AI Industry Daily Briefing — October 13, 2026

The Executive Read

The thread today is control: who has it over a model once it exists. Meta released Muse Wonder, a pair of closed models it says are state of the art for agent tasks, and sells only the smaller one through an API. The benchmark results come from Meta’s own model card, and on the aggregate index in that card the Meta models trail Anthropic’s Claude Opus 5.5. Anthropic published two research posts on Monday about the other side of control. In one, it says new safeguards cut the reasoning data that rival labs extract from Claude by 10 to 100 times, and it names two Chinese labs, Zhipu and Moonshot, as having tried to copy its models; those are Anthropic’s allegations, and I found no response from either company. In the other, its Frontier Red Team argues that small models are perhaps a year from being able to copy themselves onto cheap, poorly secured devices, while saying today’s models cannot yet do it. A third item shows the same problem in the wild: Lumen’s security researchers say a botnet has taken over more than 3,400 exposed servers, many running AI tools, and hides its instructions in a poem on GitHub. On the business side, Character.AI said Monday that it has filed for bankruptcy, with Disney bidding $20 million for a license to some of its assets. Several items below rest on a single company’s account of its own work, and I say so where they do.

Top AI Headlines

Meta Releases Muse Wonder, Its Most Capable Models, and Cites Its Own Benchmarks

What happened. On October 12, Meta Superintelligence Labs released two models, Muse Wonder and Muse Wonder Full. Meta’s research post calls them its “most capable models” with “state-of-the-art performance on personal and professional agentic tasks,” meaning work where the model plans and carries out many steps on its own. Both are proprietary, with no downloadable weights. According to VentureBeat, which read the model card, both take text, images, audio and video, and have a context window of about one million tokens. Muse Wonder is available through the Meta Model API as muse-wonder-1.0 at $4 per million input tokens and $20 per million output tokens. Muse Wonder Full is not in the API; it is offered only through Muse Code subscriptions at $50 and $200 a month, with usage limits. Meta says training took place at its gigawatt-scale Prometheus data center.

Why it matters. Meta’s research post names benchmarks but gives no scores in its text; the numbers are in Meta’s model card, as relayed by VentureBeat. Those figures are Meta’s own, and Meta says some comparisons used different tools for different models. On SWE-Marathon, a long-running coding test, the card lists 57.5 for Wonder Full against 46.3 for Claude Opus 5.5 and 42.5 for OpenAI’s GPT-6 Astra. On DeepSWE 1.1, a software-engineering test, it lists 79.0 against 74.2 and 74.1. But on the Artificial Analysis Intelligence Index, a general composite, the card lists Wonder Full at 56, Wonder at 52, GPT-6 Astra at 53 and Opus 5.5 at 58. It also trails Opus 5.5 on Terminal-Bench and HealthBench Pro. So the claim that holds up on Meta’s own numbers is narrower than “best model”: it leads on some long-horizon coding tests and trails on the general index. A full safety report is “available soon,” Meta says.

Business implication. Pricing is only half the comparison; data handling differs by channel. Meta says API content is not used for training, but Muse Code subscriptions default to a “Contributor” mode that lets Meta use submitted content to improve its models; users can opt out, but only for future submissions. Companies choosing between vendors should read that setting before approving staff use.

Sources: Meta, research post on Muse Wonder (October 12); VentureBeat, reporting on the model card, pricing and data terms. Benchmark figures are Meta’s own.

Anthropic Says New Defenses Cut Distillation Extraction by 10 to 100 Times

What happened. On October 12, Anthropic published “Strengthening our defenses against distillation attacks.” Distillation here means training a model on another model’s outputs to copy its abilities; the post describes covert, large-scale efforts, run through networks of fraudulent accounts used to do exactly that. The post says reasoning tokens extracted by distillers on Anthropic’s platform fell 10 to 100 times or more after a new classifier, a program that flags requests aimed at pulling out Claude’s reasoning, was fully deployed, and that on some days the amount was too small to measure. It reports a false-positive rate below 0.1 percent for the classifier, and says tens of thousands of distillation-linked accounts have been banned, often within two hours of a campaign starting. These are Anthropic’s own measurements; the post notes it has not yet faced a highly sophisticated, persistent attempt to get around the defenses.

