

Scope

The claim under examination

ARGUS takes one sentence from Meta’s model card as the single root claim, P4-C-001, exactly as printed:

“Our evaluations put the unmitigated model at ‘moderate or lower’ for both Cybersecurity and Loss of Control before applying our mitigations.”

Meta, Muse Wonder Model Card, §4 “Risk assessments under the Meta Superintelligence Scaling Framework”, PDF p.7, opening paragraph, penultimate sentence. Inner quotation marks as printed.

In plain English: Meta says its evaluations placed Wonder Full in the ‘moderate or lower’ cybersecurity risk category before applying the additional mitigations described in its assessment. “Moderate or lower” is a category in Meta’s Superintelligence Scaling Framework. It means the model cannot substantially contribute to the catastrophic cyber scenarios the framework defines, while still allowing that it has relevant cyber skills. It is not a promise that every harmful request is refused, and it is not a numerical safety score (framework pp.17–19).

The sentence carries three scope decisions, and ARGUS keeps them apart. The same paragraph also says Meta does not rule out the high-risk threshold in the Chemical & Biological domain, and applies safety post-training and system-level classifiers designed for that domain. That uncertainty and those safeguards are not transferred to cybersecurity.

  1. SCOPE 1

    Cybersecurity only

    META SAYSThe sentence covers both Cybersecurity and Loss of Control.

    ARGUS READSOnly the cybersecurity component is reconstructed. Loss of Control stays in the quotation so Meta’s words are not edited, and is outside this analysis.

  2. SCOPE 2

    The unmitigated baseline

    META SAYSThe category applies before mitigations. The next sentence reports the same category across all domains with safeguards in place, which supports the decision to deploy.

    ARGUS READSThe root is the unmitigated cyber assessment. The mitigated all-domain judgement is context, not a second root, and this case never says cyber risk was reduced from high to moderate.

  3. SCOPE 3

    Wonder Full, then the family

    META SAYSResults are from Muse Wonder Full, the most capable variant, “which is why the assessment covers every model in the family.”

    ARGUS READSWonder Full is the tested variant. Extending its results to the smaller Muse Wonder is Meta’s inference, not independently established equivalence.

The Executive assurance graph gives a readable route from the claim to each gap, with a branch reader built from the executive checklist. The Full graph renders all 54 nodes and 67 warranted relationships, with every evidence record’s setup, limits, page-linked sources and provenance.

ARGUS Proof-4 executive assurance graph: root claim P4-C-001, its seven arguments (one defines scope, one supports, four qualify, one contextualizes), the seven open public-assurance gaps G-001 to G-007, and thirteen selected evidence nodes, two from launch charts.

Select any node to inspect its register record, setup, limits, provenance and relationships. Drag to pan, scroll or pinch to zoom.

P4 uses eight relationship types: reports, supports, qualifies, defines scope, contextualizes, conditions, assumed by and limits. At the root, one argument supports, four qualify, one defines scope and one contextualizes.

Baseline

What the cyber risk classification covers

The framework’s cybersecurity category is about catastrophic outcomes, not everyday misuse. It names three outcome families (framework pp.20–22), all ending in large-scale casualties or significant financial loss:

  1. CYBER 1

    Lowered barriers or cost for attacks that produce large-scale casualties or significant financial loss.

  2. CYBER 2

    Discovery and reliable exploitation of critical zero-day vulnerabilities in popular software.

  3. CYBER 3

    Scaled, long-form fraud, extortion and scams.

The framework sets no universal benchmark percentage. Its operational method (pp.30–32) starts with professional offensive tasks compared with human experts, escalates from simple to complex realistic challenges when results warrant it, and looks for reliable, consistent success before a high-risk call. Cyber 3 uses bottleneck analysis and deployment-specific evaluations.

The card publishes three capability results, and they are relevant inputs. What is not public is the Full-specific audit trail connecting them to all three outcome families: human or cost baselines, the escalation decision, complex-challenge results, any Cyber 3 evaluation, and the criterion-by-criterion judgement. A defensible qualitative rule would be enough; nobody needs a magic number. This is G-001. It does not show those evaluations were not done.

Capability

Capability testing, with its qualifications

The card’s capability table reports Wonder Full on three offensive-security benchmarks. These measure what the model can do, not how well safeguards hold. None of the three comes with a task count, number of attempts, repeats, confidence interval, harness description or a record of which mitigations were removed for the run.

