Meta's Muse quietly routed a task to an OpenAI model on Azure

A researcher poking through the filesystem of Meta’s Muse personal-agent product found that while nearly every agent session ran on Meta’s in-house model, code-named Avocado, one subagent session was routed to a model labeled azure/muse-special. Telltale signs pointed to OpenAI: a gpt_responses_v1 signature, an encrypted reasoning payload with OpenAI’s characteristic gAAAAA prefix, and tool-call IDs formatted differently from Avocado’s. The daemon’s model catalogue backs this up, listing not just a dozen-plus Avocado variants but Claude (Opus 4.6–4.8, Sonnet, Haiku), GPT-5.5/5.6, and Kimi K3 — complete with a full Anthropic client for request handling, prompt conversion, and SSE parsing, provider API keys locked to an inference proxy, and a proxy kill-switch.

The practical upshot is that which model answers a Muse prompt is a server-side decision. Meta has the plumbing to route across multiple frontier providers and A/B test their outputs without notifying users; in this case only a single outlier session left Meta’s own model. The researcher explicitly rules out weight theft or distillation from rivals: for muse-special, the raw chain-of-thought stays encrypted, is bounced back to Azure on the next turn, and is barred from Meta’s RL completion server, so Meta only sees replies, tool calls, and any short reasoning summary the provider returns.

The privacy asymmetry is the more notable finding. Avocado (Meta) sessions write their thinking text directly into the transcript with an empty signature, making it available for reinforcement learning — and Meta’s own notice says those conversations can be used to train its AI unless users opt out. So the same product treats third-party model traffic as sealed while harvesting its own model’s reasoning for training, a distinction most users would never see.