Why it matters. The post names two labs. It says Zhipu distilled cyber capabilities from leading US models while building its GLM-5.3, and that after Anthropic’s safeguards degraded its attacks on Claude Fable 5, Zhipu switched to an older Claude model and another lab’s model. It says the US government’s CAISI, a standards body for advanced AI, assessed GLM-5.3 as the most cyber-capable open-weights model released to date. It says requests to Moonshot’s Kimi models were secretly forwarded to Claude, including one from a user Anthropic believes was affiliated with China’s People’s Liberation Army, who sought to analyze CCTV footage of a specific individual. I found no statement from Zhipu or Moonshot, and I have not seen the underlying evidence. Anthropic also reports an earlier test on the SWE-bench Verified coding benchmark: a model trained on full Claude Opus 4.8 reasoning transcripts scored 80.4 percent, against 71.8 percent when trained on summarized transcripts.

Business implication. Anthropic is making customers part of the defense, and some of that is a cost to them. Since September 24 it has charged for requests blocked by safeguards in specific areas, including distillation, and the post says some legitimate users had to update their integrations. The post also argues that cloud platforms and inference providers should offboard fraudulent accounts, and concedes that illicit distillers are still paying customers, so incentives can work against defense.

Sources: Anthropic, “Strengthening our defenses against distillation attacks” (October 12). All figures and allegations are Anthropic’s.

Anthropic’s Red Team: Small Models May Be Months From Spreading Across Cheap Devices

What happened. Also on October 12, Anthropic’s Frontier Red Team published “AI models may be capable of self-replicating without access to a datacenter,” by William Zhou and Daniel Freeman. The authors study “weight-based replicators”: programs that carry a model’s weights, the numbers that make up the model, onto a hacked device, run the model there, and repeat. They tested whether small open models can do the non-hacking steps, mainly setting up inference on unfamiliar hardware. In a demo, Google’s Gemma 4 26B ran across 15 Android TV boxes costing about $55 each, at roughly 0.39 tokens per second, which is very slow. In a simplified test on eight emulated Android devices in Google Cloud, the open-weight GLM-5.2 spread to all eight in four of five trials. Other models failed reliably.

Why it matters. The authors say their cloud test left a remote-access feature unprotected, so results are an upper bound on real-world success. They project that a small model reaches GLM-5.2’s level by the end of 2026, using a general capability index as a rough proxy. Their summary line is that “right now, the floor and ceiling don’t intersect”: models that can do the job are too large for such devices, and models small enough to fit cannot yet do it. They also say small models are poor at spearphishing, and that access to the larger Opus 4.8 as an “advisor” did not help significantly. They describe spread as slow, with a doubling time of days, but hard to stop because there is no central point to switch off. Suggested defenses are network anomaly detection, quarantining infected devices as was done after the Mirai botnet, and stronger default-password rules for internet-connected devices.

Business implication. This is a forecast from a lab that also sells security tools, built on one proxy and one botnet as a scale anchor, and it has not been independently reviewed. Its practical point is more modest than its title: unmanaged internet-connected devices are a future place for AI-driven attacks to live, which makes basic device hygiene a budget line, not an afterthought.

Sources: Anthropic Frontier Red Team, “AI models may be capable of self-replicating without access to a datacenter” (October 12). Findings and projections are the authors’ own.

Character.AI Files for Bankruptcy; Disney Bids $20 Million as Lead Buyer

What happened. Character.AI said on Monday that it has filed for bankruptcy in the US and has agreed to sell some assets to Disney for $20 million, NBC News reported in a story carried from Reuters. Disney is a “stalking-horse” bidder, an opening buyer whose offer sets a floor that others can top. The deal covers a non-exclusive, perpetual license to some of the company’s intellectual property. Character Technologies, the owner, listed estimated assets and liabilities each between $50 million and $100 million in a court filing. The company expects to close the sale of all assets by late November or early December, and says services will continue during the transition and shut down if no buyer is found. NBC’s article does not name the court, and I did not find the docket.

