October 13, 2026 — Meta's Best Model Isn't in the API

Host0:31

Set Meta's new model to maximum reasoning effort, and you still don't get the best version of it. Meta's own docs say so. That's not a bug. That's the lineup. On Monday, Meta announced Muse Wonder and Muse Wonder Full, both built for agentic work, where a model plans, calls tools, and keeps going. Wonder is on the Meta Model API and in Muse Code. Wonder Full is only for Muse Code subscribers. The interface is familiar. Point an OpenAI-compatible client at Meta's API, use the model ID muse hyphen wonder hyphen one point zero, and send text, images, video, audio, or PDFs. You get text back. The context window is one million, forty eight thousand, five hundred seventy six tokens. It costs four dollars per million input tokens, twenty cents per million cached, and twenty dollars per million output. OpenRouter lists the same. Meta's docs say Wonder and its cheaper Spark line share endpoints, so switching is a model ID change. How it works, per Meta: large-scale training, then reinforcement learning, aimed at using tools across multi-step tasks. Meta also pitches Active Memory, which carries information across conversations, and Active Focus, which keeps going through errors. Those are company claims, not independently verified. The number to know comes from VentureBeat, citing Artificial Analysis. Its Intelligence Index scores Wonder Full fifty six and Wonder fifty two. Claude Sonnet five point five is fifty six, GPT six Astra fifty three, Claude Opus five point five fifty eight. Near the frontier, not past it. On SWE-Marathon, Wonder Full hits fifty seven point five, against forty six point three for Opus. But that comes from Meta's own model card, and VentureBeat notes the tools and conditions aren't always the same. Now the catches. Wonder is in preview, and rate limits and maximum output length aren't published in what I read. There are no downloadable weights. And Muse Code defaults to Contributor mode, which lets Meta use your submissions to improve its models. You can switch it off for future ones. The verdict. Try Wonder on a bounded, multi-file coding task you can score against your current model. Hold off on sensitive data until you've read those terms. And don't plan an API rollout around Wonder Full, because it isn't there. What to watch is whether it ever gets an API price.

3:14

Meta's model is hosted only, so you rent it. This next one you can compile on your laptop, and it ships with an MCP server so an agent can drive it. On some Windows AMD graphics drivers, GridCraft flashes briefly in Task Manager and quits. The README documents the override. Set the WGPU backend variable to vulkan. GridCraft is an open-source, clean-room spreadsheet written in Rust. It runs on macOS, Windows, Linux, and BSD, plus a WebAssembly build. It has about three thousand eight hundred stars, which is a snapshot, not a health metric. The engine is split into crates, with the egui frontend kept separate so the UI can be swapped. A dependency graph drives incremental recalculation, so unaffected formulas don't recompute. Copy-on-write workbooks make undo snapshots nearly free. The hook for builders is automation. There's an MCP server, a CLI, and a JSON control channel, with operations like read range, write range, evaluate formula, and insert chart. The number is five hundred thirteen of Excel's five hundred twenty three worksheet functions. That's the project's own count. It also says it's about fifty percent ready for real work, and it calls itself alpha. Large workbooks and real-world XLSX fidelity are still ahead. To try it, you need Rust one point ninety or newer. Clone the storytold gridcraft repo, then run cargo run, release flag, package gridcraft.

4:56

A spreadsheet engine's whole job is parsing expressions people hand it. Hold that thought, because GitLab's Monday went wrong in a parser too. The reported route from the internet to code execution on a GitLab server is a regular expression. Not a login. Not an uploaded executable. A regex in CI/CD configuration. GitLab's critical patch release assigns CVE twenty twenty-six, nine seven two two nine, a CVSS ten point zero. GitLab says a specially crafted regular expression could, under certain conditions, let an unauthenticated user execute arbitrary code on the GitLab server. BleepingComputer says a researcher using the handle joaxcar reported it through HackerOne. The mechanism: the vulnerable component parses, compiles, and evaluates regular expressions in project pipeline configuration. BleepingComputer reports an integer overflow paired with insufficient validation. In plain terms, a number inside the compiler outgrows its container, and nothing checked. Affected versions are nineteen point two before point eight, nineteen point three before point five, and nineteen point four before point two. BleepingComputer's story says the nineteen point three fix is point four, but GitLab's own release says point five. Use GitLab's. GitLab.com is already patched, and Dedicated customers need not act. If you self-manage, this one's yours. Find your exact version and upgrade. The same release carries other fixes, including high-severity XSS, authorization, and pipeline issues. What we don't know: the sources I read don't document confirmed exploitation, and there's no word on mitigations for anyone who can't upgrade yet. Operators will point to change windows and compatibility checks. Fair. Still, a ten point zero is the day to ask for an exception.

