Muse Spark 1.1: the training choices matter more than the benchmarks
Meta has shipped Muse Spark 1.1 and a public preview of the Meta Model API. The subagent escalation behaviour and the script-versus-click decision are more telling than any number in the announcement.
Meta Superintelligence Labs has put out Muse Spark 1.1, along with a public preview of the Meta Model API. It's a multimodal reasoning model built for agentic work — tool use, computer use, coding — and it's live now in Thinking mode in the Meta AI app and on meta.ai.
This is a vendor launch post, so read the numbers accordingly. The claimed wins aren't the interesting part. The training choices are, because they tell you where agent engineering has actually landed.
The subagent details
Most model launches describe capabilities. This one describes role behaviour, which is a different thing.
Meta says the model was trained to orchestrate multi-agent systems specifically to optimise end-to-end latency. As a main agent it gathers context, plans, and delegates across parallel subagents. As a subagent it sticks to its assigned job, works within the tools it has, and escalates back when it reaches the edge of that job.
That second half is what most teams get wrong. A subagent that decides to be helpful beyond its brief is worse than one that stops and asks — you lose the isolation that made you split the work up to begin with. Training the escalation boundary in, rather than prompting for it and hoping, is a real design position.
The model also handles a million-token context that it manages actively: pulling from much earlier in a run, and compacting in a way that keeps the steps needed later. Compaction quality quietly decides whether a long agent run holds together. It's also the least-discussed part of every agent stack I've worked on.
Meta claims zero-shot generalisation to native tools it hasn't seen, MCP servers, and custom skills.
Script or click
The computer-use section has the best detail in the post.
Instead of reasoning through desktop work one click at a time, the model was trained to decide when to write a script because automation is faster, when to click because direct interaction is simpler, and to emit batches of actions per step rather than one at a time.
Anyone who has built computer-use automation recognises the failure mode being targeted. Click-by-click agents are slow and they compound errors, since every step is another chance to misread the screen. Dropping into a script for the repetitive stretch is what a competent human operator does. Encoding that as a trained decision instead of a prompt instruction tends to show up as reliability rather than as a benchmark number.
On coding, Meta reports gains across large codebases — bug diagnosis, features in enterprise systems, large migrations — and says the model works across different agent harnesses with the now-standard feature set: planning mode, goal conditioning, subagent delegation, context compaction. Their demo runs in OpenCode, where the model builds a chat web app, screenshots it to catch user-visible failures, traces those back to the code, fixes them, and validates the fix.
The numbers are Meta's
The headline coding claim rests on Meta Internal Coding Bench. That's Meta's own evaluation, and they describe 1.1 as competitive with leading alternatives on it. Might well be true. It's also not reproducible by anyone outside Meta.
The endorsements come from launch partners: Replit, Cline, Box, and the OpenClaw Foundation. Launch-day quotes from partners with early access are marketing, whatever the underlying experience was. Box's is the most specific, tying its claim to their own enterprise evaluation set, which at least names something concrete.
On safety, Meta says it evaluated against its Advanced AI Scaling Framework across chemical and biological, cybersecurity, and loss-of-control categories, and found the model within safe margins. It also claims strong resistance to direct jailbreaks and to indirect attacks — untrusted data, prompt injection, developer-prompt attacks — plus better adversarial robustness, lower hallucination rates, and less sycophancy.
Hold the prompt-injection claim loosely. It's the hardest unsolved problem in computer-use agents, because the model reads the same screen an attacker can write to. Resistance measured by the vendor, against the vendor's own threat model, isn't the same as holding up against people actively trying to break it. The full posture is in their evaluation report, and that's where anyone planning to deploy this should go.
What to do with it
The direction is right. Latency-aware orchestration, trained escalation boundaries, and script-versus-click judgement all matter more in production than another point of benchmark score, and it's good to see a lab treating them as training targets rather than harness problems for someone else to solve.
It's still a public preview with vendor numbers, a vendor benchmark, and vendor safety results. Reading more launch coverage won't tell you anything the announcement didn't. Running it against your own evaluation set on your own workload will — particularly before you point it at a browser with anything sensitive behind it.