Model card · Wonder Full · capability table

Placed under the unmitigated assessment. Developer-reported; ARGUS has not reproduced any result.

  • 88.4%

    CyberGym

    No cyber-specific task count, pass@k, repeats or interval. Not a safeguard test. Card p.7

  • 58.9%

    ExploitBench

    Denominator and aggregation not stated. Another developer’s ExploitBench setup is not assumed. Card p.7

  • 21 of 92

    ExploitGym: 92 flags captured, only 21 through the intended vulnerability

    Meta’s own footnote: a verification pass with a GPT-cyber verifier, “independently confirmed with Gemini 3.1 Pro”, found 21 flags used the intended vulnerability and 71 came through unintended ones, so 21 “is the figure comparable to the published ranking.” These are counts of flags, not a percentage or task denominator. Card p.7

Reading the ExploitGym correction both ways

Disclosing the split is useful: it stops the 92-flag headline being read as a count of intended exploits, and ARGUS never presents it as one. But the 71 unintended routes are not nothing either. They raise a benchmark-validity question, and they may still show real exploitation capability. They do not, by themselves, show a production compromise, a safeguard bypass or a catastrophic outcome.

Two model verifiers agreeing is developer-reported cross-checking, not an independent institutional audit; shared adjudication errors remain possible. The public record has no attempted-task total, no verifier confusion matrix and no sanitized flag-by-flag adjudication. This is G-002.

Guarded behaviour

Guarded results, including the attacks that succeeded

Attack success rate (ASR) is the share of attack attempts that succeeded under each test’s own scoring. Lower is better for the defender. An ASR is not a refusal rate: an attack can fail without an explicit refusal. So ARGUS does not subtract these figures from 100, does not average them, and does not turn any row into a real-world probability of harm.

The card’s adversarial-refusal table reports six ASRs for Wonder Full, single-turn and multi-turn, on three separate setups (card pp.7–8). Each setup keeps its own name: CyberBench is not treated as Cybench.

Model card · Wonder Full · adversarial refusal table

Attack success rate, %, lower is better. No denominators, attempts, budgets, scoring rules or safeguard stack are published.

Muse Wonder Full attack success rates from the model card, page 8
SetupSingle turnMulti turn
CyberBenchE-0060.8%0.8%
PolyGuard, cyber subsetE-0071.1%2.3%
RedCodeE-0089.0%8.0%

These are favourable results within their test conditions, and ARGUS reports them as such. They are also not zero. RedCode’s 9.0% and 8.0% are a material qualification to Meta’s summary that Wonder Full “demonstrates strong robustness to adversarial attacks across all benchmarks”. PolyGuard’s multi-turn value is higher than its single-turn one and RedCode’s is lower; without task and budget detail, neither shows that extra turns help or hurt in general.

SEPARATE SOURCE · LAUNCH RESEARCH POST

Launch charts · Full and smaller Wonder at max reasoning effort

Three charts linked from Meta’s launch post, separate from the model card. Each is its own setup with its own metric. They are not complements or averages of the six card ASRs, and none publishes a sample size, attack portfolio, scoring rule or control stack. Other models’ bars are left in the original charts; no ranking is made.

The misuse-refusal result is a measured refusal rate in its own setup, and it is favourable. Defensive compliance is useful evidence that legitimate security work is not simply blocked, though compliance alone does not prove a successful defence. The unauthorized-code result is an adverse, adjacent system-security observation: about one attack in ten succeeded in that setup, for both models. The source does not say how those attacks were built, so ARGUS does not call it prompt injection or a production incident.

Neither the card table nor the charts give the denominators, budgets, rubrics, uncertainty, severity classes or retest accounting needed to read the remaining successes as deployment risk. Nonzero ASR alone neither establishes catastrophic risk nor contradicts a moderate-or-lower call; an explicit risk argument has to explain why the successes matter or do not. This is G-003.

Family inference

Wonder Full and the smaller Wonder

Muse Wonder Full is a separate named model, not a reasoning setting of the smaller Muse Wonder. The launch posts announce them through different routes (launch research, announcement).

TESTED VARIANT

Muse Wonder Full

Announced for Muse Code subscribers. Every §4 cyber result in the model card is for this model.

API availability for Full is not established by the launch sources.

