The lead: provenance is now a feature
Two stories landed within four days of each other, and they mean more read together than apart.
On 15 October, Meta released Muse Spark Open, an open-weight model with 816 billion parameters (42 billion active per token), a one-million-token context window, and native multimodal input. Meta pitches it at coding and agentic work. The weights are on Hugging Face and the major clouds, and it runs on vLLM, SGLang, TensorRT-LLM and llama.cpp. The headline grabber: Meta says it runs on two M5 Ultra Mac Studios with MLX, and showed it fixing code and editing video entirely on-device (TechCrunch).
On 19 October, the US Department of Homeland Security published an order, signed in July, that bars federal civilian agencies from buying DeepSeek products and orders them removed from agency IT (PYMNTS). Reporting on the order says it also reaches "third-party products and services developed using DeepSeek implementations" (Mad Robot).
Why these belong together. For the past eighteen months, the strongest open-weight models have mostly come from Chinese labs. Meta's own benchmark table makes the point: Muse Spark Open still trails Kimi K3 and GLM 5.3 on several coding and agentic benchmarks. That created a quiet blocker for anyone in a regulated industry who wanted to run AI on their own infrastructure. The best weights you could own were often the ones your risk committee, your US parent company or your largest customer would not accept.
This week that blocker got smaller from both sides. A non-Chinese open model arrived that is close enough to the leaders for most enterprise work. And a government gave the first formal signal that model origin is a supply-chain risk, not a matter of taste.
What is actually new, and what isn't.
- Not new: open weights you can run yourself. Llama, Mistral and others have been around for years.
- New: a US-origin open model in the same capability tier as the Chinese leaders, with mainstream tooling support on day one.
- New: a government order that reaches past the vendor to the products built on its models. That moves the burden onto every software supplier to know which models sit inside what they sell.
- Overstated: "runs on a Mac." Two top-spec Mac Studios are a remarkable pilot rig, and the hardware bill is in the tens of thousands of dollars rather than the hundreds of thousands. But it is a single-team setup. Serving hundreds of concurrent users is still a GPU-cluster problem: Meta's model card puts the compressed NVFP4 weights at a minimum of 700 GB of GPU memory.
Read the licence before you draw the architecture. "Open weights" is not "open source", and the Muse Model License has two terms that matter:
- Internal use and embedding the model in your own product are free. But if you offer the model to third parties as an API or similar service, and your group's revenue exceeds US$20 million over any twelve months, you need a separate agreement with Meta first.
- Attribution is mandatory. Products built on it must display "Built with Muse Spark Open" in the UI, documentation, website or settings. If you are a vendor planning a white-labelled product, that is a commercial decision, not a footnote.
What to do on Monday
- Ask your AI vendors for a model bill of materials. Which base models, from whom, hosted where, fine-tuned on what. If a vendor can't answer in a week, that tells you something on its own. The DHS order applies only to US federal civilian agencies, but procurement teams copy each other, and multinationals push their rules down to their suppliers.
- Re-run your on-premise business case if you shelved it. The usual objections were "the open models aren't good enough" and "the good ones are the wrong nationality." Both are weaker this week. Weigh the real remaining costs (hardware, the people to run it, licence terms) against what you pay a cloud API each month.
- Don't overcorrect. A model's country of origin is one risk signal among several, not a quality verdict. A Chinese model running on your own air-gapped hardware sends no data anywhere. A US model behind a third-party API does. What protects you is controlling where the data goes. Provenance matters most where your customers or regulators say it does.
From where I sit in South Africa: no local rule like this exists yet. The revised national AI policy is targeted for January 2027 (Engineering News). But if you serve US-headquartered clients or handle their data, their procurement checklists will reach you well before Pretoria writes its own.
In my view
It's hardly surprising that the West is starting to push this approach of model origin as a security issue. The AI race is a replica of the arms race, strangely over the data that we've all been freely contributing to the internet for many years. Politics aside, very few people know how to operate a proper air-gapped system and I think this is what scares governments the most, rather than trying to fly their flag higher than others. Make no mistake that this slant on AI will continue for the foreseeable future. In cloud models we worry about where data is actually going, what happens in the case of a breach and how to protect not only our own data, but that of a customer also. In local AI, we worry about quality of output, GPU costs and sensible governance.
I'd say what is coming next, is additional regulation around observability and data-lineage. Most of these principles wouldn't be new to any data scientists or CIOs in the room. What does scare most leaders is the junior with their personal ChatGPT or Claude license that's just published their shiny new dashboard with all your client names to a GitHub repo.
Also moving
Microsoft now treats AI agents as insiders. On 19 October Microsoft extended Project Perception with "Guardian Agents" and dynamic, task-scoped permissions for AI agents. Each agent gets a continuous risk score, and as risk rises the system can block writes while keeping reads, demand human approval, or stop the agent outright. Its agent discovery now covers 60 agent types, including Claude Code and OpenAI Codex (Microsoft Security; GeekWire). The principle is right; Satya Nadella's version is "we should not ask a model to be its own security authority." So what: agent governance is becoming a feature of a US$99-per-user-per-month licence tier (Microsoft 365 E7), with wider availability planned around Ignite in mid-November. Before you buy, ask whether those controls still work on the agents you run outside Microsoft's stack, or whether the lock-in has simply moved from the model to the control plane.
Power, not chips, is the constraint on "sovereign" capacity. Microsoft confirmed on 19 October it has pulled out of leasing capacity at Nscale's planned data centre in Loughton, outside London. Former UK Prime Minister Keir Starmer once called it the country's largest sovereign AI data centre. UK media report the site was told it would not get grid power until the 2030s (AFP via CP24). So what: "sovereign cloud" is only as available as the local grid behind it. South African readers know this story by heart (thanks Eskom!). If your AI roadmap assumes in-country hyperscale capacity will be there on time, ask for the power connection date, not just the launch announcement. It also strengthens the case for small, efficient inference footprints you can actually power.
The sovereignty read
This week: moved toward ownership, with fine print.
A capable open model you can legally run yourself arrived, and governments started treating model origin as supply-chain risk. Both make it easier to own your AI stack. The counterweights: licence conditions on "open" models are getting more detailed, governance tooling is being bundled into premium tiers, and the grid is becoming a hard limit on everyone's capacity plans.
What I'm watching next week
- Meta's full evaluation report for Muse Spark Open, promised "soon".
- Whether the DHS order's reach into third-party products produces guidance for federal contractors.
- Microsoft's E7 agent-control pricing and availability ahead of Ignite.