Meta

Muse Spark Contemplating

• Framework: Meta's Advanced AI Scaling Framework v2
• 4 statements about capability levels
• 6 safeguards
• 12 tests by the provider
• 1 source document

What the provider states

• Autonomy & replication · Moderate or lower · Stated as not crossed

  Loss of Control risks.We assess loss of control risk as “moderate or lower.”

  Meta · 3 June 2026 · Read the source
• Chemical, biological, radiological and nuclear · High · Stated as crossed

  We retain the same “high risk” determination for the unmitigated model.

  Meta · 3 June 2026 · Read the source
• Chemical, biological, radiological and nuclear · Moderate or lower · Stated as not crossed

  After validating that the mitigations deployed for Muse Spark, including refusal mechanisms, continue to perform robustly under the Contemplating architecture, we confirm residual risk at “moderate or lower.”

  Meta · 3 June 2026 · Read the source
  The same level is stated in 1 other sentence, counted once. Show it.

  After applying the same mitigations as for Muse Spark, the residual risk is reduced to “moderate or lower.”

  Meta · 3 June 2026 · Read the source
• Cyber · Moderate or lower · Stated as not crossed

  We assess cybersecurity risk as “moderate or lower” with respect to the threat scenarios outlined in Meta’s Advanced AI Scaling Framework.

  Meta · 3 June 2026 · Read the source

Safeguards the provider describes

• Domain-specific safeguards (CBRN or cyber)

  We have also deployed Cyber misuse monitoring systems as an additional compensating control.

  Meta · 3 June 2026 · Read the source
• Misuse monitoring and enforcement

  These mitigations include mechanisms to refuse on dangerous or dual-use topics of concern (Section 2.1.2), scalable mechanisms to detect and deter persistent malicious use, and scalable monitoring of long-term behavior for potential threat actors.

  Meta · 3 June 2026 · Read the source

• We have also designed and implemented scalable mechanisms that are intended to deter persistent malicious use, as well as mechanisms that scalably aggregate and assess long-term patterns of user activity for targeted risk assessment on complex topics.

  Meta · 3 June 2026 · Read the source
• Safety training (harmlessness and refusal)

  Our mitigation suite includes redundant mechanisms to ensure refusal across a broad set of threat scenarios we believe are in scope for models of this capability level, as well as additional mechanisms for detecting and deterring persistent malicious use.

  Meta · 3 June 2026 · Read the source

• One important layer is model refusal, where deployments of high-risk models must reliably avoid providing enabling information on topics that could enable malicious use.

  Meta · 3 June 2026 · Read the source

• These mitigations include mechanisms to refuse on dangerous or dual-use topics of concern (Section 2.1.2), scalable mechanisms to detect and deter persistent malicious use, and scalable monitoring of long-term behavior for potential threat actors.

  Meta · 3 June 2026 · Read the source

The provider's own tests

• AI development acceleration and monitorability reliability evaluation · The provider · Autonomy & replication

  Following the evaluation setup for Muse Spark Contemplating, we do not expect increased reasoning capabilities to affect model agentic capabilities within a chat interface deployment and rule out the realization of threat scenarios related to AI development acceleration and reliable monitorability for this deployment.

  Meta · 3 June 2026 · Read the source
• Cybench · The provider · Cyber

  Reported result: Muse Spark Contemplating scored 65.4% pass@1.

  pass 1: 65.4%

  Based on the rationale above, Muse Spark Contemplating’s agentic cyber capabilities are assumed to be on par with those reported for Muse Spark in the Muse Spark Safety & Preparedness Report, which are at or below those of peer models: Cybench (65.4% pass@1 vs 93.0% for Opus 4.6), CyberGym (43.5% pass@1 vs 66.6% for Opus 4.6).

  Meta · 3 June 2026 · Read the source
• Human Pathogens Capabilities Test (HPCT) · The provider · Chemical, biological, radiological and nuclear

  As shown in Figure 1, we observe that Muse Spark Contemplating shows increased performance in two evaluations (VCT and HPCT), although the magnitude of change is still within the range expected for existing frontier models.

  Meta · 3 June 2026 · Read the source
• Molecular Biology Capabilities Test (MBCT) · The provider · Chemical, biological, radiological and nuclear

  The Molecular Biology Capabilities Test (MBCT), Virology Capabilities Test (VCT), and Human Pathogens Capabilities Test (HPCT) are part of a suite of evaluations developed by SecureBio and the Center for AI Safety (Götting et al., 2025; SecureBio, 2025).

  Meta · 3 June 2026 · Read the source
• WMDP-cyber · The provider · Chemical, biological, radiological and nuclear
  accuracy: 91.1%

  We observe that Muse Spark Contemplating performs approximately on par with peer models, exhibiting an accuracy of 91.1%.

  Meta · 3 June 2026 · Read the source
• adversarial robustness against cyber misuse requests · The provider · Misuse & jailbreak

  Muse Spark Contemplating exhibits the lowest overall ASR across all models, with 7.2% of prompts breakable by at least one attack template, compared to 9.0% for Muse Spark, 8.2% for Meta AI Thinking, and 31.7–59.0% for peer models.

  Meta · 3 June 2026 · Read the source
• controlled comparison using a subset of the hardest CTF challenges · The provider · Cyber

  we compared the performance of repeated independent attempts with Muse Spark on this subset of CTF challenges against a parallel-sampling scaffold analogous to Muse Spark Contemplating at several different budget constraints ranging from $10 to $500 per challenge.

  Meta · 3 June 2026 · Read the source
• general alignment propensities evaluation · The provider · Deception & sabotage

  The model demonstrates robust epistemic integrity under adversarial pressure (Section 2.3.3).

  Meta · 3 June 2026 · Read the source
• multi-turn social engineering evaluation · The provider · Misuse & jailbreak

  Muse Spark Contemplating refuses to respond to 100% of prompts on this evaluation (see Appendix C); therefore, we do not present capability results on this benchmark for Muse Spark Contemplating.

  Meta · 3 June 2026 · Read the source
• private set of 600 cybersecurity relevant prompts · The provider · Misuse & jailbreak

  We find that Muse Spark Contemplating shows significantly stronger refusal behavior (e.g., the ASR is 1.3%) against direct cyber misuse requests relative to peer models where the second lowest ASR is 3.5% for Gemini 3.1 Pro.

  Meta · 3 June 2026 · Read the source

No document we read states: a release date, an independent or government test. No incident on record names this version.

Compare with other versions