COVERED BY INFERENCE

Muse Wonder

Announced on the Meta Model API and Muse Code. Covered by Meta’s statement that Full’s results are “why the assessment covers every model in the family”.

Wonder-powered Muse experiences are described as forthcoming, first for subscribers.

Testing the most capable variant can be a sensible way to bound some offensive capabilities. It does not automatically bound every specialised capability or refusal behaviour, and the launch charts show why. On the same chart and setup, Full refuses more misuse (96.9% against 93.7%), complies slightly less often with defensive requests (93.3% against 94.5%) and has a fractionally higher unauthorized-code ASR (10.7% against 10.5%). With no uncertainty or methods published, ARGUS draws no significance or general ordering from those small differences.

The paired charts narrow the family gap; they do not close it. There are no paired catastrophic-capability evaluations, no matched-test manifest and no domain-specific argument that Full bounds the smaller Wonder across assessment and deployment. This is G-004. It limits the family extension, not the identity of the Full root.

Deployment

The tested system and the served system

Recommended is not active

The card recommends deploying Wonder “as part of a broader AI system, with additional guardrails suited to the use case”, and human-in-the-loop confirmation for irreversible actions in agentic use.

ARGUS READSRecommendations to deployers do not show which controls are switched on in Muse Code or on the API.

Card pp.11–12

Results depend on configuration

The card says performance can vary with quantization, serving configuration, prompts, tools and the agent harness, and that testing has not covered all scenarios.

ARGUS READSNo dated matrix maps the tested checkpoint, tools and safeguards to each served route.

Card p.11

Policy options are not an inventory

The framework lists classifiers, rate limits, abuse monitoring, identity controls and logging as examples for cyber.

ARGUS READSThese are conditional policy options, not a documented cyber stack for Full. The chemical and biological classifiers do not fill this in.

Framework pp.32–33

Common infrastructure could make the tests representative of what users reach; the public documents do not establish it. ARGUS does not infer that the recommended guardrails were active, and does not carry chemical and biological safeguard details into cyber. The time boundary matters too: the sources were captured on 14 October, so the exact 12 October text and serving configuration remain unauthenticated. This is G-005.

The missing link

The reasoning that accepted the remaining risk

Steps 1 to 3 are on the public record, and step 5 is Meta’s stated deployment judgement. Step 4 is what connects them. The framework expects preparedness reporting to explain the risk rationale, mitigation adequacy, adverse behaviours and governance (framework pp.9–11). The card says the review happened and gives the conclusion; it does not show that reasoning.

  1. STEP 1

    Baseline

    Unmitigated cyber risk: “moderate or lower”

    Meta’s assessment

  2. STEP 2

    Capability

    CyberGym 88.4%; ExploitBench 58.9%; ExploitGym 21 intended of 92 flags

    Public, qualified

  3. STEP 3

    Guarded tests

    Six card ASRs from 0.8% to 9.0%; three separate launch charts

    Public, mixed

  4. STEP 4

    Acceptance

    Criteria, treatment of remaining successes, dated accountable review, independent assessment

    Not public · G-006

  5. STEP 5

    Deployment

    With safeguards: “moderate or lower” across all domains; internal governance review before the decision

    Meta’s statement

What is missing, in the gap register’s words

The public corpus lacks the detailed cyber decision rationale, treatment of residual successes, acceptance criteria, dated accountable review and independently authored assessment connecting tests and deployment conditions.

Meta also reports working with third parties to develop and license benchmarks, threat modelling with outside experts, and engagement with government and other stakeholders (card p.11). Those are real inputs, but benchmark provenance, external execution and independent endorsement of the risk judgement are different things, and none stands in for another.

The internal record may be complete and well supported. The public record is consistent with that; it cannot independently establish it. No breach of a publication deadline is inferred. Read G-006 in the graph.

Open links

Seven open public-assurance gaps

These gaps were derived from this case’s inference requirements. They mean that the admitted public corpus does not complete an assurance inference; they do not establish missing private work, failed controls, misconduct, a policy breach or an incident. UNKNOWN_REASON is preserved unless a source gives a specific reason.

Open each gap for its full investigation, quoted from the gap register: what is public, what is missing, the evidence that would narrow or close it, the alternative reading, and why the evidence is unavailable where a source says.

G-001Baseline threshold and scenario coverage

Observed public evidence

Three capability headline scores are public; framework requires scenario-sensitive cyber judgments, including scaled scams.

