Every AI control your enterprise actually owns is implemented at an API gateway. The prompt log, the token meter, the DLP scan on egress, the model-version pin, the kill switch — none of them are properties of a model. They are properties of a network path. They work because inference happens somewhere else and the request has to leave your building to get there.
On August 10, 2026, Meta Superintelligence Labs released Muse Glimmer, a 30-billion-parameter model under Apache 2.0, and that path became optional. Not for chat — chat has run locally for two years. For agents: multi-step tool calls, schema handling, failure recovery, the workload your security team assumed was safely stuck behind a vendor API. Quantised, the weights are under 20 GB, and Meta's stated envelope for actually running it — weights, KV cache, vision encoder and drafter together — is 24 GB. That is a gaming GPU or a high-spec developer laptop, not the base-model corporate fleet, but it is hardware plenty of engineers already have. One of them can pull it down this afternoon, and the first record of that agent's existence will be a laptop's disk usage.
What Meta Actually Shipped Today
Muse Glimmer is a ~29.6B-parameter dense transformer with a vision encoder, a 131,072-token context window, and an Apache 2.0 licence, per the model card on Hugging Face. At full BF16 precision it needs over 55 GB of memory. The number that matters is what the quantised variants cost: the K-Quant-17GB build targets a 24 GB envelope at 1.0% quality degradation, and the K-Quant-Dynamic build targets 32 GB at 0.2%, per the same model card. That is a consumer graphics card, or a laptop somebody already expensed.
Meta shipped optimised integrations for llama.cpp, MLX and ExecuTorch, with Ollama, LM Studio, Unsloth, vLLM and SGLang as launch partners. Speculative decoding via DFlash delivers a claimed 3.1× speedup on an RTX 5090 and 1.8× on an M5-Max — Meta's own benchmark, not an independent one. And Techmeme's roundup of the announcement confirms the second shoe: Meta says it will open-weight Muse Spark 1.2, its most advanced model, in the coming weeks.
Constellation Research's Larry Dignan reads the strategy plainly — Meta monetises through advertising and compute rental rather than per-token API revenue, so giving weights away costs it nothing and costs OpenAI and Anthropic a great deal. He is right about the market. The enterprise consequence is somewhere else entirely.
The Benchmark That Matters Is MCP Atlas, Not SWE-Bench
The score that changed the enterprise calculation is 75.5 on MCP Atlas, against 54.2 for Gemma4-31B and 62.5 for Qwen3.6-27B in the same size class, per Meta's published table. MCP Atlas measures whether a model can hold a multi-step tool-calling workflow together — call a tool, read the result, decide the next call, recover when one fails. That is the agent workload, and it is the thing small models have reliably failed at.
Read the rest of the table honestly, because it does not say Muse Glimmer is the best small model. Qwen3.6-27B beats it on SWE-Bench Verified (77.2 to 76.0), on TerminalBench 2.1 (60.7 to 51.7) and on OSWorld-Verified (75.6 to 65.9), per the full benchmark comparison. It is narrower and more specific than a leaderboard win: the multi-step tool-call gap closed, at a memory footprint that fits on hardware you have already bought.
For eighteen months, "small models can't hold an agent loop together" was the honest technical objection to running agents locally. It was the load-bearing reason platform teams could tell an enthusiastic engineer no.
That objection did not expire this morning — it has been eroding since April, when Qwen3.6-27B shipped under the same Apache 2.0 terms in the same size class, which is exactly why the comparison above is close. Muse Glimmer is where the erosion gets hard to argue with. On Scale's public leaderboard, 75.5 puts a model you can run on your own hardware inside the band the frontier APIs occupy, a shade above GPT-5.5's 75.3, against 88.1 for Meta's own hosted Muse Spark 1.1. What replaces the objection is not a better technical argument — it is a governance question nobody has budgeted for.
Your Controls Live in the Network Path, Not the Model
An AI gateway is a proxy that every model request passes through, and it is where enterprise AI controls are physically implemented. Cloudflare's own product documentation describes the deal exactly: connect your apps through the gateway and you get metrics on requests, tokens and cost, plus logging of requests and errors, caching and rate limiting. Every one of those features requires the request to pass through the proxy. That is not a Cloudflare limitation. It is what a proxy is.