Why it matters. Character.AI, founded in 2021 by two former Google employees, built chatbots that users could talk to as characters. Google licensed its technology in 2024 and rehired the founders. NBC lists the legal pressure around it: a lawsuit by the mother of a 14-year-old Florida boy who died by suicide, settled earlier this year with Google; a suit by Kentucky alleging the chatbots encouraged self-harm; and a suit by Pennsylvania alleging the chatbots posed as doctors. Disney sent a cease-and-desist letter in September 2025 over its characters, which Character.AI says it removed, and in September this year Disney hired Character.AI’s former CEO, Karandeep Anand, as its first group-wide technology chief.

Business implication. A company that Google once paid to license its technology is ending as an asset sale for $20 million. The license, not the product, is what Disney is buying. For other consumer chatbot companies, the filing shows how heavy litigation and safety costs combined with a licensing-style exit can be, though the reporting I read does not say what caused the filing.

Sources: NBC News, Reuters report on the filing (October 13). The court docket was not located.

Model and Product Updates

Anthropic opens a free vulnerability-scanning service for open-source projects. Announced October 8 with its Cyber Mission, the OSS Scanner gives enrolled open-source projects periodic scans by Anthropic’s most capable models. Each report includes a proof of concept, an explanation and, where available, a suggested fix. Anthropic says the reports are generated by a model and sent without human review, and that it expects a true-positive rate above 90 percent; that is a forecast, not a measured result. It names the Python Software Foundation, Alpha-Omega and OpenSSF, and the Apache Software Foundation among recipients of funding that keeps the service free. A companion Critical Infrastructure Defense Program brings Claude models and on-site engineers to providers that protect power, water and transport systems, with 11 founding partners including Accenture, CrowdStrike, Deloitte, Palo Alto Networks and Rockwell Automation. Anthropic says some fixes for industrial systems may take decades because the equipment cannot easily be taken offline.

Source: Anthropic, “Introducing the Anthropic Cyber Mission” (October 8).

Meta’s Muse Wonder adds memory features. Meta describes “Active Memory,” which keeps a user’s context across conversations, and “Active Focus,” which keeps work going toward a long-term goal. Meta says Wonder will soon power experiences in its Muse app, first for subscribers. These are descriptions of features I could not test.

Source: Meta research post (October 12).

Regulation and Policy Watch

White House says eleven companies pledged $2.4 billion to the Genesis Mission. A White House fact sheet from its science summit lists commitments of “SI for science tools and compute credits” (the administration’s term “SI” stands for super intelligence) from eleven companies: Nvidia $1 billion, AMD $500 million, OpenAI $200 million, Anthropic $150 million, Google $150 million, AMP $100 million, Emerald AI $100 million, and AWS, Armada, Crusoe and Micron $50 million each. The fact sheet does not say how much is cash and how much is compute credits or software, and the pledges go to more than 15 federal agencies. Anthropic’s own post says its $150 million runs over three years and is delivered as Claude access and credits for several hundred research projects. The fact sheet also lists a $100 million graduate fellowship and a $1.8 billion NIH, Department of Energy and Biohub effort to build AI models of cells. The American Institute of Physics’s weekly policy newsletter adds that the Department of Energy plans only a $20 million pilot of the fellowship in fiscal 2027, with later funding dependent on appropriations. The $6 billion-plus headline total covers the whole summit, not only AI.

Sources: White House fact sheet; Anthropic, “Building on our commitment to American scientific discovery” (October 8); AIP FYI, week of October 12.

UK AI Security Institute sets out a “best practice” agenda. On October 12 the institute, which says it has evaluated more than 55 models before release, published “Towards technical best practice for frontier AI development.” It argues that frontier capabilities are advancing faster than the practices used to manage their risks, and calls for voluntary, industry-developed practices that could later become international standards. Its eight priority areas include assessing risk throughout development, preserving oversight of systems, reporting incidents involving AI agents, sharing metrics on AI’s role in its own development, and giving independent auditors access. The post does not mention the dispute over pre-release access that yesterday’s edition covered, and I still have not found a primary statement confirming that access has been restored.

Source: UK AI Security Institute (October 12).