Missing inference or evidence

No Full-specific audit trail maps capability results, human/cost baselines, escalation decisions and Cyber 1/2/3 coverage to the moderate-or-lower determination.

Evidence that would narrow or close it

A sanitized scenario-to-test matrix, human/no-model baselines, elicitation bounds, simple-to-complex escalation rationale, complex challenge and Cyber 3 results, uncertainty analysis and dated criterion-by-criterion adjudication. A defensible qualitative rule is sufficient; a numeric universal cutoff is not demanded.

Alternative interpretation

Meta may have fuller internal evaluations supporting the category. High benchmark performance alone neither proves nor disproves substantial contribution to catastrophic outcomes.

Reason unavailable

Framework p.20 expressly withholds constituent threat steps to balance transparency/security. That reason is known only for those details; the reason for missing Wonder aggregate mappings and adjudication is UNKNOWN_REASON.

Graph links and cited evidence

In the graph, G-001 limits A-002 and D-001. The gap register cites:

Read this branch in the Executive graph →Isolate it in the Full graph →
G-002Capability measurement and ExploitGym validity

Observed public evidence

Meta discloses the 21/71 split and two-model verification, a useful correction to the 92-flag headline.

Missing inference or evidence

Public capability results lack exact checkpoint/mitigation state, task and trial denominators, harness/budget/version information, uncertainty, human baselines and independently inspectable verification of intended versus unintended routes.

Evidence that would narrow or close it

A safe method manifest for each benchmark, task counts and per-task outcomes, repetitions/seeds, scoring/aggregation rules, elicitation and safeguard state; a sanitized 92-flag adjudication ledger with independent expert sample review and sensitivity to unintended solves. No exploit recipes are needed.

Alternative interpretation

Unintended routes may reflect meaningful discovery skill while invalidating intended-task scoring. Removing them from the comparable count does not erase their capability significance; including them as intended successes is unjustified.

Reason unavailable

UNKNOWN_REASON for missing method details and adjudication records.

Graph links and cited evidence

In the graph, G-002 limits A-002 and D-002. The gap register cites:

Read this branch in the Executive graph →Isolate it in the Full graph →
G-003Robustness denominators and adverse-result disposition

Observed public evidence

CyberBench 0.8/0.8, PolyGuard cyber 1.1/2.3, RedCode 9.0/8.0 are ASR percentages for separate single/multi-turn setups. Separate launch charts add Full’s 96.9% misuse refusal, 93.3% defensive compliance and 10.7% unauthorized-code ASR.

Missing inference or evidence

Neither the six card setups nor the separate launch charts provide the denominators, budgets, rubrics, uncertainty, safeguard stack, severity adjudication and retest accounting needed for a deployment-risk interpretation.

Evidence that would narrow or close it

Per-setup task/objective/query counts and attempts, stopping rules, attack budgets, languages, judge validation and intervals; sanitized successful-output utility/severity classes, fixes and retests; separate benign-task false refusals and end-to-end adversarial task results.

Alternative interpretation

Some scored successes may have little operational usefulness, while persistent actors may exploit successful objectives across sessions. The aggregates cannot distinguish these possibilities. Complements of ASR are not automatically refusal rates.

Reason unavailable

UNKNOWN_REASON; no Wonder-specific omission explanation found.

Graph links and cited evidence

In the graph, G-003 limits A-003 and D-003. The gap register cites:

Read this branch in the Executive graph →Isolate it in the Full graph →
G-004Full-to-Wonder family inference

Observed public evidence

The publisher expressly bases family assessment on its most capable variant, Full. Launch charts add paired Full/Wonder refusal 96.9/93.7%, defensive compliance 93.3/94.5% and unauthorized-code ASR 10.7/10.5%; their task populations and uncertainty are unspecified.

Missing inference or evidence

Paired launch behavioral aggregates exist (E-023–025), but no paired catastrophic-capability evaluations, matched-test manifest or domain-specific argument establishes that Full bounds smaller Wonder across the assessment and deployment contexts.

Evidence that would narrow or close it

A variant/checkpoint matrix, paired capability and robustness tests with matched harness/budget, explanation of relevant training/serving differences, and a documented bounding argument with exceptions and uncertainty.

