Hacker News ★ 75 5 min

Meta's Muse appears to use an OpenAI model labeled muse-special

🔗 https://mouse.dev/blog/muse-special/

📌 拆解 Meta Muse:系統裡藏著一個 OpenAI 模型?

TL;DR:獨立研究者在Meta Muse的VM檔案系統裡,挖出疑似透過Azure呼叫OpenAI模型的線索。

幾乎所有session log都跑在Meta自家模型Avocado上,唯獨9月21日那一次不一樣——log裡出現了一個叫azure/muse-special的名字。

🤔 一個異常的session,牽出的後續追查

這是作者(化名Pete,部落格mouse.dev)繼上一篇登上Hacker News首頁的文章後,第二次深入挖掘Muse代理背後的檔案系統。他發現VM裡的session紀錄會標註每個子任務用了哪個模型,其中絕大多數都指向Meta內部模型Avocado,只有一個subagent的session被標記為azure/muse-special,這讓他決定順著這條線索繼續查下去。

🧩 幾個技術細節湊出的推論

在Cursor裡搜尋repo後,作者找到一段字串:「GPT Responses model client via MAGI native Azure OpenAI lane」。模型目錄(model catalogue)裡,azure/muse-special緊接著列在azure/gpt-5.6-sol之後。回頭檢視session transcript,作者發現兩個關鍵細節:其一,簽名被標記為gpt_responses_v1,並帶有一段以gAAAAA開頭的加密payload,這是OpenAI慣用的格式;其二,工具呼叫ID(tool call ID)採用call_後接24碼混合大小寫字元的格式,這與其他Avocado session裡call_後接32碼十六進位字元的格式明顯不同。

把視角拉遠,Muse代理daemon附帶的完整模型目錄裡,除了約15個版本的Avocado,還列有Claude Opus 4.6/4.7/4.8、Sonnet 4.6與Haiku 4.5、透過OpenAI/Azure/Codex提供的GPT-5.5與GPT-5.6各版本,以及透過Fireworks與Meta自架路由提供的Kimi K3。作者強調,「被列在目錄裡」只代表runtime具備呼叫該模型的能力,不代表它真的被用過。更值得注意的是,runtime裡還有一整套針對Anthropic的請求處理程式碼,包括anthropic/request_flow.rs、anthropic/convert_prompt.rs、anthropic/parse_sse_stream.rs,分別負責請求流程、提示詞轉換與串流解析。環境中也存在分別對應Anthropic、OpenAI等供應商的API金鑰檔案,存取權限限制在inference-proxy服務;另外還有一個環境變數JARVIS_ANTHROPIC_BASE_URL_REVPROXY_OVERRIDE=0,程式註解明確寫著這是一個「live kill switch」(隨時可切換的開關),而非過期設定殘留。

💡 是選擇性路由,還是在做蒸餾?

作者猜測有兩種可能:一是某些任務上OpenAI或Anthropic的模型表現就是比Meta自家模型好,於是選擇性地路由過去;二是整套VM本來就內建A/B測試不同供應商模型回應與工具呼叫的能力,用於蒸餾(distillation)或強化學習(RL)訓練。針對「Meta是否在蒸餾其他實驗室的模型」這個問題,作者的結論偏向否定:muse-special的原始推理過程是加密的,daemon只是把它存起來、留待下一輪對話送回Azure,二進位檔案裡明確寫著加密的推理內容不能被RL補全伺服器(completion-server)覆寫使用;換句話說,Meta這端能看到的只有回覆內容、工具呼叫,以及OpenAI/Anthropic偶爾附上的簡短推理摘要,真正的思維鏈本身仍是加密狀態,RL伺服器會拒絕處理這類資料,也沒有跡象顯示Meta複製了對方的模型權重。相對地,Avocado模型的思考文字是直接以明文寫入transcript、簽名欄位是空的,可供RL訓練使用;根據隱私權說明與repo內容,使用Avocado進行的對話預設可被用來開發Meta自家AI,除非使用者主動選擇退出。

⚠️ 證據是拼湊出來的,結論仍是推測

作者自己也承認,檔案與log並沒有明講muse-special究竟對應哪一個GPT版本,也不清楚這個subagent當初為何被選中使用它。整篇文章的結論建立在字串比對、簽名格式與ID長度差異等間接證據上,屬於合理推測而非官方證實。

🎯 實務啟示

對於正在打造多供應商(multi-provider)Agent runtime的工程師而言,這篇拆解提供了一個有意思的參照:即使把模型抽象成內部代號,簽名格式、加密payload前綴、工具呼叫ID的生成規則,仍可能洩露背後真正的推論供應商。同時,「kill switch開關+分權限的API金鑰+加密推理鏈」這套設計,也示範了大型產品在多供應商路由與RL資料管線之間,如何劃出隱私與可用性的邊界。

🔗 來源

#MetaAI #Muse #OpenAI #ReverseEngineering #LLMRouting #AzureOpenAI #ModelDistillation #ReinforcementLearning #AIInfrastructure #AgentRuntime

原始資料 Hacker News · 收集於 2026-09-26
來源原標題
Meta's Muse appears to use an OpenAI model labeled muse-special
作者
Aeroi
原始標籤
hackernews
來源訊號
HN points 140 HN 留言 48
原始連結
https://mouse.dev/blog/muse-special/

