The threshold Meta would not rule out
Buried in the model card Meta published alongside Muse Wonder on Monday is a sentence the launch post does not contain: “Without mitigations, we do not rule out the model reaching this threshold in the Chemical & Biological domain.”
The threshold is the “high risk” tier in Meta’s Superintelligence Scaling Framework, now at version 2.1 and dated this month. A model crosses it when “deployment of the Frontier AI could substantially contribute to any threat scenario associated with a catastrophic outcome”. Under the framework’s own table, reaching that tier does not stop a release. It moves the model into “Deploy With Mitigations”, which permits deployment “only if sufficient mitigations are defined, implemented and validated to reduce risk to that of a moderate or lower model”.
That is the route Meta took. The card says it applies safety post-training and system-level classifiers for the chemical and biological domain, places the unmitigated model at “moderate or lower” for cybersecurity and loss of control, and reaches “moderate or lower” across every domain once mitigations and system-level safeguards are counted — “which supports our decision to deploy”.
Ninety-two flags, twenty-one of them the intended way
The cyber section carries a disclosure few model cards make. Meta reports that Muse Wonder Full captured 92 flags on ExploitGym. A footnote then takes most of them back: a verification pass run with what Meta calls a GPT-cyber verifier, and independently confirmed with Gemini 3.1 Pro, “found that 21 of those used the intended vulnerability, while the other 71 were captured through unintended vulnerabilities”. Because ExploitGym’s published ranking counts only intended-vulnerability exploitations, Meta states that 21 is the figure comparable to that ranking.
Elsewhere in the same section Meta reports 88.4% on CyberGym and 58.9% on ExploitBench, with no equivalent caveat attached. On adversarial refusal it reports attack success rates of 0.8% on CyberBench for both single- and multi-turn attempts, 1.1% and 2.3% on the cyber subset of PolyGuard, and 9.0% and 8.0% on RedCode.
Two biology tasks have no score at all
The dual-use biology figures are high. On SecureBio’s suite the card reports 59.6% on the Molecular Biology Capabilities Test, 66.5% on the Human Pathogens Capabilities Test and 55.9% on the Virology Capabilities Test, an average of 60.7%. On LAB-Bench it reports 89.0% on ProtocolQA and 95.6% on SeqQA with tools, and 79.4% on an internal BioDesign Tools evaluation Meta says it built with Faculty.AI and outside subject-matter experts.
Two rows of SecureBio’s Agentic Bio-Capabilities Benchmark carry no number. Fragment Design, which tests in-silico design of short DNA fragments that assemble into a full-length genetic construct, and Screening Evasion, which tests modifying those fragments to get past DNA synthesis screening while preserving function, are both marked with a footnote: “High rate of refusals due to safety training. Refusals dropped prior to scoring.” The third task on that benchmark — writing a script to drive a commercial liquid-handling robot through a DNA assembly — scored 100.0%.
The refusal side of the ledger is where Meta’s numbers are strongest. It reports 98.7% on SecureBio’s BioTIER in English and across ten language buckets, 98.2% under adversarial transformations, and 100% on an internal chemistry refusal set in English and multilingually, falling to 99.8% adversarially. On loss of control the card reports 87.3% on MASK, which tests whether a model stays honest under pressure, and 0% on Agentic Misalignment, which counts harmful actions taken to advance an objective or avoid shutdown.
What has not been published
Meta’s launch post promises a fuller safety report that has not yet appeared. The card says Meta “worked with third parties to develop and license evaluation benchmarks”, ran threat modelling with outside experts, engaged government entities, and protects model weights under a “lifecycle-based weight security program” — none of which it describes further. An internal governance process reviewed the residual-risk assessment before the deployment decision was taken; the card does not say who sits on it.
The next thing to watch is that fuller report, and whether the ExploitGym footnote becomes a convention. A model card that publishes 92 and then explains why the comparable number is 21 is doing something unusual, and it only works if the rest of the industry publishes the same check.