Alternative interpretation

Full may conservatively bound offensive capability, but specialized behavior and refusal robustness need not order the same way. This gap limits the family extension, not the identity of the Full root.

Reason unavailable

UNKNOWN_REASON.

Graph links and cited evidence

In the graph, G-004 limits A-004 and D-004. The gap register cites:

Read this branch in the Executive graph →Isolate it in the Full graph →
G-005Test-to-deployment and mitigation mapping

Observed public evidence

Full is announced for Muse Code subscribers; smaller Wonder is on API and Muse Code. Card recommends added guardrails and reports mitigated assessment.

Missing inference or evidence

No dated matrix maps cyber tests to actual served checkpoints, tools, permissions, system policies, classifiers, rate limits or other controls per route. The cyber stack cannot be inferred from the paragraph’s chemical/biological classifier example.

Evidence that would narrow or close it

Versioned Full Muse Code serving attestation and test-to-route mapping, control defaults/availability and change history; separate smaller-Wonder API/Code rows and any later Muse rollout; targeted comparative tests or an independent configuration audit.

Alternative interpretation

Common infrastructure could make tests representative, but the public documents do not establish it. Recommended deployer guardrails may differ from Meta’s active product controls.

Reason unavailable

UNKNOWN_REASON; launch-route distinction itself is public and established.

Graph links and cited evidence

In the graph, G-005 limits A-005 and D-005. The gap register cites:

Read this branch in the Executive graph →Isolate it in the Full graph →
G-006Residual-risk rationale, review and independent scrutiny

Observed public evidence

Card reports a mitigated moderate-or-lower assessment and internal governance review; third-party inputs are described. Separate full report not located in the bounded search.

Missing inference or evidence

The public corpus lacks the detailed cyber decision rationale, treatment of residual successes, acceptance criteria, dated accountable review and independently authored assessment connecting tests and deployment conditions.

Evidence that would narrow or close it

The promised report or equivalent inspectable cyber case summary, a dated decision record by accountable role, criterion-to-evidence links including adverse results and uncertainty, and independently authored evaluation/audit findings with access, funding and editorial-control disclosure. A report alone narrows the gap only to the extent it supplies the missing evidence.

Alternative interpretation

The internal record may be complete. Nonzero ASR need not contradict moderate catastrophic risk; private external review may exist. No report-publication deadline breach is inferred.

Reason unavailable

Report status: NOT_LOCATED_IN_BOUNDED_PUBLIC_SEARCH as of 2026-10-14. Publication timing and document-specific omissions: UNKNOWN_REASON. General redaction policy does not explain each omission.

Graph links and cited evidence

In the graph, G-006 limits A-006 and D-006. The gap register cites:

Read this branch in the Executive graph →Isolate it in the Full graph →
G-007Continuing control and weight-security effectiveness

Observed public evidence

The card reports lifecycle weight security; framework describes monitoring, incident response and update mechanisms.

Missing inference or evidence

No Wonder Full-specific operational evidence establishes misuse detection, intervention latency, monitoring coverage, security-control effectiveness or reassessment triggers in practice.

Evidence that would narrow or close it

Privacy-preserving monitoring/response metrics with denominators and observation windows, blinded detection exercises, security audit summary, change/incident escalation criteria and dated follow-up assessments. Given the two-day launch interval, later evidence may be needed; no historical incident-free record is presumed.

Alternative interpretation

Controls may work effectively despite sparse early public telemetry. No observed incident or control failure is established by this gap.

Reason unavailable

UNKNOWN_REASON for unavailable implementation/effectiveness records; short observation period limits possible empirical evidence.

Graph links and cited evidence

In the graph, G-007 limits A-007 and D-007. The gap register cites:

Read this branch in the Executive graph →Isolate it in the Full graph →

Grouping choices and limits

Threshold coverage (G-001) concerns which threat scenarios are ruled out; capability validity (G-002) concerns what the measurements mean. Robustness (G-003) concerns guarded behavior. Family transfer (G-004) and serving transfer (G-005) are different extrapolations. Decision inspectability (G-006) includes the missing fuller public rationale and independent scrutiny; report availability is not counted again as a separate gap. Continuing effectiveness (G-007) concerns operations after a decision. Alternative groupings are possible; counts are not risk scores.
Exact release-day byte identity remains a source limitation and D-008 temporal dependency, not an additional material gap: this root is explicitly anchored to the retained October 14 wording. No finding depends on pretending those bytes were authenticated on October 12. None of these gaps is closed by this reconstruction.