Emerging Startup Radar

IonQ to buy security startup Elisity in a stock deal worth up to $1.3 billion. In an October 12 filing, IonQ, a quantum-computing company, said it will acquire Elisity, a zero-trust security company founded in 2019 that secures users, devices, workloads and AI agents. Zero trust means no user or device is trusted by default. The price is up to $1.3 billion, entirely in IonQ stock and including an earnout of up to $150 million tied to Elisity’s performance. The share count will be set at closing from IonQ’s 20-day average price, with a floor of $33.07 and a cap of $49.61 per share. Closing is expected in the fourth quarter, subject to regulatory approval. Elisity has, per the release, more than 100 customer deployments. IonQ’s CEO, Niccolo de Masi, is quoted saying “Q-Day is coming much faster than predicted,” a reference to the day quantum computers can break current encryption; that is a company view, not a finding.

Character.AI’s sale, above, is the day’s other startup story. The dependence of a once-heavily funded consumer AI app on a $20 million license bid shows how thin the exit options can be outside the largest labs.

Source: IonQ press release, SEC Form 8-K exhibit 99.1.

AI Infrastructure and Market Signals

A botnet is hijacking exposed AI servers. On the Lumen blog, the company’s Black Lotus Labs describes “PoeLLM,” also called Canto Incognito, a cryptocurrency-mining and scanning botnet that has targeted exposed AI and open-source services since at least April 13. Its main targets are LiteLLM, a gateway that routes requests to AI models, and Ollama, a tool for running models locally, along with Gotenberg and Gitea. Most victims are in the US and Western Europe. The malware looks up its command server by reading four words from a poem in a GitHub repository and converting them to an internet address; the operator moves the server by editing the poem, which has been changed 11 times. The report’s key takeaways cite more than 3,400 victim servers, while its body text gives about 2,200 at a mid-June peak, with around 800 active a day. BleepingComputer, which says it corrected an earlier figure, reports the 3,400 count. Researchers assess with moderate confidence that the operator is Italian-speaking and financially motivated. The likely LiteLLM entry point is a flaw tracked as CVE-2026-42271. Lumen advises patching, limiting public exposure of AI tools and checking logs against its published indicators. This lines up with Anthropic’s warning above: AI infrastructure is already a target.

Sources: Lumen Black Lotus Labs, “Canto Incognito: tracking the PoeLLM malware”; BleepingComputer.

Google says its India AI hub will use air cooling. AFP reported on October 11 that Google says its planned data center in Visakhapatnam, in Andhra Pradesh, will use air cooling instead of water after residents objected given local water shortages. The $15 billion, gigawatt-scale project, which would be Google’s largest AI hub outside the US, is set to open in 2028. A gigawatt is roughly the output of one large nuclear reactor. Alexander Smith, Google’s head of infrastructure and energy for Asia-Pacific, said its water assessment found pressure on the local watershed. Google says it will pay the full cost of required grid upgrades and projects about $688 million a year in local economic activity; those are company claims. Activists want a moratorium on new data centers in the state. The report also notes that authorities in Finland ordered work stopped at two Google sites pending environmental assessments.

Source: AFP via Kuwait Times (October 11).

Public Investment Watchlist

Informational only; this is not investment advice. I did not verify any share-price move or earnings release from an exchange or company source, so none is quoted.

• Meta Platforms (NASDAQ: META). Released Muse Wonder; benchmark claims are its own, and the full safety report is pending.
• IonQ (NYSE: IONQ). Agreed to buy Elisity for up to $1.3 billion in stock; the share count depends on its average price, within a stated range.
• Nvidia (NASDAQ: NVDA), AMD (NASDAQ: AMD), Micron (NASDAQ: MU), Alphabet (NASDAQ: GOOGL), Amazon (NASDAQ: AMZN). Named in the White House list of Genesis Mission pledges, in amounts that do not say how much is cash.
• Walt Disney (NYSE: DIS). Stalking-horse bidder at $20 million for a license to some Character.AI assets; other bidders can still top it.

Watchlist

1. Character.AI sale process. Rival bids against Disney’s $20 million, and the late November or early December closing target.
2. Meta’s Muse Wonder safety report. Meta says it is “available soon.”
3. IonQ–Elisity closing. Expected in the fourth quarter, subject to regulatory approval.
4. Responses from Zhipu and Moonshot. Neither has been quoted in anything I read about Anthropic’s allegations.
5. Written confirmation of UK pre-release model access. Still resting on one newspaper’s report, as noted yesterday.
6. Patches for LiteLLM exposure. Lumen’s advice is to patch and reduce public exposure; watch for further reporting on the botnet’s scale.