CHARLEMAGNE LABS

OLYMPUS opened an institutional file on Charlemagne Labs because a lab’s release report names it as the author of one of the tests that decides whether the lab’s model clears a catastrophic-risk threshold, and almost nothing else about it is public. This is not a psychometric profile, since an institution has no Dark Triad. It is a mandate, a money record with no figures in it, a founding story and a voice, and the finding is the arrangement: a start-up founded by a former Meta product manager with 12-plus years at the company wrote the scam threat model that supports Meta’s conclusion about Meta’s model.

Evaluator record: the engagements, the terms each document states, the findings quoted and what followed.

Institutional Archetype

THE BENCHMARK WITH A PRODUCT BEHIND IT — Charlemagne Labs sells Agent Charley, a 270-million-parameter model that runs on the user’s laptop and warns of phishing, social engineering and data leaks. It also built the benchmark, 852 simulated scam conversations, on which Meta scored Muse Spark and Muse Spark 1.1. The company’s own pages say its research “directly informs Agent Charley’s detection engine” and that it “managed to expand and enhance our internal evaluation suite into the comprehensive assessment that we performed for the Muse Spark release.” A benchmark author that sells the defense against the thing it measures is a common shape in security. In the frontier-lab evaluator layer it is rare, and it sits at the single point where a lab’s report states what a third party’s analysis did to the lab’s own risk call.

Mandate & Origin

In its own words. The About page: “We have combined decades of experience in safety, security and product design at Meta, the US Department of Defense, and numerous startups.” Mission: “Empower employees to operate securely in the AI era.” It lists research in “SLM Fine-Tuning,” “Data Engineering,” “Threat Intelligence” (“Proprietary intelligence on techniques used in dark web marketplaces and underground forums”) and “Threat Modeling” (“Analysis of cybercrime operations to identify capabilities ripe for AI uplift, before attackers get there”) (Charlemagne Labs, About).

Founding. Co-founder and CEO Jeremy Philip Galen, on 5 November 2025: “I was working as a Product Manager at Meta when the idea for Charlemagne Labs came to me.” He had started a team in 2023 called “Creator BadX,” studied account takeover and “observed that social engineering was growing in popularity among threat actors,” and left Meta to found a start-up because of “The rise of agentic AI” and “The possibility of working with Small Language Models (SLMs) for more privacy.” The company is named for his beagle (Charlemagne Labs, How Charlemagne Labs got started). The About page’s team list: Galen, “Co-founder & CEO,” “12+ years at Meta focusing on privacy, safety, and security”; Staford Titus Selvaraj, “Co-founder, AI & Security Lead”; Kseniia Ha, “Lead Interaction Designer” and “former Product Designer at Meta”; Richard Whaling, “ML Expert,” “Formerly director of data engineering at M1 Finance,” who signs the company’s research post as “Head of Research” (Charlemagne Labs, About; Charlemagne Labs, benchmark post). WIRED calls Galen “cofounder of Charlemagne Labs and an ex-Meta project manager who worked on countering social engineering scams” and says Whaling “cofounded Charlamagne Labs with Galen” (WIRED, 22 April 2026).

The product. On 6 November 2025 Whaling and Staford Titus S wrote: “Last Friday, we soft-launched Agent Charley, our local small-language-model for defensive cybersecurity,” a model built on “gemma3-270m,” which the post calls a “state-of-the art small language model (SLM)” (Charlemagne Labs, Building Agent Charley). Its careers page lists two open roles, both “Remote (U.S. preferred)” (Charlemagne Labs, Careers).

Funding & Backers

Money in. No investor, funding round, grant or revenue figure is stated on the company’s home, about, blog or newsroom pages. Its product is priced to customers: “On-device inference is a flat cost per seat, not a tax on protection” (Charlemagne Labs, Reverse Information Paradox). On 5 October 2026 it announced it was “one of five finalists in the Ninth Annual DataTribe Challenge,” at the Cyber Innovation Conference: “the finalists share $25,000 in prize money and work with DataTribe principals and seasoned cybersecurity entrepreneurs,” with a pitch on 27 October 2026 (Charlemagne Labs, DataTribe finalist).

Who pays for the benchmark. Meta’s report says it “engaged Charlemagne Labs” and that resource limits were “imposed by Charlemagne Labs” on the comparison runs; neither Meta nor the company states a fee, a contract value or whether the work was paid (Meta, Muse Spark report). The CEO’s post of 8 April 2026 says only that “Charlemagne Labs helped them evaluate how AI models perform in realistic social engineering scenarios” (Charlemagne Labs, 8 April 2026).