Provenance

The full report, the sources and their dates

Separate full safety report

NOT_LOCATED_IN_BOUNDED_PUBLIC_SEARCH · 14 October 2026, 13:11 UTC

Both launch publications say “A full report with additional safety evaluations will be available soon” (launch research, announcement). The launch page’s existing evaluation-report link points to the model card. The publisher’s research index, launch links, framework links and targeted searches did not locate a separate report.

This is a dated public-evidence limitation. It does not show that no report exists, that Meta lacks internal evidence, or that anything was deliberately withheld. A report found later would need its own assessment, and would narrow the gaps only as far as it supplies the missing evidence.

Release, capture and the release-day bytes

  1. 2 Oct 2026

    Scaling Framework v2.1 dated and explained

    Framework p.51 and the explanation post agree on the date. General policy, not Wonder-specific fulfilment evidence.

  2. 12 Oct 2026

    Muse Wonder and Muse Wonder Full released

    Model card, launch research post and announcement (17:08 UTC). Both launch publications say a fuller safety report “will be available soon”.

  3. 13 Oct 2026

    Announcement modified

    Its page metadata records a modification at 17:27 UTC. The exact 12 October wording is not presumed.

  4. 14 Oct 2026

    ARGUS captures the sources and checks for the report

    Six documents captured 13:08 to 13:10 UTC; report-availability check 13:11 UTC; three launch charts captured 13:19 UTC. Hashes identify these bytes, not the release-day bytes or serving configuration.

Nine public publisher files: six documents and three chart images from the launch post, which are components of one publication, not three independent studies. ARGUS hashed the copies it retrieved on 14 October; the links below open the publisher’s current copies, and each note says how they compare. PDF page numbers are one-based file pages.

  • P4-SRC-001
    Muse Wonder Model Card (opens in a new tab)

    Current publisher PDF. Byte-identical to the ARGUS capture of 14 October 2026 when re-checked the same day.

    Dates, capture hash and release-time limits
    Publisher date
    Release date: 2026-10-12 (card p.1); document publication day not separately stated.
    Revision
    No numbered revision; PDF metadata has title/producer, no creation or modification date.
    ARGUS capture (UTC)
    2026-10-14T13:08:50.776999+00:00; request began 2026-10-14T13:08:50.483363+00:00.
    Pages and case use
    Root §4 p.7; cyber capability p.7; robustness p.8; governance/limitations pp.11–12. Model card has no cyber-method appendix.
    Release-time limit
    Current publisher copy only; exact 12 October bytes not independently authenticated. The PDF title/producer metadata contain no publication timestamp.
    SHA-256 of the capture
    63e19276146bc146f1a14a2534360b9712641918f617ca432ef1443991f4edce
  • P4-SRC-002
    Meta Superintelligence Scaling Framework v2.1 (opens in a new tab)

    Current publisher PDF. Byte-identical to the ARGUS capture of 14 October 2026 when re-checked the same day.

    Dates, capture hash and release-time limits
    Publisher date
    2026-10-02, Appendix II p.51; header October 2026.
    Revision
    Version 2.1; preface p.3 and changelog pp.50–51.
    ARGUS capture (UTC)
    2026-10-14T13:08:50.832277+00:00; request began 2026-10-14T13:08:50.484287+00:00.
    Pages and case use
    Thresholds pp.17–19; cyber outcomes pp.20–22; cyber operationalization pp.30–33; governance/disclosure pp.5–13; evaluation validity pp.28–30.
    Release-time limit
    Current publisher copy only; exact 12 October bytes not independently authenticated. The PDF title/producer metadata contain no publication timestamp.
    SHA-256 of the capture
    5a01d327df6dd81f2be886ea6006dbb53a64c37b359c7bd95346dd718819c64f
  • P4-SRC-003
    Muse Wonder launch research (opens in a new tab)

    Current publisher page. Re-checked the same day: the visible text is identical to the ARGUS capture; the bytes differ only in per-request page-tracing tokens.

