Reflection released Beam's weights—what can outsiders verify?
The 501-billion-parameter model can now be downloaded under Apache 2.0, but its strongest performance and safety claims still come from the developer. The published safety report is unusually detailed and also exposes important unresolved risks.
The short version
- What happened
- Reflection AI released Beam's instruction-tuned weights in BF16, FP8 and NVFP4 formats on 16 October under Apache 2.0; the earlier 5 October announcement had only promised a later release.
- Who it affects
- Software teams gain another model they can run under their own controls, but workers and customers should not be promised faster or safer outcomes until errors, oversight and operating costs are measured on real tasks.
- What remains unproven
- There is no peer-reviewed paper or independent replication for Beam. Capability scores are developer-run; several safety tests use small samples, simulated environments or model judges, and the overall systemic-risk label is self-assessed.
Keep in mind
There is no peer-reviewed paper or independent replication for Beam. Capability scores are developer-run; several safety tests use small samples, simulated environments or model judges, and the overall systemic-risk label is self-assessed.
Multi-source analysis · 4 linked sources. Primary analysed source date: 16 October 2026.
Read the full report · 4 min The evidence, methods, implications and limitations
The material change is access, not another launch promise
Reflection AI made Beam's instruction-tuned weights downloadable on 16 October, turning its 5 October preview into a verifiable release. The model card lists a sparse mixture-of-experts system with 501.3 billion total parameters, 23.4 billion active per token, 52 layers and a one-million-token context window. BF16, FP8 and NVFP4 versions carry an Apache 2.0 licence. That gives researchers and organisations permission to inspect, modify and self-host the model instead of relying only on a vendor API. Access is not the same as accessibility: AWS says even the reduced-precision versions require substantial multi-GPU infrastructure, specialist serving software and workload-specific testing.[1][2][4]
The benchmark evidence is broad, but still company-run
Reflection reports 81.6% for the BF16 model on SWE-bench Verified, 80.1% on Terminal-Bench 2.1, 51.1% on Humanity's Last Exam with tools and 80.8% on MCP Atlas. The card says evaluations used temperature 0.7 and top-p 0.99 and publishes results for all three numerical formats. It does not provide uncertainty intervals, complete run traces or an independently controlled comparison with rivals. The release blog's claim of roughly three-times-fewer reasoning tokens therefore remains a developer estimate. The model card describes public, licensed and commercially obtained training data, with filtering and benchmark decontamination, but does not publish a source-by-source dataset inventory. Its one-million-token context is a supported technical limit, not evidence that every fact remains reliable across a document of that length. Teams should test representative repositories, tool permissions, failure recovery, latency and human correction time before treating benchmark scores as workplace productivity evidence.[2]
The distinction that matters
What the release lets outsiders inspect—and what it does not prove
The same publication package contains verifiable access facts, developer-run performance evidence and a self-assessed safety conclusion. They should not be given equal weight.
Weights and licence
Three checkpoint formats are downloadable under Apache 2.0
Access and reuse permissions can be checked directly
Capability table
Scores span coding, reasoning and tool-use benchmarks
Useful test targets, but not independent replication or workplace outcomes
Safety report
Methods and denominators are published for several risk evaluations
More auditable evidence, while the risk classification remains the developer's
The safety report adds denominators—and a reason for scrutiny
The separate safety report is more informative than a generic assurance. For automated systemic-risk benchmarks, Reflection says it ran each model three times and pooled the attempts. It tested all 100 text-only questions in the Human Pathogen Capabilities Test: Beam reached 61% exact-match accuracy, first among 13 compared models and 30 percentage points above the cited expert reference. That test measures knowledge, not successful laboratory work. On a ten-target DNA fragment-design task, Beam passed 23 of 28 completed attempts, while two more timed out; the tiny task set limits generalisation. These results matter because open weights can be adapted without the developer's hosted safeguards.[3]
Published methods improve accountability, not certainty
Reflection classifies Beam as having a limited effect across biological, chemical, cyber and loss-of-control risk categories. That is the developer's conclusion under its chosen framework, not a regulator's or peer-reviewed finding. Some safety evaluations used model judges, small samples or simulated environments; planned Iris evaluation artefacts were not yet available when checked. The useful next step is independent reproduction using the released weights, especially for multilingual use, prompt injection, cyber offence and biological uplift. For developers, the release creates a real option for local control. For organisations handling sensitive code or public services, it also transfers more responsibility for security, monitoring and incident response to the deployer.[2][3][4]