Walk the list of things your AI policy promises and ask where each one is enforced. Prompt and completion logging: the gateway. Token accounting and per-team budgets: the gateway. DLP inspection of what leaves for the model provider: the gateway, or the egress proxy in front of it. Pinning a model version so a silent vendor swap does not invalidate your evals: the gateway. The kill switch you promised the board — the one control the audit committee actually asked about: the gateway.
Now delete the network hop. Every item on that list becomes unenforced simultaneously, and none of them fail loudly. There is no alert, no 403, no dashboard that goes red. The gateway simply stops seeing traffic it never knew existed, and your token spend gets better. This is the same structural blindness that made 90% of AI usage invisible to IT, except the previous version at least generated an outbound TLS connection somebody could have inspected.
What Local Inference Actually Records
By default, Ollama logs metadata and not content. At the default INFO level it writes GIN HTTP access lines — method, path, status, client IP, latency — for every call to /api/generate, /api/chat and /api/embed, and prompt and response text is gated behind OLLAMA_DEBUG_LOG_REQUESTS, which defaults to false. There is no dedicated audit log and no SIEM integration.
Where those logs live is its own problem. Ollama's official troubleshooting documentation points you at ~/.ollama/logs/server.log on macOS, journalctl -u ollama on Linux, and %LOCALAPPDATA%\Ollama on Windows. Those are diagnostic files on an endpoint, rotated locally, deleted by anyone with the laptop. They are not an evidentiary record, and nothing ships them anywhere.
So the honest description of an agent running Muse Glimmer on an engineer's machine is this: it can read local files, call MCP tools, and take multi-step actions, and the durable organisational record of what it did is a timestamped list of HTTP status codes on a disk you do not administer. If that agent touches a customer record, you cannot reconstruct which record, when, or what it did with it. This is the same class of gap as agents holding standing IAM permissions with every call technically authorised — except here there is not even an authorisation event to review.
The Compliance Clock Moved, and That Is the Trap
Article 12 of the EU AI Act requires that high-risk AI systems "technically allow for the automatic recording of events (logs) over the lifetime of the system." Automatic means the system generates them; a spreadsheet does not qualify. Article 26(6) then obliges deployers to retain those logs "for a period appropriate to the intended purpose... of at least six months." Penalties reach €15 million or 3% of annual worldwide turnover.
Here is the part your legal team has probably already told you, and the part they may have drawn the wrong conclusion from. Under the Digital Omnibus political agreement reached on 6 May 2026, high-risk obligations for standalone Annex III systems are deferred to 2 December 2027, and to 2 August 2028 for AI embedded in regulated products. Gibson Dunn notes the deferral takes legal effect only on formal adoption and publication in the Official Journal. Article 50 transparency duties were not delayed and remain on the original schedule.
Sixteen extra months sounds like relief. It is the trap. Retrofitting an audit trail onto inference that never crosses a network boundary is not a compliance document you write in Q3 2027 — it is endpoint agents, or a mandated local proxy, or a hard organisational rule about where agents may run, each of which is a procurement cycle and a negotiation with engineering. The obligation arrives in December 2027. The laptops arrive this quarter. You do not get to start the work when the deadline does.
The Steel Man: Local Is Genuinely Better on Privacy
The strongest case for local inference is real, and it is not a cost argument. Data that never leaves the device cannot be retained by a model provider, subpoenaed from one, or exposed in one's breach. It removes an entire category of third-party risk. It is why Apple built a 20B on-device foundation model and why turnkey local deployment has been eating cloud inference bills all year. Open weights are also the only durable hedge against a vendor's pricing decisions — the argument for holding an open-weight fallback against API price rises has only strengthened.
All true. And none of it is the same thing as governed.
Ask what happened to the last cohort of teams who ran inference locally. Ollama ships with no authentication, and a single misconfiguration — binding to 0.0.0.0 instead of the documented default 127.0.0.1 — is all that sits between a private service and the open internet on port 11434. How many have crossed that line depends on who counted, and the published figures do not agree: SentinelLABS and Censys reported roughly 175,000 unique exposed hosts across 130 countries in January, Cyera cites roughly 300,000, and Cisco's point-in-time Shodan sweeps found 1,139 in September 2025, of which fewer than a fifth had a model actually loaded. Take the order of magnitude and not the number. In May, Cyera disclosed CVE-2026-7482, "Bleeding Llama", an unauthenticated heap out-of-bounds read scoring CVSS 9.1 that let an attacker extract process memory — user conversations, system prompts, and environment variables including API keys — in three API calls. Fixed in 0.17.1, where the release notes described feature work with no security note.