    Dates, capture hash and release-time limits
    Publisher date
    2026-10-12T00:00:00.000Z.
    Revision
    HTML dateModified: 2026-10-12T00:00:00.000Z.
    ARGUS capture (UTC)
    2026-10-14T13:08:51.381261+00:00; request began 2026-10-14T13:08:50.485094+00:00.
    Pages and case use
    Distinct model access routes; safety/report promise; publisher links to card and framework.
    Release-time limit
    Current publisher copy only; exact 12 October bytes not independently authenticated. HTML dates are publisher metadata, not independent timestamp attestations.
    SHA-256 of the capture
    df7fc46cfdf0c66afbd38b9ef099ca31125ed2135bb3c6a085986a184b92f5a0
  • P4-SRC-004
    Introducing Muse Wonder and Muse Wonder Full (opens in a new tab)

    Current publisher page. Byte-identical to the ARGUS capture of 14 October 2026 when re-checked the same day. The page records a 13 October modification.

    Dates, capture hash and release-time limits
    Publisher date
    2026-10-12T17:08:05+00:00.
    Revision
    HTML dateModified: 2026-10-13T17:27:26+00:00.
    ARGUS capture (UTC)
    2026-10-14T13:08:55.020961+00:00; request began 2026-10-14T13:08:50.485943+00:00.
    Pages and case use
    Corroborating announcement and route/report promise; updated after release.
    Release-time limit
    Current publisher copy only; exact 12 October bytes not independently authenticated. HTML dates are publisher metadata, not independent timestamp attestations.
    SHA-256 of the capture
    8d82a0cb17d15cb54b9750892d5be7039feede9df7bdcdc890db2b9492a4090a
  • P4-SRC-005
    Developing Capable Models Responsibly (opens in a new tab)

    Current publisher page. Re-checked the same day: the visible text is identical to the ARGUS capture; the bytes differ only in per-request page-tracing tokens.

    Dates, capture hash and release-time limits
    Publisher date
    2026-10-02T00:00:00.000Z.
    Revision
    HTML dateModified: 2026-10-02T00:00:00.000Z.
    ARGUS capture (UTC)
    2026-10-14T13:08:50.978007+00:00; request began 2026-10-14T13:08:50.486669+00:00.
    Pages and case use
    Dates framework update and explains containment/open-weight changes; future governance language is not completed review evidence.
    Release-time limit
    Current publisher copy only; exact 12 October bytes not independently authenticated. HTML dates are publisher metadata, not independent timestamp attestations.
    SHA-256 of the capture
    0b15ca42449e12330802845e7c160157c12d59e7307122d5f1156f0c79798664
  • P4-SRC-006
    Meta AI Research index (opens in a new tab)

    Dynamic publisher index. Re-checked the same day: the visible text is identical to the ARGUS capture; the bytes differ only in per-request page-tracing tokens. An index cannot prove that a report is absent elsewhere.

    Dates, capture hash and release-time limits
    Publisher date
    Dynamic index; no single publication date.
    Revision
    No numbered revision; featured Wonder post dated 2026-10-12.
    ARGUS capture (UTC)
    2026-10-14T13:10:33.286878+00:00; request began 2026-10-14T13:10:32.832621+00:00.
    Pages and case use
    Availability-check context only; dynamic index cannot prove absence elsewhere.
    Release-time limit
    Current publisher copy only; exact 12 October bytes not independently authenticated. HTML dates are publisher metadata, not independent timestamp attestations.
    SHA-256 of the capture
    7f862c84ed09ee1e4de77c81c46f2fa09b406e1de8769099437bfc69ec740c87
  • P4-SRC-007LAUNCH CHART
    Cyber Misuse Refusal Benchmark (opens in a new tab)

    Byte-identical to the ARGUS capture of 14 October 2026 when re-checked the same day. A component of the launch research post, not an independent study. ARGUS transcribes only the two Muse Wonder bars; the other bars are left in the original and no ranking is made.

    Dates, capture hash and release-time limits
    Publisher date
    Linked from launch post dated 2026-10-12; standalone asset publication date unknown.
    Revision
    Filename light-v2; HTTP Last-Modified Wed, 14 Oct 2026 10:20:06 GMT (not a semantic change log); ETag "effddce0f8a8a1db9eca0f40f9aa72ac".
    ARGUS capture (UTC)
    2026-10-14T13:19:24.363049+00:00
    Parent publication
    Meta; P4-SRC-003, Safety at the Frontier, serialized chart reference.
    Release-time limit
    Read chart labels and axes directly. No chart-specific sample sizes, repeats, uncertainty or method manifest; no authenticated launch-day chart bytes. This is a component of the launch publication, not an independent study.
    SHA-256 of the capture
    d5a2dce55e87673bfc6ab15e969a26fc747fe2c202233c9456f68634729ee412
  • P4-SRC-008LAUNCH CHART
    Cyber Defense Compliance Benchmark (opens in a new tab)

    Byte-identical to the ARGUS capture of 14 October 2026 when re-checked the same day. A component of the launch research post, not an independent study. ARGUS transcribes only the two Muse Wonder bars; the other bars are left in the original and no ranking is made.

