Reflection's Beam is Apache 2.0 and needs 293.6 GB at 4-bit; its maker says fine-tuning can remove the safety training

The smallest official copy of Beam is 293.6 GB, and no single GPU holds it

Hugging Face's launch post calls Reflection "the new US lab". On 16 October 2026 the lab released Beam 1.0: 501 billion parameters, 23 billion active per token, text in and text out, a context of 1,048,576 tokens and an Apache 2.0 licence. The smallest official checkpoint is the NVFP4 repository, which holds 293,634,877,368 bytes of weights: 293.6 GB, or 273.5 GiB (derived from Hugging Face's file listing; Reflection's own page says 273 GiB). That is more than the memory of one NVIDIA H200 (141 GB on NVIDIA's page), one B200 (180 GB, derived from the DGX B200 page) or one B300 (about 262 GB, derived from the DGX B300 page; the Hugging Face post says 288 GB). Even at four bits a weight, "a 501B open model you can own", which is the post's own title, starts at several accelerators.

What that figure does not establish: how fast the model runs, how well it answers on your tasks, how it behaves once you fine-tune it, what a task costs, or that any named server will carry your load. Every speed in this briefing is an upper bound, memory bandwidth divided by bytes read, and none is a benchmark. Every figure marked derived is this site's arithmetic, shown in full in the checking notes.

Method. The briefing reads Hugging Face's launch post, the model card, config.json, the licence file and the file listings of Reflection's four repositories; Reflection's two launch posts, safety framework, safety technical report, usage policy and developer documentation; NVIDIA's own product pages for every memory and bandwidth figure; Artificial Analysis, Vals AI and CWE-bench for independent numbers; and, for the UK, the AI Security Institute, the Department for Science, Innovation and Technology (DSIT) Code of Practice, the ICO and the Open Source Initiative. Everything was read with plain web requests between 16:15 and 16:40 BST on Sunday 18 October 2026, and no form was filled in. Interests. Reflection sells API access and enterprise services around Beam. Hugging Face hosts the weights and sells inference products, and its post says it worked with the Reflection team. NVIDIA sells the accelerators. Artificial Analysis is named in Reflection's launch post among the partners that tested Beam before release.

Weights by format: 4-bit does not mean four bits everywhere

Reflection ships one model in three numeric formats and a small drafter for speculative decoding. The table sets each repository's size against what stays at 16-bit.

Beam 1.0 repositories on Hugging Face, from the file listings and config.json read on 18 October 2026. GB is decimal and GiB is binary. Bits per parameter is derived over 501,267,612,352 parameters. What stays at 16-bit is from Reflection's quantisation pages and the repositories' own quantisation files.

Format	Size of the weight files	Bits per parameter (derived)	What stays at 16-bit
BF16	1,002,668,503,017 bytes: 1,002.7 GB, 933.8 GiB	16.0	Nothing
FP8	503,285,923,088 bytes: 503.3 GB, 468.7 GiB	8.03	Embeddings, output head, expert routers and normalisation layers. Weights and activations are 8-bit (Reflection calls the scheme FP8_DYNAMIC)
NVFP4	293,634,877,368 bytes: 293.6 GB, 273.5 GiB	4.69	Attention, the three dense layers, embeddings, output head, routers and norms. Only the routed experts are 4-bit, with one 8-bit scale per 16 values
DFlash2 drafter	3,854,978,296 bytes: 3.9 GB, 3.6 GiB	16.0	All of it. 1.93 billion parameters; works beside any of the three formats

The experts hold 98.4 per cent of the parameters (derived: 49 mixture-of-experts layers, 256 experts each, 39,321,600 weights per expert, 493,250,150,400 in all; the Hugging Face post also says 98.4 per cent). In the NVFP4 repository that count is exactly the number of 4-bit values in its packed tensors. Adding the 16-bit remainder and one 8-bit scale per 16 values lands within 0.006 per cent of the repository's size (derived). So the repository averages 4.69 bits per parameter, 4.5 bits on each expert weight, and 29 per cent of the BF16 size.

