Watchtower

Meta released Muse Wonder on Oct. 12 with a 13-page model card, but without a safety and preparedness report, promising that “a full report with additional safety evaluations will be available soon.” That report has not been posted as of Oct. 26 at 1:30pm PT. In the meantime, however, Meta quietly updated Wonder’s model card on Oct. 23. No changelog accompanies the update other than in the text itself, nor do there appear to be any other public announcements.

The change is to Muse Wonder Full’s ExploitGym results. Previously, Meta reported that it had captured 21 flags that used the“intended vulnerability" and 71 “unintended vulnerabilities.” There was no explanation about what those 71 unintended vulnerabilities were or how Meta assessed them against its recently updated Meta Superintelligence Scaling Framework. 

Meta’s update to Wonder’s model card now states:

Updated ExploitGym Evaluations (23 October 2026). After correcting our harness to include the intended vulnerability in the model’s prompts, as recommended by the benchmark, we reran the evaluation. Muse Wonder Full succeeded in capturing 20 intended flags (instead of the 92 total flags and 21 intended flags originally reported). We have updated the table above to reflect the intended flag results only, as this is also how results are officially reported on the public leaderboard. These updated evaluations do not require us to adjust our “moderate or lower” risk threshold for Muse Wonder Full.

Notably, gone is any mention of the model’s prior finding of 71 unintended vulnerabilities, with no explanation as to why or what those 71 unintended vulnerabilities were. That matters because Meta’s safety framework defines Cyber 2 in terms of “automated discovery and reliable exploitation” of critical vulnerabilities, and lists the ability to “automatically discover and exploit” vulnerabilities on its own as a capability enabling Loss of Control 3 assessments. Moreover, in the rerun, the model was told the intended vulnerability, which doesn’t help clarify the model’s capabilities or the related risks. And even with steering the model to focus on intended vulnerabilities, for some reason it appears the intended captures went down, from 21 to 20, with no explanation.

A diff of the changes can be found below: