Skip to content
Christopher Shaun Godwin cgodwin.io
Blog

agents

2 posts with the tag “agents”

Muse Glimmer: Meta's 30B Open-Weight Agent Runs on One GPU

Christopher Shaun Godwin
Author

On August 10, Meta Superintelligence Labs released Muse Glimmer, a 30-billion-parameter model built for always-on local agent workflows (Phoronix, 2026). The weights ship under Apache 2.0, and the model runs on a Mac or PC with a single consumer GPU (TechCrunch, 2026).

The same day, Mark Zuckerberg published a 6,500-word essay, “The Future is for Everyone,” on Meta’s site (Meta, 2026). He argues that AI concentrated in a few hands leads to worse outcomes for everyone else (AP News, 2026). Meta also promised to open the weights of Muse Spark 1.2, its most capable foundation model, within weeks (Ars Technica, 2026).

This is Meta’s first fully open release since the proprietary Muse Spark replaced the open-weight Llama family in April (VentureBeat, 2026). For DevOps and AI teams the change is practical. Capable agents no longer need a cloud API call.

What Muse Glimmer is

Section titled “What Muse Glimmer is”

Muse Glimmer is a dense causal transformer with a dedicated vision encoder (Hugging Face model card).

SpecValue
Parameters~30B total, 29.6B across 52 layers
Vision encoder~1.8B ViT-G/14
LicenseApache 2.0
Context window131,072+ tokens
Languages100+
Input / outputText and image in, text out
Knowledge cutoffJanuary 4, 2026
Target hardwareOne consumer GPU or a Mac

Specs via VentureBeat and the official page at developer.meta.com.

Glimmer is distilled from Muse Spark, the larger closed model Meta launched in April 2026 (TechCrunch, 2026). Training used logit distillation from Spark outputs, then agent-focused mid-training, supervised fine-tuning, and reinforcement learning (Neowin, 2026).

The hardware math is the interesting part. A 30B model needs over 55 GB of memory at full precision. Meta compresses it to roughly 4-bit and adds block-level speculative decoding with a DFlash drafter head, so it answers fast enough for a real agent loop (MarkTechPost, 2026). Quantized variants target 24/32 GB consumer cards (Hugging Face, 2026).

The benchmarks hold up against local rivals. Glimmer beats Gemma4-31B and Qwen3.6-27B on several popular LLM benchmarks (Neowin, 2026). Meta publishes IFBench 77.0, AIME 2026 94.7, and GPQA Diamond 83.5 (developer.meta.com, 2026).

The tooling is ready on day one. The weights are on Hugging Face now, and Ollama 0.32.7 added support the same day (Phoronix, 2026). Ollama, LM Studio, vLLM, SGLang, Together AI, Fireworks AI, and OpenRouter support is rolling out this week (VentureBeat, 2026).

Why this matters

Section titled “Why this matters”

Agents go local. Always-on agents currently mean per-token cloud bills and prompts crossing a network. Glimmer runs with no network call (MarkTechPost, 2026). Your code, logs, and prompts stay on your machine.

The frontier follows. Muse Spark 1.2 is the model behind Muse Code, the terminal coding agent Meta shipped on August 5 (VentureBeat, 2026). Opening those weights puts a shipped coding agent’s brain in your hands.

Policy is part of the pitch. Zuckerberg says US labs face extra restrictions on training data while Chinese open-weight models from DeepSeek, Alibaba, and Z.ai gain US traction at lower cost. He calls on Washington to lower the barriers (NY Post, 2026).

Governance is promised. Meta says its board will approve the safety criteria for model releases and will review each release against them (Forbes, 2026). A $1 billion “Future is for Everyone” fund targets communities hosting Meta data centers (Axios, 2026).

Your move

Section titled “Your move”
  • Pull the weights from meta-models/Muse-Glimmer-30B on Hugging Face.
  • Serve it with Ollama or vLLM on a 24/32 GB GPU, or a Mac with enough unified memory.
  • Point an agent scaffold such as OpenClaw at the local endpoint (Neowin, 2026).
  • Benchmark it against Gemma4-31B and Qwen3.6-27B on your own tasks before migrating. The 4-bit path trades some quality for the single-GPU fit.
  • Watch for Muse Spark 1.2 weights in the coming weeks (Ars Technica, 2026).

Meta’s open-source return is a bet. Distribute the models, keep the ecosystem, and let anyone run agents on hardware they own. The next few weeks will show whether Spark 1.2 follows through.

One AI Agent Just Attacked Another: Inside Google's ADK Exploit

Christopher Shaun Godwin
Author

On August 3, 2026, Pillar Security published the first practical, real-world case of one AI agent attacking another (Pillar Security, 2026). The target was google/adk-python, the repository behind Google’s Agent Development Kit for Python. It is an open-source, code-first toolkit for building AI agents (Google, 2026). The repo has more than 90 million downloads (The Register, 2026).

The core breakdown

Section titled “The core breakdown”

The repository ran two classes of automated AI agents (Pillar Security, 2026). The first class was low-privilege and public-facing. It activated when a user opened a pull request or an issue. The second class was high-privilege and reserved for maintainers. It acted on the repository with real authority.

The vulnerability sat in the boundary between them. The low-privilege agent could be manipulated into triggering the high-privilege one (Pillar Security, 2026). The manipulation was prompt injection. The trigger was a trusted handoff between agents.

The attack ran in two pull requests (The Register, 2026):

  1. An attacker opened PR A with a real fix plus malicious code.
  2. A public-facing triage agent read PR A and marked it for review.
  3. The attacker opened PR B carrying the prompt injection.
  4. The triage agent emitted a trusted @gemini-cli handoff.
  5. The privileged workflow executed the malicious action.

The result was a fake audit trail. Researcher Dan Lisichkin described it as “a complete, believable ‘a human asked for a review, gemini ran it, gemini approved’ trail on the poisoned PR, none of which ever happened” (The Register, 2026).

Google fixed the underlying issue. It did not pay a bounty because the attack required social engineering, but it hardened the repository and will recognize the report with credit (The Register, 2026). Pillar confirmed the issue “has been mitigated” (Pillar Security, 2026).

Why CI/CD teams should care

Section titled “Why CI/CD teams should care”

The triage agent ran under a collaborator account with a personal access token, not under a bot identity (Pillar Security, 2026). That token carried pull-requests: write permission. A hijacked agent with that scope can edit comments, impersonate maintainers, and fabricate approvals on a malicious PR (The Register, 2026).

Lisichkin said agent isolation alone is not enough. “Agents should have their own identity, which mandates what resources they are allowed to access and in what they are allowed to interact with these resources” (The Register, 2026). If Google had given the triage agent a bot identity, most of the attack could not have happened.

What to do about it

Section titled “What to do about it”
  1. Give every agent its own identity with scoped permissions.
  2. Model agent-to-agent boundaries in your threat model.
  3. Treat prompt injection as a supply-chain risk in CI/CD.
  4. Keep privileged agent workflows behind human approval.

The takeaway: AI agents in CI/CD are not just tools. They are principals with credentials. Attackers now know one agent can be used to compromise another. Plan for it before it happens in your pipelines.