Muse Glimmer: Meta Ships 30B Apache 2.0 Open-Weight Model

Meta returns to open weights, but in a smaller form

Meta has released downloadable model weights again. On August 10, 2026, Meta Superintelligence Labs released Muse Glimmer, a dense model with about 30 billion parameters. Anyone can download the weights, and they're licensed under Apache 2.0. Meta built the model to run on a single consumer GPU instead of in a data center.12 Reporting describes Glimmer as a distilled version of Meta's larger in-house Muse Spark model. Meta has also said it intends to release the weights of Muse Spark 1.2.1112 The company's first official open-weight release since Llama 4 is now on Hugging Face, and the license allows commercial use, modification and redistribution.12

The licensing deserves as much attention as the model. Meta's AI security tooling has long been published as open-weight models with source code, but under Meta's custom Llama licenses. Its main model now ships under one of the most permissive licenses in common use. For security teams building on open models, the result is a two-tier situation, covered below. The most accurate reading is that Glimmer is a real improvement for openness but does not make Meta's model stack open source.

What Meta shipped

The specs largely agree across coverage, though some numbers differ. One account counts 29.6 billion parameters across 52 layers, with a vision encoder of roughly 1.8 billion parameters, so the model accepts images as well as text.14 Another ranking puts the total at about 29.8 billion including the vision encoder.20 Reported context length is 128,000 tokens by default, with some sources citing roughly 131,000 tokens in extended configurations.1214 Full-precision weights are put at about 55 GB in one report and about 60 GB in another. Sources agree that 4-bit quantization brings the deployable size under 20 GB, which fits on a 24 GB to 32 GB consumer card.12

Meta pitches Glimmer as an agent model, not a chatbot. The company lists four target uses: local agents, function calling (letting the model call external tools), local coding, and "LLM-as-a-judge," where one model grades another model's output.12 Weights launched with same-day support in local runners such as Ollama and LM Studio.14 Meta reports 37.8 tokens per second on an M4 Max and 50.2 on an M5 Max, using its own speculative-decoding technique (a method that speeds up text generation).20 Unusually, Meta offers no hosted API for Glimmer, so running it locally is the only option.12

On benchmarks, Meta claims Glimmer beats Gemma 4 31B and Qwen3.6-27B on agentic retrieval and tool use. It reportedly trails Qwen on computer-use tasks.12 Independent scoring is more modest. One analysis cites a score of 35 on Artificial Analysis's Intelligence Index.1214 A September ranking lists 17.5 on version 4.3.2 of that index, which most likely reflects a re-weighted methodology rather than a drop in the model's ability.20 Either way, Glimmer is a mid-tier general reasoner tuned for a specific job.

Why the Apache 2.0 license is the real news

Meta has argued about the term "open source" for years. The Open Source Initiative and others disputed Meta's use of it for Llama. After Ars Technica examined the Llama 2 license, it started calling the model "source-available" or "weights available." That license barred companies with more than 700 million daily active users and banned using its outputs to improve other models.19 Later Llama licenses kept the same structure: commercial use was allowed only below a threshold of monthly active users.8

Glimmer drops those restrictions. Apache 2.0 has no usage thresholds or field-of-use clauses, which several reports call a sharp break from Meta's earlier community licenses.12 One outlet calls Glimmer Meta's "first fully open model release" since it moved its flagship to the proprietary Muse Spark.14

That "fully open" claim overstates things. CSO Online points out that much of the coverage called Glimmer open source when it is open-weight. Meta released the trained parameters but not the training data or the training code.17 The license is genuinely permissive, but the model can't be reproduced from scratch. Teams can inspect, fine-tune and redistribute what Meta trained. They can't check what went into it. For security audits, that gap matters more than the license text.

The broader strategy also argues against treating this as a full return to openness. Meta's top model, Muse Spark, stays proprietary and is sold through an API. Glimmer is a smaller model distilled from it, which restores an open option without giving away the flagship.14 Meta repeated its promise to open Muse Spark weights when Muse Spark 1.3 shipped on September 2, 2026, but still gave no date.20 Until those weights appear, Glimmer is best read as a deliberate open tier below a closed product.