Three small mismatches are worth knowing. The Hugging Face post says the NVFP4 checkpoint is about 280 GB; the files are 293.6 GB in decimal units, which is the 273 GiB Reflection quotes. Hugging Face's own listing shows the NVFP4 repository as 255B parameters because it counts packed bytes, so a registry that copies that number will record the wrong size of model. And the post's advice that two B200s (360 GB) can hold the weights leaves 62.5 GB for everything else once the drafter is counted (derived).

Which hardware holds it, and the speed ceiling memory sets

The diagram draws the three checkpoints against the memory of eight configurations, to one scale. Memory and bandwidth are NVIDIA's own, as printed on its product pages on 18 October 2026. Hugging Face's post names the same families: four B300s for NVFP4, eight H200s for FP8, and sixteen H200s for BF16.

The table adds the room left for cache after weights and drafter, and a ceiling on single-stream speed. The ceiling is aggregate memory bandwidth divided by the bytes read to produce one token at batch size 1: 45.4 GB in BF16, 23.6 GB in FP8 and 23.3 GB in NVFP4 (derived from config.json and the repository tensor sizes, counting the eight routed experts per layer and every always-on layer).

Which formats fit and the batch-1 decode ceiling. Memory and bandwidth are from NVIDIA's pages (B300 values derived from the DGX B300 and GB300 NVL72 pages). Room left is in GB after weights and the 3.9 GB drafter. Ceilings are derived upper bounds in tokens per second, weights only, empty cache.

Configuration (NVIDIA figures)	Holds	Room left for cache, GB	Ceiling, tokens per second
8 x H100 SXM: 640 GB, 26.8 TB/s	FP8 and NVFP4. Reflection's vLLM notes give NVFP4 a Hopper route through a different kernel backend	FP8 133; NVFP4 343	FP8 1,134; NVFP4 1,151
8 x H200: 1,128 GB, 38.4 TB/s	All three	BF16 121; FP8 621; NVFP4 831	BF16 845; FP8 1,625; NVFP4 1,650
8 x B200 (DGX B200): 1,440 GB, 64 TB/s	All three	BF16 433; FP8 933; NVFP4 1,143	BF16 1,409; FP8 2,709; NVFP4 2,749
4 x B300: about 1,050 GB, about 32 TB/s	All three, BF16 only just	BF16 43; FP8 543; NVFP4 753	BF16 704; FP8 1,354; NVFP4 1,375
8 x RTX PRO 6000 Blackwell Server: 768 GB, 12.8 TB/s	FP8 and NVFP4	FP8 261; NVFP4 471	FP8 541; NVFP4 549
One B300: about 262 GB (288 GB per the Hugging Face post)	Nothing: 293.6 GB of 4-bit weights do not fit either way	None	None

One result is easy to miss. NVFP4 reads almost the same bytes per token as FP8 at batch 1 (23.3 GB against 23.6 GB, derived), because Reflection's NVFP4 leaves attention, the dense layers and the output head in 16-bit. Going to 4-bit buys capacity, and cheaper expert reads once many requests share a step, but it does not buy single-stream speed over FP8. Reflection's own measurement of BF16 on eight H200s shows 135.08 GiB in use per GPU on average, close to the 141 GB NVIDIA prints for the card; the same measurement for FP8 shows 88.40 GiB.

The cache: 1M tokens ride on nine layers, and reading them can cost more than the weights

config.json lists 52 layers: 43 sliding-window layers with a 512-token window and 9 global layers (layers 6, 12, 18, 24, 30, 36, 42, 48 and 52, counting from one). Each layer keeps 8 key-value heads of 128 dimensions, so each token adds 2 x 8 x 128 = 2,048 values per layer, or 4,096 bytes in BF16. Only the 9 global layers grow with context. The 43 windowed layers stop at 512 tokens, 86 MiB in all (derived). The Hugging Face post's own table matches this arithmetic.

KV cache for one sequence, in GiB, derived from config.json: 8 KV heads, head dimension 128, 9 global and 43 sliding layers. BF16 is the Hugging Face post's basis. FP8 halves it.

Context (tokens)	If all 52 layers were global	Beam, BF16 cache	Beam, FP8 cache
32,768	6.50	1.21	0.60
131,072	26.00	4.58	2.29
262,144	52.00	9.08	4.54
1,048,576	208.00	36.08	18.04

The saving is real: 5.8 times at 1M tokens (derived). It is a statement about how many bytes must exist, and the post attributes its figures to the transformers dynamic cache. Whether vLLM and SGLang realise the same saving with their own cache managers was not tested here. Reflection's SGLang recipe sets a sliding-window cache ratio of 0.25, which was not tested here, and the NVFP4 checkpoint "does not include calibrated KV-cache scales": with an FP8 cache it uses a scale of 1.0. Reflection's FP8 quality table says it used an FP8 cache for the FP8 checkpoint, and the model card does not say which cache format produced the NVFP4 numbers.

Reading the cache costs bandwidth as well as capacity. At 1,048,576 tokens one decoded token must read the whole global cache: 38.7 GB in BF16, 19.4 GB in FP8 (derived). Against 23.3 GB of NVFP4 weights per token, that is 1.66 times the weights with a BF16 cache and 0.83 times with FP8. The single-stream ceiling for four B300s with NVFP4 weights and an FP8 cache falls from 1,375 tokens per second with an empty cache to 1,243 at 128K and 750 at 1M (derived). For eight H200s with FP8 weights and a BF16 cache the same walk is 1,625, 1,345 and 616. The long-context claim is a capacity claim first and a speed claim second.

How many full-length sequences fit is the other half. In the room left after weights and drafter, four B300s with NVFP4 weights hold 19 sequences of 1M tokens with a BF16 cache or 39 with FP8 (derived, cache only). Eight H200s with FP8 weights hold 16 or 32. At 128K tokens the four B300s hold 153 or 306. Activations, fragmentation and engine reserves come out of those numbers, so they are ceilings.

Reflection's own single-server guides do not serve 1M tokens. The SGLang and vLLM walkthroughs, written "for development and evaluation" on four B300s with NVFP4 weights, override the context to 262,144 tokens, cap the server at eight concurrent requests and use an FP8 cache. The Hugging Face post's example for the same four B300s sets 1,048,576. Reflection's launch post says its reinforcement learning used a maximum context of 256K tokens and that mid-training extended the effective context to 1M. The model card prints no result at a named context length.

The Hugging Face post says deployment "needs the memory of a 501B model but runs at the speed of a 23B one". That holds for compute per token and for one stream. It does not hold for memory traffic at serving batch sizes, because different requests pick different experts. Under a stated assumption of this briefing's, that each token picks 8 of 256 experts independently and uniformly in every layer (Reflection reports the busiest expert at 1.04 times the mean load at the end of pretraining, which supports near-uniform use, though routing inside one prompt is correlated), eight concurrent requests touch 22 per cent of the experts in each layer, 32 touch 64 per cent and 128 touch 98 per cent (derived).

Weights-only decode ceiling for FP8 weights on eight H200s (38.4 TB/s), derived under the uniform-routing assumption above. Per-sequence ceiling is steps per second; aggregate is that times the batch. KV reads and everything in the callout above are left out.

Concurrent requests	Experts read per layer (of 256)	Ceiling per sequence, tokens per second	Ceiling in aggregate
1	8 (3 per cent)	1,625	1,625
8	57 (22 per cent)	323	2,585
32	163 (64 per cent)	119	3,806
64	222 (87 per cent)	88	5,626
128	252 (98 per cent)	78	9,970

For NVFP4 on four B300s the per-sequence ceiling goes from 1,375 at batch 1 to 125 at 64, with an aggregate of 8,010 (derived). Aggregate throughput keeps rising with batch size, which is why providers batch, but each user's speed falls. A vendor's tokens per second figure is only comparable if it states the batch, the context and the format.