Institutional Voice & Intent

The company’s research post of 15 April 2026, by Whaling: “we feel strongly that an assessment that excludes social engineering - that is, a reliable and quantitative assessment of AI capabilities to deceive and manipulate humans in these scenarios - has a serious gap,” and “At Charlemagne Labs, we’ve been focused entirely on social engineering, as our very first priority, since day one” (Charlemagne Labs, benchmark post). The CEO to Fortune: “Because most AI researchers are more familiar with technical hacking and exploits, we believe social engineering — still the attack genesis for the vast majority of attacks — has gotten too little attention,” and “You can’t really train people, and that’s scary” (Fortune, 9 June 2026).

Stated intent: Make social engineering a measured axis of frontier-model risk and sell on-device defenses against it.

Observed intent: Place the benchmark in the release documents of a frontier lab, twice, and keep selling the product. Meta’s May report and July evaluation report both use it, and the company’s July post says it “cements multi-turn social engineering as a standard axis of frontier model evaluation”.

Gap: The company’s description and Meta’s differ on one point of method. The company’s April post says it decided, “in consultation with Meta,” to compare Muse Spark with open-weight models “as peers, rather than proprietary closed-source models from frontier labs such as Anthropic, Google, and OpenAI.” Meta’s report says that “Due to strong refusal behavior” on this evaluation, “we are unable to assess the true capabilities of helpful-only versions of those models.” Both give refusals as the reason; only the company’s post says the choice was made with Meta. The record does not settle whether the closed models would have scored higher. For the arrangement it does not need to (Charlemagne Labs, benchmark post; Meta, Muse Spark report).

Interest: Charlemagne Labs argues for practices in its own words; what adoption would pay it is set out from its own pages. No fee from any lab is stated by the company or by Meta.

• Social engineering as a standard evaluation axis. Position, the company’s, 11 July 2026: the Meta report “cements multi-turn social engineering as a standard axis of frontier model evaluation — alongside cyber offense, insecure code, and CBRN,” and “A benchmark that quantifies how persuasively a model can manipulate people is now table stakes for responsible release, and we’re proud to be the ones building it.” What it pays: the benchmark is the company’s; a standard axis is a recurring use of its suite and the strongest sales fact for a company whose product is the defense. The April CEO post says the company is “assiduously improving Agent Charley … based on the insights we’re gathering about AI-powered social engineering offense.” Best case, the company’s: “the overwhelming majority of real-world cyber incidents start with a human.” Convergence: Meta, whose report says the evaluation “addresses the current lack of coverage for measuring multi-turn social engineering capabilities,” and the technical cyber testers, since the company says “we very much share the concern of Anthropic, AISI, and other researchers” about automated end-to-end attack and positions its test beside theirs (Charlemagne Labs, 11 July 2026; Charlemagne Labs, 8 April 2026; Meta, Muse Spark report).
• Open-weight models as the defender’s base and the comparison set. Position: “open-source models also provide, in our opinion, the best possible defense against rapidly proliferating cyber threats,” and Whaling to WIRED: “We rely on open source models to train our defensive model,” and “That relies on a healthy open-source community.” What it pays: Agent Charley is built on Google’s Gemma open-weight model and the benchmark’s reference frame is open-weight models, so open releases are an input to both. Best case, the company’s: “threat actors have, so far, relied on open-weights models rather than closed-source models.” Convergence: Meta, which reports open-weight comparisons as the frame for Muse Spark, and the developers of the open-weight comparison models (Qwen, DeepSeek, Kimi, GLM) whose scores the benchmark prints (Charlemagne Labs, benchmark post; WIRED, 22 April 2026; Meta, Muse Spark report).
• The trust boundary is the device. Position: “The trust boundary has to be the device,” and “A hosted frontier LLM fails every one of those tests at once.” What it pays: the argument is the product’s design rationale and sets the product against hosted frontier models, including those it scores. Best case, the company’s: “a smaller model, on the device, that never needed the data in the first place.” Convergence: the essay it cites by Microsoft’s chief executive (Charlemagne Labs, Reverse Information Paradox).

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

• Social accounts and feeds. X @charlemagnelabs. No RSS or Atom feed is published; its blog index is charlemagnelabs.ai/blog.

Position in the Apparatus

Meta, May 2026. The Muse Spark Safety & Preparedness Report (arXiv v1 dated 14 May 2026; the company’s posts of 8 and 15 April 2026 say the report was out by then) names Charlemagne Labs in its cybersecurity chapter. It describes “multi-turn adversarial conversation benchmarks developed in collaboration with Charlemagne Labs” and says: “we engaged Charlemagne Labs to develop a detailed threat model and end-to-end analysis of the unit economics and operational requirements of major categories of scam, including spear phishing and pig butchering.” The analysis “identified several potential bottlenecks within such adversarial operations that could theoretically be reduced or eliminated by highly capable AI models, with the largest opportunities for adversarial uplift identified to be elements of the kill-chain other than social engineering”. The benchmark: “an Attacker model attempts to convince a Victim to perform some action (download a file, click a link, etc.), and the Victim is secretly instructed to push back”; 852 scenarios, “8 different scam target/demographic profiles, 7 different categories of scam, and 7 different target actions”; scored by a judge on believability, consistency and sustained turns, with Gemini 3.0 or 3.1 Pro as judge and victim. Muse Spark scored 57.3, “slightly above the next highest score on this set of models without system level defenses exhibited by Kimi 2.5 (54.0).”

The conclusion that cites the analysis. Meta: “We do not believe that observed uplift in capability on this evaluation (even without additional mitigations) would be sufficient to trigger a determination of high risk that the model could contribute to the realization of the Cyber 3 outcome described in Meta’s Advanced AI Scaling Framework. This assessment is informed by analysis of the threat model and cost-benefit analysis produced by Charlemagne Labs, which indicate that this marginal increase in social engineering capabilities would not be adequate to cause the required step change in adversarial operations scaling to result in a catastrophic outcome such as Cyber 3.” A footnote adds: “max_tokens was set to 1024 for all OSS comparison models due to resource constraints imposed by Charlemagne Labs, which resulted in 50% of Kimi K2.5 responses being truncated. Therefore, the composite score estimate for Kimi K2.5 may underestimate true model capabilities.” The report states why closed models were not scored: “Due to strong refusal behavior … on this evaluation for comparison models that are only available behind APIs with system level guardrails in place (e.g. Anthropic, OpenAI, Google models), we are unable to assess the true capabilities of helpful-only versions of those models” (Meta, Muse Spark report).

Meta, July 2026. The Muse Spark 1.1 Evaluation Report (dated 9 July 2026) assesses Cyber 3 “through a multi-turn social-engineering capability evaluation, using a benchmark developed by Charlemagne Labs,” and prints “Composite score by model on Charlemagne Labs’ multi-turn social-engineering capability benchmark” for Muse Spark 1.1, GPT-5.5, Claude Opus 4.8 and Gemini 3.1 Pro: here the closed models are scored. It repeats the caveat that “this capability is not the most direct factor limiting the scale of current fraud kill-chains” (Meta, Muse Spark 1.1 Evaluation Report).

The press. Fortune (9 June 2026): “According to research from Charlemagne Labs, an AI-security startup, AI models already widely available can now sustain believable, multi-turn deception,” which “may enable convincing, automated end-to-end scams within 12 to 24 months.” WIRED (22 April 2026), whose reporter ran the company’s tool against several models: “Meta used Charlemagne Labs’ tool to test the capabilities of its latest model, called Muse Spark.” The company’s newsroom lists a Washington Post opinion piece of 28 July 2026 (Fortune; WIRED; Charlemagne Labs, Newsroom).

Where else. No document of OpenAI, Anthropic, Google DeepMind, xAI, Microsoft or Mistral AI read for the evaluator map names Charlemagne Labs; its engagements are Meta’s, and the other labs’ models appear in the 1.1 report only as models Meta scored. Meta names its other testers in the same report: Apollo Research, Irregular, Gray Swan, SecureBio, Faculty, Trajectory Labs, with Deloitte and Frontier Design as biology consultants; Charlemagne Labs is the only one the report credits with a threat model on which a threshold determination rests.

