A security researcher named Pete reverse-engineered the filesystem of Meta's Muse personal agent and found something the company never announced: the runtime daemon ships with clients for OpenAI (via Azure), Anthropic (Claude Opus 4.6-4.8, Sonnet 4.6, Haiku 4.5), GPT-5.5 and GPT-5.6 variants, and Kimi K3 through Fireworks — alongside Meta's own internal model family called Avocado. The model catalogue lists roughly 15 Avocado variants plus the external providers, and the runtime can address any of them. Nearly every agent session in Pete's VM routed to Avocado. But one subagent session on September 21 used a model named azure/muse-special. The session transcript contained telltale OpenAI signatures: a gptresponsesv1 tag, encrypted payloads beginning with gAAAAA (an OpenAI convention), and tool call IDs in the OpenAI format — call followed by 24 mixed-case characters, versus the 32-hex-character format used by Avocado sessions. The Anthropic integration is not a stub. Pete found dedicated Rust modules — anthropic/requestflow.rs, anthropic/convertprompt.rs, anthropic/parsessestream.rs — along with API key files for Anthropic and OpenAI restricted to an inference-proxy service. A proxy kill-switch variable (JARVISANTHROPICBASEURLREVPROXYOVERRIDE=0) in the runtime environment is annotated as a live control, not stale config. The critical question — is Meta distilling from frontier competitors? — gets a qualified no. For the muse-special sessions, raw reasoning is encrypted and sent back to Azure on the following turn. The binary explicitly states that encrypted reasoning cannot use the RL completion-server override. Meta can see only the reply, tool calls, and a short reasoning summary. Avocado sessions are treated differently: thinking text is written unencrypted into the transcript with an empty signature, available for RL use. Meta's privacy note confirms conversations can be used to develop AI unless users opt out. What this reveals is an infrastructure-level hedging strategy. Meta built a model-routing layer that can swap between its own models and those of every major frontier lab without touching the user-facing product. The architecture gives Meta two distinct advantages: selective routing to whichever model performs best on a given subtask, and the ability to benchmark Avocado against frontier competitors in production conditions at scale. Both are rational engineering choices. Neither was disclosed. The lack of transparency is the friction point. Users interacting with Muse reasonably assume they are using a Meta model. The server-side routing capability means that assumption can be wrong on any given turn, and the user has no signal. The proxy kill-switches suggest Meta can enable or disable external providers fleet-wide in real time — useful for cost management and compliance, but also for making the evidence disappear if scrutiny arrives. Pete's work is notable partly because it exists at all. He credits Meta's exec team for their response to his first article and their willingness to engage. But the findings themselves paint a picture that is now standard across the industry: the model behind any AI product is increasingly a routing decision, not a fixed identity, and users are the last to know.