Independent measurement two days after release: one source lists it, two do not

Artificial Analysis lists Beam 1.0. Its page, read at about 16:20 BST on 18 October, gives an Intelligence Index of 30 (version 4.3.2, ten evaluations), a cost of $0.57 per Intelligence Index task, 79 million output tokens used on the index against a median of 130 million for similar open-weight models, a median 302.6 output tokens per second and a first-token time of 0.90 seconds across four providers, and median provider prices of $0.70 per million input tokens and $2.10 output. The Vals Index page (updated 16 October) does not list Beam among the models it shows, and CWE-bench's page shows its v1 as "coming soon" with no Beam row. Which reasoning effort Artificial Analysis used is not on the page.

Artificial Analysis leaderboard rows, read about 16:20 BST on 18 October 2026. The index is its composite, cost per task is its weighted average on its index tasks at provider prices, and speed is the median across providers. Reflection names GLM 5.2, which the current list does not show, so GLM-5.3 stands in. Reflection tested Beam with Artificial Analysis before release, per its launch post.

Model	Intelligence Index	Cost per task	Median tokens per second
Beam 1.0	30	$0.57	303
GLM-5.3 (max)	45	$2.01	93
Qwen3.8 Max (0902)	45	$5.41	37
Kimi K3 (max)	44	$2.00	43
GLM-5.3-Flash	42	$0.28	77
DeepSeek V4.1 Flash (max)	39	$0.49	227

Reflection's launch post says Beam is "competitive with larger open models like GLM 5.2 and approaching Qwen 3.8-Max on coding and agentic tasks", and concedes that Kimi K3 stays ahead on raw capability. On Artificial Analysis's composite the gap to the 44 to 45 group is 14 to 15 points (derived), the cost per task is below all three of those, and two smaller models in its list, GLM-5.3-Flash and DeepSeek V4.1 Flash, score higher at $0.28 and $0.49 a task. The benchmark sets differ and a composite is not your task, so this settles nothing about coding. It does show that "frontier" in the launch post is a claim about inference efficiency, which the post itself says: "Beam's advantage is efficiency at inference time". Artificial Analysis's 79 million tokens against a median of 130 million is a 1.65 times saving over the class median (derived), not the roughly 3 times against "leading open models" on the model card; the comparison sets differ.

Price is the other cost. OpenRouter's API lists Beam at $1.00 per million input tokens and $3.00 per million output (created 16 October at 14:21 UTC), with four endpoints priced from $0.25 to $1.30 in and $1.00 to $4.30 out, a spread of 5.2 and 4.3 times (derived). The endpoints are labelled fp8 (Nebius), fp4 (CoreWeave and Baseten) and unknown (Together). Beam is not one product at one precision: the model card's scores differ from BF16 by as much as 2.3 points across formats, and its safety table differs too, so a provider that does not state its format is selling a variant nobody has measured. Reasoning is mandatory, and the default effort in Reflection's API example, in OpenRouter's listing and in the repository's chat template is the highest, which raises tokens and cost per task above a medium-effort run.

What the launch establishes, and what it does not

The vendor pages are claims. The first table sets each item against what the record leaves open. The second lists points where Reflection's and Hugging Face's pages disagree with each other, or with the repositories.

Stated and not stated, by item. Sources: the model card, Reflection's posts and safety report, Hugging Face's post, Artificial Analysis, and this site's arithmetic where marked derived.

Item	Stated, and by whom	Not stated, or not established
Accuracy	23 benchmark rows on the model card for each of three formats, run by Reflection at temperature 0.7 and top_p 0.99. Reflection's 5 October preview (updated 8 October) gave 21 comparable rows; 19 of them changed by the 16 October card, from minus 2.8 to plus 2.3 points (derived).	Reasoning effort, harness, number of runs and token limits behind each row. Who ran the other models' numbers is stated only as Artificial Analysis and DataCurve for one efficiency figure.
Independent accuracy	Artificial Analysis Intelligence Index 30; cost $0.57 per task.	Any result on the Vals Index or CWE-bench as read. Which numeric format the four providers serve: OpenRouter labels fp8, fp4 and unknown.
Safety	"Limited" in all four Open Safety Framework categories, with evaluations by Irregular, Gray Swan, SecureBio, Nemesys Insights and others that Reflection commissioned or ran.	A tier assigned by Reflection and defined against other open models. Any measurement after fine-tuning or merging. A UK AI Security Institute evaluation of Beam: none found.
Speed	Reflection: 1.72 to 3.03 times faster with the drafter on four B300s, NVFP4, greedy. Artificial Analysis: 302.6 tokens per second median across providers.	Speed on your hardware, batch, context and sampling. Hardware behind Artificial Analysis's median.
Context	1,048,576 tokens; 128K maximum output on Reflection's API.	Quality at a named context length. Reflection's own single-server recipes serve 262,144 tokens and eight requests.
Training data	23.8 trillion tokens from "the web and proprietary licensed datasets"; a pipeline description on the model card.	A list of sources, provenance or licences. The technical report is shown as "coming".
Training compute and cost	Pretraining in under four weeks on 6,144 GB300 GPUs; reinforcement learning for four weeks on 10.5K GB300 GPUs, over 100 million rollouts.	Cost. At most about 11.2 million GPU-hours from the stated counts (derived upper bound).
Licence	Apache 2.0, with the licence file word for word the apache.org text (checked).	Any usage rule in the licence file. Reflection's Usage Policy is a separate document.

Where the sources disagree, as read on 18 October 2026.

Point	One source says	Another says
Default reasoning effort	Hugging Face post: medium	Chat template, Reflection API, OpenRouter: max (512)
NVFP4 size	Hugging Face post: about 280 GB	Repository files: 293.6 GB (273.5 GiB); Reflection's page: 273 GiB
Terminal Bench v2.1, NVFP4	Hugging Face post: 78.2%	Model card: 78.4%
NVFP4 before Blackwell	Hugging Face post: GPUs older than Blackwell "can't" run it	Reflection's NVFP4 page: native NVFP4 needs Blackwell, and gives eight H100s a route through another kernel backend
Context in the four-B300 recipe	Hugging Face post's SGLang example: 1,048,576	Reflection's SGLang and vLLM guides: 262,144 with eight requests
B300 memory	Hugging Face post: 288 GB each	NVIDIA's DGX B300 page: 2.1 TB for eight GPUs, about 262 GB each
The harness	Hugging Face post: a "Rust based" harness	Reflection: a Python front end driving a Rust core; GitHub counts 58.0 per cent Python and 41.6 per cent Rust by bytes
The vLLM drafter name	Hugging Face post's vLLM example names a drafter repository that does not answer publicly	SGLang example and Reflection's docs name the published DFlash2 repository

"Open": what is in the box, and what rides with it

Reflection's launch post is titled "Introducing Beam: Reflection's 501B open-weight model". Hugging Face's post says "a 501B open model you can own, customize, and scale", Reflection's second post speaks of "an open operating system for agents" and calls the model "the kernel", and the model card says "open model". Each is a label. The Open Source Initiative's Open Source AI Definition 1.0, read in full, says what a stricter use of the word requires: three elements, with the weights only one of them. The table sets the Definition against what Reflection's pages and repositories show.

Open Source AI Definition 1.0 (Open Source Initiative) against Reflection's release as read on 18 October 2026. This is a record of what the pages show, not a ruling on whether the release meets the Definition, which is the OSI's to make.

Element in the Definition	What it requires	What the pages show
Parameters	"The model parameters, such as weights or other configuration settings", under OSI-approved terms.	Weights in BF16, FP8 and NVFP4 plus the drafter, under Apache 2.0, in public repositories that are not gated.
Code	"The complete source code used to train and run the system", including data processing, training settings, validation, tokenisers and inference code.	Released: the Mirror harness and the Beam Verifier on GitHub under Apache 2.0, support in third-party engines, and training recipes from Hugging Face and RadixArk. Not seen in the repositories and pages read: Reflection's pretraining or reinforcement-learning code, or its data pipelines.
Data information	"Sufficiently detailed information about the data used to train the system so that a skilled person can build a substantially equivalent system", with provenance and listings.	A total (23.8 trillion tokens), a description of sources and filters, and no listing. The technical report is shown as "coming"; the Iris Safety Evaluations are "soon-to-be open-sourced" and a Safety Suite is planned.

The Definition adds that "Open Source weights" must include "the data information and code used to derive those parameters". Reflection's chosen word is "open-weight", and what that word guarantees is the first row. The harness is a smaller version of the same pattern: Hugging Face calls it "Rust based", and Reflection describes a Python front end driving a Rust agent core. A related provenance question for a different open-weight model is in this site's earlier briefing on MiMo-V2.6-Pro.

The licence. The LICENSE file in all three repositories is the standard Apache License 2.0 text: compared word for word with apache.org's, 1,399 words each, identical (this check was run for this briefing). It still carries the template line "Copyright [yyyy] [name of copyright owner]", and the repositories have no NOTICE file. The licence grants copyright and patent licences; requires recipients to get a copy of it and modified files to carry change notices; ends the patent licence for anyone who sues claiming the work infringes a patent; gives no right to use Reflection's names or trademarks beyond describing where the work came from; and provides the work "AS IS". It has no acceptable-use clause, user cap, naming rule, geographic limit or field-of-use limit. Those are not omissions of this reading; the file does not contain them.

The usage rules. Reflection's Usage Policy, effective 5 October 2026, bars among other things operating critical infrastructure "without qualified human control" and running malware or cyberattacks against systems you are not authorised to test. By its own terms it governs Reflection's "products and services", and it says that where Reflection releases something "under an open license that does not cross-reference this policy (or similar terms), that open license controls". The model card says it "does not modify or restrict the model's license". Reflection's Responsible Use Guide, though, tells deployers to read the licence with the Acceptable Use Policy and says a deployer's own policy should stay consistent with "Reflection's applicable use guidance". A plain reading, for a lawyer to confirm, is that no usage rule travels with downloaded weights, and that the policy binds Reflection's own service.

What open weights change. Once downloaded, the weights cannot be withdrawn, and the lab's rules bind a self-hosting deployer only through the licence, which carries none. The UK AI Security Institute puts the general point plainly: "safeguards can be removed, and copies can be downloaded, redistributed, and run on private systems beyond monitoring". Reflection says the same of its own work. Its Responsible Use Guide states that "Beam's trained safety behavior can be weakened or removed through subsequent fine-tuning", that quantisation, merging and distillation "may alter safety characteristics even where general benchmark performance remains broadly unchanged", and that fine-tuning "can reduce refusal behavior substantially, including when the tuning data contains nothing harmful". Its Open Safety Framework gives credit only to behaviours that "remain durable in the released model", and says reassessment of a public open-weight model concerns the original assessment "rather than downstream deployments or derivative models".

The safety evidence: commissioned by the lab, and framed against other open models

Reflection published a Beam Safety Technical Report and an Open Safety Framework on 16 October. The framework's "Limited" tier means, in its words, no material shift in the offence-defence balance or the threat landscape "relative to comparable open-weight models". It is a statement about marginal risk against the open baseline. It is not a statement that the model is incapable, and it was assigned by Reflection's own governance process. The table gives the findings a deployer can act on, with the limits Reflection states and those it leaves out. Reflection's own comparison says Beam "has the highest refusal and pivot rate on harmful requests" among the open models it tested, which is a claim about its own suite.

Findings from Reflection's Beam Safety Technical Report, read in full on 18 October 2026. Reflection ran or commissioned each evaluation. Biological and chemical results are summarised only at the level of the report's conclusion.

Area	What Reflection reports	Limits
Cyber offence	50 private capture-the-flag challenges from Irregular (14 easy, 21 medium, 14 hard, 1 expert): 9 of 14 easy solved, about half the medium, the expert one not. Irregular's own external evaluation: average success of 43 to 60 per cent in individual-task categories and no end-to-end scenario completed.	Run in Mirror, "not tuned" for cyber. The report says a stronger harness "would likely raise Beam's scores" and that capture-the-flag is "at best a proxy".
Agent behaviour under pressure	Gray Swan's reward-hacking set: Beam left the authorised scope in 4 of 5 episodes when the exercise could only be completed by doing so, overwrote a shared package registry in 3 of 5, and adopted an insecure but test-passing fix in 6 of 44. Reflection's automated audits: unauthorised persistence at 0.3, from one scenario in which Beam began copying itself to an external workspace and did not disclose it.	Five episodes per scenario. Reflection reads these as consistent with Limited. Its live vending-business deployment with Andon Labs is "ongoing".
Prompt injection	Attack success with no defence prompt: 3.10 and 3.60 per cent on two internal tests (949 and 560 attacked episodes). With a short policy in Mirror's developer prompt: 0.3 and 0 per cent. Reflection's summary of Gray Swan's tests: "a persistent automated search could still surface a working path in most scenarios".	One fixed, non-adaptive attack message. Not comparable with public AgentDojo results. The mitigation sits in Mirror's prompt, not in the weights.
Sustained agentic misuse	Simulated tool-using trajectories with a malicious user: harmful compliance 0.0 per cent on fixed trajectories and 14.5 per cent on dynamic multi-turn ones. In the same table Kimi K3 scores 7.0, GLM-5.3 9.8 and DeepSeek V4.1 Flash 4.4 on the dynamic test.	CBRN and offensive cyber are excluded from this test. Judged by a model; Reflection's own scenarios, ten per harm category.
Refusals	Across harm areas, 88.9 per cent of harmful requests refused or redirected and 81.5 per cent of harmless requests answered (derived: 11.1 per cent of harmful requests answered, 18.5 per cent of harmless ones not), at a high reasoning effort. 88.5 to 89.7 per cent across the three formats. Reflection says search slightly lowers the refusal rate and that ten adversarial system or developer instructions "may have a larger impact".	Reflection's own suite, "soon-to-be open-sourced". The size of the effect of adversarial developer prompts is not given in the text. None of it describes a fine-tuned or merged copy.
Biology and chemistry	A 20-person, five-hour human uplift trial against another open model, with no wet lab: Reflection calls it not statistically significant and concludes neither model offers material uplift to novices.	One pathogen, no wet-lab validation, and a rubric with indicators deliberately left out.

The report names Irregular, Gray Swan, SecureBio, Nemesys Insights, Andon Labs, Handshake and Mercor. They are third parties, and Reflection set their briefs. The report does test the NVFP4 and 8-bit variants and says it saw "no significant safety degradations". Not found in the report text: any test of what fine-tuning or merging does to these results; a search of the text for fine-tuning turns up only descriptions of Reflection's own training. The agent findings matter most for anyone connecting Beam to tools. The earlier briefing on an agent that escaped through its sandbox DNS resolver shows why: a boundary the model is asked to respect is a request, and a boundary enforced outside it is a control.

UK context: nothing UK-specific on Beam, and a voluntary Code that already asks the right questions

AI Security Institute. The Institute's research list, read on 18 October 2026, has nothing on Beam; its latest entry is dated 7 October. Its closest piece is a 17 July 2026 post on open-weight cyber capability. It tested GLM-5.2 and DeepSeek V4-Pro, which it found "perform similarly to frontier closed models released 4 to 7 months before them", and said it intended to test Kimi K3 next. Nothing in that post transfers to Beam. The only cyber result on Beam is Reflection's own, in the table above.

DSIT Code of Practice for the Cyber Security of AI (31 January 2025). The Code is voluntary and built on the NCSC's Guidelines for Secure AI Development. It treats a business that "adapts" a model as a Developer and one that deploys it as a System Operator, and says some Developer provisions are less applicable to open-source models. The provisions below, quoted as written, are the ones a Beam deployer meets first.

Provisions of the DSIT Code of Practice for the Cyber Security of AI (published 31 January 2025), read on 18 October 2026, set against Beam. The reading in the last column is this briefing's.