And on Meta's own safety evaluation, Muse Glimmer records a 28.4% attack success rate on Siren AgentDojo, a prompt-injection benchmark. That is Meta's number, published by Meta, for a model designed to read files and call tools. Roughly one in four injection attempts lands — on an agent with local filesystem access and no gateway between it and anything. The same agent-config persistence problem that let a worm survive package removal applies here with nothing watching.
We Have Run This Play Before, Twice
Shadow AI is not a hypothetical you are getting ahead of. It is the current state. Okta's May 2026 survey with Apprize360, covering about 300 technology executives and 500 knowledge workers, found more than half of employees use personal AI tools without approval and 58% of executives reported an AI-related security incident or close call in the past year. The same survey found over half of employees say their organisation's policies are unclear, hard to find, or non-existent — while executives believed those policies were clear and consistent.
Harish Peri, Okta's SVP for AI security, framed the mechanism precisely: "The risk isn't necessarily because of intent, but because employees are experimenting without thinking through visibility, governance, or consistent security controls."
That is BYOD in 2011 and unsanctioned SaaS in 2015, and both went the same way. The technology arrived, employees adopted it because it worked, IT discovered the footprint eighteen months later, and the eventual control cost five times what building it early would have. The difference this time is that BYOD at least generated network traffic. A local agent generates a fan noise.
What to Do Before the First Team Pulls 20GB
This Week:
- Get a number for current exposure. Query your endpoint management for
ollama,lmstudio,llama.cppand.gguffiles across managed devices. You are looking for a count, not a culprit — walking into the next conversation with "we have 340 machines running local inference" changes it entirely. - Ask your security lead one question in writing: if an engineer runs an agent locally against a customer database export, what artefact would we produce for an auditor? Get the answer on paper. It is the business case for everything below.
- Check whether any Ollama instance in your estate is bound to
0.0.0.0or listening on 11434 beyond localhost, and confirm the version is 0.17.1 or later.
This Month:
- Write the local-inference policy as an allow-with-conditions, not a ban. Bans produced the shadow AI numbers above. Name the approved runtimes, require a specific logging configuration, and specify which data classifications may never be processed by a locally-run agent.
- Price the two real options for producing a log: an endpoint agent that captures model I/O on the device, or a mandated local proxy every approved runtime must route through. Both are real work. Pick one now rather than discovering in 2027 that neither is procured.
- Add "runs entirely on employee hardware" as an explicit category in your AI system inventory. If your AI gateway is your inventory, your inventory is now structurally incomplete.
Before Renewal:
- Reprice your gateway and observability contracts against what they can actually see. If a meaningful share of agent runs moved on-device, you are paying for coverage of a shrinking denominator — and the vendor should be answering how they cover the rest.
- Ask every AI governance vendor in your stack the same question: what do you capture when inference happens on the endpoint? Most current answers are "we don't." Get it in writing before you renew, not after.
The Bottom Line
The industry spent two years building the control plane for enterprise AI at exactly one architectural chokepoint, because that is where the traffic was. Meta just made the chokepoint optional, gave the weights away under Apache 2.0, and pointed at Muse Spark 1.2 as the next one. Every gateway, guardrail and observability product you bought assumes a request it can see.
The engineers will do this because the model is good and the licence says they can. That is not a discipline problem, and treating it as one is how you end up with 340 unmanaged agents and no record of any of them. Decide now where an agent is allowed to run and what it must write down when it does.
The model got small enough to escape. Your audit trail did not get smaller with it.
Continue Reading
- Local AI Deployment Is Turnkey Now. Cloud Bills at Risk
- Apple Runs a 20B AI Model on iPhone. Your Data Never Leaves.
- Google Gemma 4: Why Apache 2.0 Changes Enterprise AI
- 90% of AI Usage Is Invisible to IT. The Breach Has Started.
- One Agent Escalated Another. Every Call Was Authorized.
- DeepSeek Will Raise Prices. Your Ceiling Is Already 4x.
- EU AI Transparency Law Starts Monday: Are You Ready?
- AI Agents Have Admin Access. 57% of Firms Aren't Ready.