7:04

GitLab self-managed means the patching is yours. AWS's Monday pitch goes the other way: your web app, no rewrite, and no infrastructure to manage, in AWS's words. The demo is ordinary Express code, with one twist. It has to listen on the host and port in an environment variable called AWS, Lambda, HTTP, endpoint, joined by underscores. That's Lambda Web Functions. Event functions receive an event and return a response. Web Functions run a conventional HTTP server, so Express, Hono, Fastify, or Next.js run without Lambda-specific adapters. The mechanism is concurrency. One warm execution environment can serve up to one hundred twenty eight concurrent requests. Billing is requests, active CPU time, and memory for as long as the environment exists. It scales to zero, on the same Firecracker isolation as Event Functions and Lambda MicroVMs. CloudFront can front it. Origin Access Control restricts the endpoint to your distribution, and you get edge TLS, caching, custom domains, and optional WAF with no application code changes. AWS says there's no extra fee for that integration. Now the fine print. Launch supports Node twenty four on Arm sixty four, VPC connectivity, and five Regions: N. Virginia, Ohio, Oregon, Tokyo, and Ireland. The claims about faster cold starts and lower cost are AWS's own. The pages I read have no independent benchmark. To try it, run aws lambda-web deploy, name hello-world, with the hello-world flag. Then measure what matters: sustained connections, heavy input and output, or traffic outside those five Regions. Nobody's shown those numbers yet.

9:07

OpenCode two point zero. A session you start in the terminal can now continue in the desktop or web app, because every client attaches to one shared background service. The catch is breaking changes. V one plugins don't run in V two, and V one server integrations must migrate. Anomaly's exact verdict on the old API, to The New Stack: “The old API grew haphazardly as we and the world collectively learned what agents are and should be. It was bad.” No plugins, go ahead. Otherwise, keep V one around while you verify models, credentials, and MCP servers. Cloudflare Logpush Transformers. One SQL query can now filter, redact, and reshape logs before they leave Cloudflare, on supported datasets across every plan. The first gigabyte of input each month is included, then four cents per gigabyte. If a transform fails, delivery stalls rather than leaking raw logs. Good for redaction, rough for uptime. Anyone paying to export logs they discard should look. Bedrock AgentCore short-term memory. Billing now follows data volume rather than a flat rate per event: one dollar per gigabyte ingested, twenty cents retrieved, ten cents per gigabyte-month stored. Ingestion and retrieval bill at least twelve kilobytes per event, so a tiny event isn't a tiny charge. AWS says most workloads get cheaper, which is its claim. Rerun your own math. Ollama zero point forty point four, release candidate. llama.cpp moves forward and the server now reuses verified manifests and loaded models on inference routes. No benchmark ships with the notes, so the speedup is unquantified. There's also a fix compacting recurrent state after a speculative rollback, the most specific sentence in any changelog today. Wait for stable unless you need the new model support.

11:08

Several of those items are about paying less per token. Microsoft's next chip attacks it at the source, though not until next year. Microsoft announced Maia 300 on Monday, with production deployments planned for twenty twenty-seven, so you can't rent one yet. Maia 200 is already serving production workloads, Copilot included. The spec: eight HBM four stacks, two hundred eighty eight gigabytes, eighteen terabytes per second, in a nine hundred fifty watt envelope. A rack holds ninety six accelerators at one hundred sixty seven kilowatts. Microsoft claims forty percent more tokens per megawatt than leading GPU systems. That's a projection, with an unnamed baseline. SiliconANGLE separately puts memory bandwidth about twenty percent below Nvidia's Rubin. Why care: Microsoft says moving data, not raw compute, is the inference bottleneck. So memory goes NUMA across chiplets, and software can place data near the compute using it.

12:17

Fast Boot, where the hotfix shows up after the punchline. SonicWall's side door. A ten point zero SSRF in the WorkPlace portal of SonicWall's SMA one thousand appliances is drawing attempts, first caught on honeypots October eighth. SonicWall calls the way in an unintended alternate access path, which is a very polite name for a door. Dueling statements. SonicWall says it has no evidence of exploitation in the wild, while Previdian and Defused logged attempts on honeypots. Both can be true, like a smoke alarm going off while the fire marshal reports no fire yet. Combo meal. The same release fixes three more SMA one thousand flaws: post-authentication command injection, Zip Slip, and stored XSS. A ten point zero with three sides is a combo meal nobody ordered. That's Fast Boot. Remember, an unintended alternate access path is just a door with better PR.

13:19

Today: Meta's Muse Wonder and the model you can't reach, GridCraft the Rust spreadsheet, GitLab's ten point zero CI/CD flaw, and Lambda Web Functions. One thing to try: check your GitLab version, or deploy the Lambda hello world and time it against what you run now. Sources are in the show notes. Follow The Daily Reboot wherever you get podcasts. I'm your host. See you tomorrow, and patch something.