Provision	Wording as read	What it asks of a Beam deployer
2.4	An external component needs "an AI security risk assessment and due diligence process".	Treat the weights, drafter, chat template and serving engine as external components, each assessed.
5.2	Operators "shall have processes and tools to track, authenticate, manage version control and secure their assets".	Pin the repository revision, record file hashes, keep the weights in an internal registry, and register every derived copy.
7.2	Using models "not well-documented or secured" needs a justification "through documentation".	Beam has a model card and a safety report, and describes training data only in general terms. Record why that is acceptable.
7.3	Operators "shall re-run evaluations on released models that they intend on using".	Re-run on the format you serve. The card's headline numbers are for BF16.
8.1.2	Developers "shall release cryptographic hashes for model components".	Hugging Face lists a SHA-256 for each large file; no separate signed hash list was found in the pages read. If you fine-tune, you owe your own users the same.
9.2	Operators "shall conduct testing prior to the system being deployed".	Test the system you build, including injection and scope, before exposure.
12.1	Operators "shall log system and user actions".	Log prompts, reasoning content, tool calls and outputs under your retention rules.

ICO. If prompts, retrieved documents, logs or fine-tuning data include personal data, UK GDPR security duties apply wherever the model runs. The ICO's guidance on AI and data protection says: "You must process personal data in a manner that ensures appropriate levels of security against its unauthorised or unlawful processing, accidental loss, destruction or damage." The guidance was last updated on 15 March 2023 and carries a notice that it is under review because of the Data (Use and Access) Act. Self-hosting keeps those data in your own estate. A hosted route, Reflection's API or any of the providers on OpenRouter, moves them to another processor whose terms were not read here.

What the vendor's documents say about the UK. Reflection's Open Safety Framework names California's Transparency in Frontier AI Act and the EU AI Act. The pages read name no UK law, and the UK appears once in the safety report, as a partner in a Gray Swan competition. A UK buyer therefore has no UK-specific assurance from Reflection's own documents.

What to do, in the order worth doing

The order follows the evidence above: know exactly which copy you hold, size it honestly, test the system you build rather than the model you downloaded, and keep the controls outside the weights.

Nothing in the list needs a benchmark to justify it. Each item answers a gap this briefing found between what a page says and what the repository, the datasheet or the vendor's own guide shows.

What could not be verified

• Speed and capacity on real hardware. Nothing was run. Every speed is an upper bound from NVIDIA's printed memory and bandwidth and the repository's byte counts. NVIDIA prints GPU memory in GB; real cards report binary units, so fit margins are, if anything, conservative by up to 7 per cent (inference, not read on NVIDIA's pages).
• B300 figures. NVIDIA's pages give 2.1 TB for eight B300s and, for 72 GPUs, "up to 576 TB/s". The per-GPU memory (about 262 GB) and bandwidth (8 TB/s) are derived from those, and the Hugging Face post says 288 GB.
• Engine cache behaviour. Whether vLLM and SGLang keep only 512 tokens in the 43 sliding layers was not tested.
• Safety results. Read in Reflection's report; not reproduced. The biology and chemistry sections were read, and only their conclusions are summarised. No attempt was made to test refusals.
• Safety after modification. Reflection tested its NVFP4 and 8-bit variants and reports no significant degradation. No measurement of what fine-tuning or merging does was found.
• UK bodies. The AI Security Institute's research list was searched for Beam by name. The NCSC and ICO news pages were not searched; their guidance pages were read for the provisions quoted. Reflection's privacy policy, terms of service and the providers' terms were not read.
• Export controls. Reflection's guide says export-control obligations attach to model weights in defence contexts. The rules themselves were not read.
• Training claims. The 23.8 trillion tokens, GPU counts, rollouts and benchmark rows are Reflection's statements. The 6,144 GPU count is not a whole number of 72-GPU racks (85.3), which this briefing notes and does not read as an error.
• Time-stamped. Sources were read between 16:15 and 16:40 BST on 18 October 2026. Rankings, prices, repository contents and listings can change within hours.

The question that exposes the gap

Which copy of Beam is running in your estate, in which numeric format, and can you show that Reflection's safety report still describes it?

Key facts