Actions & Leadership Choices

• 2025. By 5 November 2025 Galen has left Meta to found the company, per his post; Agent Charley soft-launches on 31 October 2025 (Charlemagne Labs, How Charlemagne Labs got started; Charlemagne Labs, Building Agent Charley).
• 8 April 2026. Meta releases Muse Spark; the CEO posts that Charlemagne Labs “helped them evaluate how AI models perform in realistic social engineering scenarios” and that “Meta is taking the lead in including social engineering in cybersecurity risk analysis” (Charlemagne Labs).
• 15 April 2026. The benchmark post says the evaluation suite was “released as open source on github, subject to the considerations in our responsible disclosure statement” and that “We’ll be releasing a full report of our comprehensive benchmarking separately” (Charlemagne Labs, benchmark post).
• 9 and 11 July 2026. Meta publishes the 1.1 report; the company says it is “the second Meta evaluation cycle to adopt our benchmark” (Charlemagne Labs, 11 July 2026).
• October 2026. DataTribe finalist; pitch set for 27 October.

CONDUCT: STRUCTURAL — THE FOUNDER IS A FORMER EMPLOYEE OF THE LAB WHOSE MODEL THE BENCHMARK SCORES, AND THE LAB’S RISK DETERMINATION CITES THE FOUNDER’S ANALYSIS. Both halves are in the parties’ own words: Galen’s About-page career is “12+ years at Meta,” and Meta’s report says its Cyber 3 assessment “is informed by analysis of the threat model and cost-benefit analysis produced by Charlemagne Labs.” Nothing in the record says the analysis was shaded. The point is that the arrangement has no independent check printed with it.

Alliance Map

These run at the same time. One small company has a founder from the lab, a benchmark in the lab’s reports, a threat model the lab’s risk call cites, a product built on another lab’s open-weight model and a venture firm’s pitch stage, and states no investor. Each tie is stated by the company or by Meta. The overlap is the finding.

Reach Assessment

Institutional: Its benchmark and threat model sit inside one lab’s catastrophic-risk determination for a consumer model. Memetic: The Fortune and WIRED pieces carry its “12 to 24 months” claim to a general audience. Civilizational: If AI-run scams are the first catastrophic-risk domain to be fully automated, the measure that says whether a lab’s model is a step change belongs to whoever builds the benchmark. A test of that kind with one customer and no printed independence is thin footing; the weakness is structural, not a finding about the test.

Score basis. Atk 4 is reach: Meta’s May report says “we engaged Charlemagne Labs to develop a detailed threat model,” prints the benchmark’s scores and says its Cyber 3 assessment “is informed by analysis of the threat model and cost-benefit analysis produced by Charlemagne Labs”; the July report uses the benchmark on three other developers’ models (Meta, Muse Spark report; Meta, Muse Spark 1.1 report). It stays at 4 because one developer’s documents carry it, no statute or gate requires anyone to ask, and the benchmark is one axis of one domain; Signature Science at 4/6/5, hazard 50, is named in three Anthropic cards and a NIST agreement, and 10a Labs at 5/5/4, hazard 47, in four cards of one lab. Def 3 is funding insulation: its pages state no investor, round or revenue, its product is sold per seat, and its CEO’s own page lists 12 or more years at Meta, the lab whose model the benchmark scores (Charlemagne Labs, About); Trajectory Labs at 7/4/5, hazard 53, holds one point more, because its profile records lab-commissioned work at three labs and no named funder. Hp 2 is entrenchment: a product launched on 31 October 2025 and a benchmark in two Meta reports, with nothing in statute or procurement, below Gryphon Scientific at 5/4/3, hazard 40, whose rubrics sit inside a published OpenAI study (Charlemagne Labs, Building Agent Charley). Hazard 30 follows the (atk+def+hp) x 10/3 convention the same peers follow. The values hold.

Sources: Charlemagne Labs, About; Charlemagne Labs, How Charlemagne Labs got started; Charlemagne Labs, Building Agent Charley; Charlemagne Labs, Introducing the Charlemagne Labs benchmark for Social Engineering Capability; Charlemagne Labs, Meta releases Muse Spark; our CEO interviewed on TBPN; Charlemagne Labs, Muse Spark 1.1 evaluated on our multi-turn social engineering benchmark; Charlemagne Labs, The Reverse Information Paradox is why Agent Charley is an SLM; Charlemagne Labs, DataTribe finalist; Charlemagne Labs, Careers; Charlemagne Labs, Newsroom; Muse Spark Safety & Preparedness Report: Meta, arXiv; Muse Spark 1.1 Evaluation Report: Meta; AI is supercharging cyberattacks: Fortune (9 June 2026); WIRED, AI Lab newsletter (22 April 2026).