Meta's security tools still use Llama licenses

The security side shows the two-tier problem clearly. Meta's main open security components come from its PurpleLlama work:

• Llama Guard 4: a 12-billion-parameter multimodal classifier that flags harmful prompts and responses against the MLCommons hazard categories.103
• Prompt Guard 2: small 86M and 22M models that detect jailbreaks and prompt injection.5
• LlamaFirewall: an agent guardrail framework that combines Prompt Guard 2, an "AlignmentCheck" auditor that reads the agent's reasoning, and CodeShield, a static code scanner built on Semgrep and regex rules.2

The PurpleLlama repository had about 4,400 GitHub stars and 778 forks as of early October.3

These components don't share Glimmer's license. A comparison of guard models for on-premises deployment lists Llama Guard 4 and Prompt Guard 2 under the Llama 4 Community License, while most competitors use Apache 2.0.4 The LlamaFirewall framework is cataloged under MIT in one directory.5 A separate explainer says it couldn't find a named license on the project's pages, README or paper.2 Practitioners notice this. One team building guardrails for regulated industries in Brazil chose IBM's Granite Guardian over Llama Guard. They cited its Apache 2.0 license, and found Llama Guard needed a fine-tuning project before it worked for their use case. As they put it, Apache 2.0 ends a procurement discussion and a Llama license starts one.1

That creates an odd situation. A company can now deploy Meta's newest model under Apache 2.0. If it adds Meta's own guard models as safety layers, it is back under the threshold-based Llama terms. Competitors have used Apache 2.0 for this category for some time: OpenAI's gpt-oss-safeguard, Alibaba's Qwen3Guard, IBM's Granite Guardian 4.1 and Mistral's Shieldstral, released in August 2026.4 If Meta wants Glimmer used in regulated, locally hosted deployments, aligning its safety tooling with Glimmer's license is the obvious next step. Meta hasn't announced that.

Local agents need these defenses more

Glimmer's design increases the need for security tooling. Meta built it for always-on local agents that call tools and write code.12 Those are the conditions where prompt injection is most dangerous: a malicious instruction hidden in a web page or tool output can take over the agent. Meta's published numbers for LlamaFirewall show what layered defenses can do. On the AgentDojo benchmark, adding Prompt Guard 2 and AlignmentCheck cut attack success from 17.63% to 1.75%. Task completion fell from 47.73% to 42.68%.2 Those are Meta's own results. One review found no independent evaluation and noted that the AlignmentCheck setup described asks for a hosted Together API key. That's awkward for teams that chose Glimmer to stay offline.2

Meta also has related open research. Meta-SecAlign provides 8B and 70B adapters (small add-on weight sets for Llama 3.1 and 3.3) trained to resist indirect prompt injection. Its authors present the results as benchmark figures, not guarantees.6 None of these artifacts targets Glimmer specifically. They were built on Llama and validated with it.26

The wider ecosystem fills some of the gap and adds risk of its own. Open-source scanners such as NVIDIA's garak, Microsoft's PyRIT and CyberArk's FuzzyAI are actively maintained for red-teaming.5 But Protect AI's LLM Guard was archived in July 2026 and no longer receives patches, a reminder that open security tooling can lose its maintainers.59 Practitioners also say guard models catch obvious attacks and miss subtle ones.8

The trust question

The geopolitical context adds another layer. Coverage widely notes that Chinese labs such as Qwen, DeepSeek and Moonshot's Kimi set the pace for open-weight models in 2026, and that Glimmer is Meta's attempt to regain ground.12 CSO Online frames the choice bluntly for security buyers: whether to trust Meta more than the Chinese government with intellectual property.17 A US-made, Apache-licensed model that runs entirely offline is a credible answer to that worry. Without training data, though, buyers are still trusting the vendor, not verifying it.

Bottom line

Glimmer is Meta's most permissively licensed model so far and a sensible fit for local, private agent workloads.1215 It is still an open-weight model, not open source.17 It sits in a strategy where the flagship stays closed and the promised open Spark weights have no date.20 For security teams, the gap is that Meta's own guardrails remain under Llama-era licenses and were built around older models.4 Glimmer's success with enterprises may depend less on its benchmark scores than on whether Meta releases security tooling that is as open as the model.