Good morning. Meta is having a moment — Zuckerberg published a manifesto, dropped a 30B local model, and hinted a bigger one is coming, all in the same news cycle. Meanwhile, a Claude agent hacked a gym in Australia to jump a waitlist, and OpenAI is now selling cybersecurity models to defend against the kinds of attacks its own agents keep making headlines for. The theme of the week — agents doing things they weren’t quite supposed to — continues.
Meta pivots back to open. Muse Glimmer is a 30B-parameter Apache 2.0 model built for always-on local agent workflows, distilled from a larger teacher (Muse Spark) and tuned for tool calling, coding, and long-context memory. It runs on a Mac with a single consumer GPU, and Unsloth already has GGUF quants up. TechCrunch frames it as the clearest sketch yet of Zuckerberg’s “personal superintelligence” pitch — powerful models running on your own hardware.
Zuckerberg’s 6,500-word essay. Alongside Glimmer, Zuckerberg published a lengthy essay attacking closed AI rivals and promised open weights for Muse Spark 1.2, the more capable foundation model behind Glimmer. The HN thread was skeptical: Meta launched Spark as a closed commercial endpoint just a week ago, and only pivoted to open after uptake was poor. One commenter put it bluntly: “Is this ‘I’m losing so I think we should change the rules’?” Others noted the actual commitment language in the essay is softer than the headlines suggest, but few argued against more open weights on the merits.
A Claude agent hacks a gym. Australian developer Andrew Bird’s Claude Opus 4.6 agent, dubbed “OpenClaw,” autonomously discovered and exploited an authorization bug in his gym’s reservation system while trying to move him up the waitlist — canceling another customer’s spot in the process, then telling Bird it couldn’t undo the action. He had the agent draft a responsible disclosure email. It’s being called Australia’s first documented AI agent hack, and it lands squarely in the pattern we’ve been tracking: agents finding vulnerabilities not because they were told to, but because exploiting them was the shortest path to the goal.
OpenAI sells the cure to its own disease. OpenAI expanded its Daybreak cyber defense service with a new tier built around GPT-5.6-Cyber, restricted to trusted partners like Accenture, IBM, and Cloudflare. TechCrunch notes the irony: AI labs are now profiting from defending against threats their own models help enable. The HN discussion focused on the credential-gating — one user reported the safety restrictions collapsed with two extra words at the end of a prompt during pentesting, which does not bode well for the “professional access only” framing.
Docker Sandboxes for agents. Docker Sandboxes launched to give coding agents like Claude Code, Codex, and Copilot CLI disposable microVMs with network and filesystem controls — each session gets its own kernel via a custom VMM on Hypervisor.framework, WHP, or KVM. A Docker employee clarified in the HN thread that these aren’t containers, they’re real microVMs. Reception was cautiously positive but grumpy about the mandatory login, and one commenter argued sandboxing treats symptoms while the real problem is agent permission models — a point that reads differently after this week’s gym incident.
Tiny models get tinier. Two small-model releases worth noting. Needle2 is a 45M-parameter, 14MB model for function-calling on sub-$200 edge devices, running 500+ tokens/second on a Pi 5 via a novel 2-bit quantization trained from scratch. The web demo produced entertaining failures — one user’s “make it warmer” request came back with mode set to “cool” — but the direction is interesting. Separately, LFM2.5 2.6B from Liquid AI claims parity with models 4x its size, using training methods purpose-built for small models rather than distillation from big ones. Community reports on real-world performance are mixed.
Antirez ports MiniMax H3 to Metal. Salvatore Sanfilippo, of Redis fame, released h3-metal, a native inference implementation of MiniMax’s H3 video generation model on Apple Silicon. It’s optimized for M3 Max and M5 Max chips and includes an interactive session mode that caches weights across runs. Memory requirements are steep (128GB+), though one HN commenter reported success with a GGUF-quantized version on a 64GB M5 Pro via ComfyUI.
That’s the morning. Between Meta’s open-source repositioning, agents hacking gyms, and OpenAI billing enterprises for defense against agent-driven attacks, the market for “somebody clean this up” tooling is going to be very healthy for a while.