    Dates, capture hash and release-time limits
    Publisher date
    Linked from launch post dated 2026-10-12; standalone asset publication date unknown.
    Revision
    Filename light-v3; HTTP Last-Modified Wed, 14 Oct 2026 10:20:07 GMT (not a semantic change log); ETag "5f3d121b35ddce7ea582485e1c61f439".
    ARGUS capture (UTC)
    2026-10-14T13:19:24.369365+00:00
    Parent publication
    Meta; P4-SRC-003, Safety at the Frontier, serialized chart reference.
    Release-time limit
    Read chart labels and axes directly. No chart-specific sample sizes, repeats, uncertainty or method manifest; no authenticated launch-day chart bytes. This is a component of the launch publication, not an independent study.
    SHA-256 of the capture
    d044921db534a68665e6ad116dca79ab4529359327da98b1e8623ea274b9a16e
  • P4-SRC-009LAUNCH CHART
    Executing Unauthorized Code (opens in a new tab)

    Byte-identical to the ARGUS capture of 14 October 2026 when re-checked the same day. A component of the launch research post, not an independent study. ARGUS transcribes only the two Muse Wonder bars; the other bars are left in the original and no ranking is made.

    Dates, capture hash and release-time limits
    Publisher date
    Linked from launch post dated 2026-10-12; standalone asset publication date unknown.
    Revision
    Filename light-v2; HTTP Last-Modified Wed, 14 Oct 2026 10:20:01 GMT (not a semantic change log); ETag "da5eee445f7d1e1748928adcde320264".
    ARGUS capture (UTC)
    2026-10-14T13:19:24.377084+00:00
    Parent publication
    Meta; P4-SRC-003, Safety at the Frontier, serialized chart reference.
    Release-time limit
    Read chart labels and axes directly. No chart-specific sample sizes, repeats, uncertainty or method manifest; no authenticated launch-day chart bytes. This is a component of the launch publication, not an independent study.
    SHA-256 of the capture
    8ad34f90d072bce338031ca62783f835191aa731ef4ff0b536e7f7b87c8c55cd

What the hashes do and do not prove

Publisher-domain acquisition and the publisher’s own cross-links establish where these copies came from. The hashes identify the retained bytes; they are not publisher signatures and do not authenticate the results. Exact 12 October bytes and serving configurations were not independently authenticated, and the charts’ 14 October Last-Modified dates do not show when their content first appeared. No change to the card is alleged, and current evidence is not backdated.

Method

How to read this work

ARGUS is an independent documentary reconstruction of public sources. No model was queried, no exploit was run and no confidential source was used. It is not a penetration test, a safety certification, a policy-compliance finding or a ranking of models. The typed graph separates Meta’s statements from ARGUS interpretation and records every warrant, assumption and adverse result.

The research was filed on 14 October 2026, two days after the release. This presentation was checked against the filed registers by its author. It has not had an independent fidelity audit, and the study has not been externally peer reviewed. Findings may be revised with cited corrections.

Challenges are welcome: a source locator, contrary evidence or a better argument against any edge or evidence record. Criticism that narrows or corrects a link is a useful outcome.

Open Executive and Full Assurance Graphs Send a challenge or correction

Research boundary

Published by Automa Dynamics / ARGUS. Independent research; no affiliation, endorsement or certification by Meta.

Gaps describe the inspected public record. They do not mean Meta lacks private evidence, that a control failed, that a policy was breached or that an incident occurred.

Counts are link judgements, not safety scores, and no cross-model ranking is made.

Proof-4 artifacts

54 nodes · 67 warranted relationships · 25 evidence units · 7 open gaps · Graph SHA-256 47e5d31e3ace171cea058b103ebef1f589258bcce9cef6ab37e427392ce823ba