Is Muse Spark Open Safe? Meta’s Open Model and Your Data
Meta released Muse Spark Open on 15 October 2026. Where your data goes on each way of running it, what the licence asks of you, and what Meta has not published.
Short answer: it depends almost entirely on where you run it. Meta released Muse Spark Open on 15 October 2026, and its research post calls it the most capable US open-weight model to date. Open weights means anyone who accepts the licence can download the model and run it on their own machines. Run it there and your prompts never leave the building. Run it through someone else’s API and the old questions about storage and training come straight back, just addressed to a different company.
This post sticks to what Meta and its partners have written down, as of 16 October 2026. It separates the routes, says what each one does with your data, and lists what Meta has not published yet.
What Meta released
Muse Spark Open is the open-weight version of Muse Spark, the model that has powered Meta AI since April. It is not an app. It is a large mixture-of-experts model, with 816 billion parameters in total of which 42 billion are active for each token, and a context window of one million tokens. Meta describes it as natively multimodal. The Hugging Face launch post is more specific: it reads text, images, audio and video, and writes text.
If the names are confusing, that is fair. Muse is Meta’s agent app, Muse Spark is the model family behind Meta AI, and Muse Wonder is the newer closed model from 12 October. What Muse Spark is sorts out the line-up. The important change here is that, until this week, Muse Spark could only be reached through Meta’s own products and API. Now the weights themselves are public.
Three ways to run it, three different answers
Meta lists three kinds of access in its developer announcement. Each one puts your data somewhere different.
- On your own hardware. You download the weights and run them yourself. Nothing you type is sent to Meta or anyone else, because there is no one else in the loop.
- In your own cloud account. Amazon SageMaker AI, Google Cloud Model Garden and Microsoft Foundry Models all carry the weights. You rent the machines, but the model runs inside your account.
- Through a hosted API. Baseten, Fireworks AI, Groq, Modal, Nebius, OpenRouter and Together AI all serve it. This is the easy route, and it is the one where your prompts go to a third party.
The catch with the first route is size. The full checkpoint is about 1.5 terabytes, according to Hugging Face. Meta says it is the first model in its class to run on a desktop, but the desktop is two Mac Studios with M5 Ultra chips and 512 GB of memory each. TechCrunch reports that it needs at least a terabyte of RAM. Smaller, compressed versions exist, and they lose some quality. For most people at work, local means a company server, not a laptop.
The cloud and API routes, in detail
AWS is the clearest about data. Its SageMaker JumpStart post says your prompts are processed on infrastructure you configure and control. You can put the endpoint in your own private network, encrypt its storage with your own key, and switch on network isolation for the container. The model only changes when you redeploy it. At launch it was offered in two US regions, so check your own region before planning around it.
The hosted APIs are a different question. Each provider has its own terms on logging, retention and training, and Meta’s announcement does not summarise any of them. An open model served by a company you have never signed a contract with is not more private than a closed model from a company you have. Read the provider’s data policy before the first prompt, not after.
One thing worth saying plainly: none of Meta’s launch pages contains a data or privacy statement for the model. That is not a warning sign in itself. With open weights, Meta is mostly not the one handling your prompts. It does mean the answer to "is it private" sits with whoever runs the model, which may be you.
What the download asks of you
Getting the weights is not anonymous. The model page on Hugging Face is gated. To download, you sign in and submit a form with your full legal name, date of birth and organisation, and the page says those details cannot be edited after you submit. If you are downloading for an employer, use the organisation’s details and agree it with whoever looks after licences.
The Muse Model License is also worth five minutes. Four parts matter for a normal workplace:
- Attribution. A product built on the model must prominently display "Built with Muse Spark Open".
- A revenue line. A company with more than 20 million US dollars in gross revenue that offers the model to others as a service must tell Meta and sign a separate agreement first. Internal use is outside that clause.
- Private data. The acceptable use policy forbids collecting, inferring or disclosing private or sensitive information about people unless you have the right to under applicable law.
- Age. The licence says the model is not intended for anyone under 18.
The licence also names Meta Platforms Ireland as the licensor for people in Europe. It contains no clause on how a licensee must handle personal data. That responsibility stays with you, under whatever law already applies to your organisation.
What Meta says about safety
Open weights cut both ways. Anyone can run the model, including people who strip out the guardrails. Meta says it gave the open version additional safety post-training for that reason, and that it met the thresholds of Meta’s Superintelligence Scaling Framework for release.
The model card gives some numbers, all from Meta’s own testing. It reports that the model refused 99.2% of jailbreak attempts on an internal cyber benchmark, refused over 98% of harmful requests on a chemical and biological refusal benchmark, and scored a 98.1% honesty rate on the MASK benchmark. Meta also says those results do not cover every downstream set-up and that changes to the model can weaken them. The full evaluation report is described as "available soon".
The practical advice in the model card is sensible and worth following. Meta recommends running the model inside a system with guardrails suited to your use, asking a human to confirm any irreversible action an agent takes, and not showing raw reasoning traces to end users. If you are wiring it into an agent that can send email or change files, that confirmation step is the one to keep. The reasons are set out in is Meta Muse safe, which covers the agent app.
On training data, the model card says it comes from public sources, web crawls, third parties, data derived from Meta’s products and services, and synthetic data. It does not say more than that.
A careful way to start
- Choose the route first. Own hardware, own cloud account or hosted API: decide before you decide what to paste.
- If you use a hosted API, read that provider’s terms on retention and training. They are the ones that apply, not Meta’s.
- Keep work data out until your employer agrees. A new model is a new supplier, even when it is open.
- Put a human in front of irreversible actions. Meta’s own model card asks for it.
- Check the answers that matter. The routine in how to check an AI answer when you are not the expert works for any model.
- Read the evaluation report when it lands. Until then, the safety numbers are Meta’s own.
If your organisation needs a structure for the decision, the NIST AI Risk Management Framework reduces to three plain questions: what can this system touch, what is the worst realistic mistake, and what have we done to limit it?
The short version
Run it yourself and your data stays yours. Run it through someone else and read their terms first. Either way, the safety numbers are Meta’s own until the full report arrives.
Benchmarks aside, an open model is still a model, and it is still confident when it is wrong, which is the pattern in what AI is actually bad at. If you are comparing it with Meta’s closed models, is Muse Wonder safe covers the API and memory questions for Wonder, and Muse Code vs Claude Code covers the coding agent Meta paired with this release.
The skill that carries across every new model is the same: know where your data goes, check what comes back, and keep risky jobs in human hands. Coursium teaches people to use AI at work, on their phone, with short lessons on exactly that. You can see how Coursium works if that is useful.