摘要原文

I found a model labeled azure/muse-special while Muse was building my website. So I dug deeper. This is Part 2 of digging through the Muse filesystem after my article hit the front page of Hacker News this week. In this article I focus on a model I found in my logs called muse-special , and confront the question: does Muse actually use OpenAI and Claude models behind the scenes? One odd session Muse records which model each agent session uses. Nearly every session log in my VM was routed to Meta’s internal model, called Avocado. But one subagent used a model named azure/muse-special . Interesting... Figure 1. Sessions in my VM grouped by model. Everything is Avocado except a single azure/muse-special session on September 21. Click image to enlarge. Following the name This made me curious, so I searched across the repo inside Cursor and found this: “GPT Responses model client via MAGI native Azure OpenAI lane.” OK. The model catalogue seems to list azure/muse-special then azure/gpt-5.6-sol . So I searched my session transcripts... Here I found two details that stood out: The signature is tagged gpt_responses_v1 and contains an encrypted payload starting with gAAAAA (which OpenAI uses). Tool call IDs used call_ followed by 24 mixed-case characters. This was different from all the other lines that the Avocado sessions printed ( call_ followed by 32 hex characters). Figure 2. Lines from the muse-special transcript: a call_ ID in the OpenAI style and a gpt_responses_v1 signature with an encrypted gAAAAA payload. Click image to enlarge. These little details tell me that the muse-special model is possibly an OpenAI model or OpenAI’s Responses API. So is muse-special an alias for a GPT model served through Azure? The files and logs don’t tell me exactly which GPT model, or why it was selected by the subagent in the first place, but let’s take a step back and explore further... The model catalogue The broader model catalogue that is shipped with Muse’s agent daemon lists about 15 versions of Avocado, plus: Claude Opus 4.6 / 4.7 / 4.8 Sonnet 4.6 and Haiku 4.5 GPT-5.5 and GPT-5.6 variants via OpenAI, Azure and Codex Kimi K3 through Fireworks and Meta-hosted routes Figure 3. My summary of the model IDs shipped in the hatch daemon, grouped by family. A shipped ID means the runtime can address it, not that it was used. Click image to enlarge. The Anthropic plumbing The Claude support goes beyond just the model ID and includes an Anthropic client with request handling, prompt conversion and streaming parsers: anthropic/request_flow.rs anthropic/convert_prompt.rs anthropic/parse_sse_stream.rs OK, so now we’re kind of wondering... why? There are API key files present for Anthropic, OpenAI, etc., with access restricted to the inference-proxy service. ...But there’s also a proxy kill-switch setting in the env. Figure 4. JARVIS_ANTHROPIC_BASE_URL_REVPROXY_OVERRIDE=0 in the runtime env. The comment calls it a live kill switch, not stale config. Click image to enlarge. Why ship all of this? Now, there are a few reasons for this, I guess. The first would be that an OpenAI or Anthropic model just does a superior job at a certain task that Muse can’t fulfill right now, and they selectively route for that. The second is that all these VMs are shipped with the ability to A/B test model responses, tool calls, etc. for the purpose of distillation and RL. Distillation or RL? Maybe. Idk. This leads us to the truth, which is that the model behind Muse is ultimately a server-side choice. The runtime has clients for multiple providers, which gives Meta the ability to change routing without asking users. In my case there was only a single outlier session that didn’t use the Avocado (Meta) model, but the infra is there to. Is Meta distilling? Wait, so is Meta distilling from the other frontier labs? (Getting technical. tl;dr: No.) With the muse-special model the raw reasoning is encrypted. The daemon stores it to send back to Azure on the following turn. In the binary it explicitly says that the encrypted reasoning cannot use the RL completion-server override. So what Meta can see here is only the reply, the tool calls, and a short reasoning summary when OpenAI/Anthropic returns one. The raw chain of thought is encrypted and the RL server refuses those blobs. There is no indication that Meta copies OpenAI or Anthropic weights. Avocado models are treated differently, however. The thinking text is written directly into the transcript, with an empty signature, and available for RL use. So Avocado models, according to the privacy note and repo, do indicate that conversations can be used to develop AI at Meta unless you opt out. (Makes sense.) Closing thoughts This is my own exploration of what has been a very cool release from Meta. My best guess is that muse-special is an OpenAI model served through Azure. Whatever you think of Meta, the talent they brought onto this project deserves credit. They took a different approach in a world full of chatbots and search bars, and the exec team’s response to my first article, which got some eyeballs, has been pretty amazing too, as has their willingness to reach out to a nobody and explain their thinking. It’s not every day you get to look inside the filesystem of a product that could reach hundreds of millions of people. Seeing inside a runtime cell gives us an early look at where this whole personal agent thing might be going, and it’s been really fascinating to read through all of it this week. If you worked on Muse at all, please feel free to reach out. I’d love to learn more and perhaps contribute. Things seem to be moving fast. Not really breaking, yet. pete at mouse dot dev -Pete @heypeterjames Screenshot ← → Close (140 points, 48 comments on Hacker News)

由 claude-code/sonnet 自動生成