Daily AI briefingSunday 18 October 2026

Cheap open models, expensive stolen keys

DeepSeek's "minor update" beat GPT-5.6 Sol on its own agent tests for a fraction of the price. OpenCode's hosted console leaked the provider keys users had stored there.

The day in 60 seconds

Read the full issue ↓

Agent security

OpenCode's hosted console leaks provider keys; users report $400 to $1,700 of overnight charges

Policy

Anthropic is pitching its own federal AI bill: wider preemption of state laws, weaker enforcement

Anthropic

Anthropic: Claude led 26% of model-building work in August, and could lead 80-90% next year

Claude Code

Claude Code 2.1.302: choose the model behind auto mode's safety check; standalone Claude Design closes 14 December

Evals

Epoch: open-weight models trail closed ones on cyber tasks by about six to seven months

Agents

DeepSeek opens its web search and fetch APIs to every developer at $0.75 per 1,000 calls

Agents

Four Gemini 4 Argon agents beat Minecraft from scratch in 27 hours, with no human help

If you do one thing

Run DeepSeek-V4.1-Flash-1017 as the model inside Claude CodeDeepSeek tuned this MIT-licensed update inside agent harnesses. By its own table it now beats GPT-5.6 Sol on Terminal-Bench 4.0 (42.3 vs 39.9) and uses fewer tokens per task, at $0.15/$0.60 per million off-peak on OpenRouter. An independent 105-bug test puts it behind Opus 5.5 (34 vs 41.7), so try it as the cheap worker, not the reviewer.

Editor’s note

DeepSeek's update is a harness story as much as a model story.

It got 35% better on Terminal-Bench by training inside several coding harnesses, with no new algorithm. It also uses fewer tokens per task. Ollama, vLLM and Unsloth supported it within a day. Every number so far is DeepSeek's own. A hands-on 105-bug test puts it behind Opus 5.5, but well ahead of its predecessor.

Day 30 of the agent-breach arc moved off the agents and onto key storage. OpenCode's breach hit people who parked API keys in a hosted console. Calling it "distillation" blurred the matter: on 13 October that word meant training on another model's outputs (see that issue). Here it covers stolen keys being resold.

Today’s highlights

01Day 30 · agent-breach arc#agent-security #harnesses
OpenCode's hosted console leaks provider keys; users report $400 to $1,700 of overnight charges
1.4% of OpenCode Console users with linked OpenAI, Anthropic or Google keys were hit. The open-source CLI that keeps keys on your machine was not involved.
MoreLessOpenCode called it "a large scale distillation attack" and says the incident is ongoing. Anthropic says it has revoked Claude keys it believes were affected, and Google has blocked exposed Gemini keys. Affected users were emailed on 17 October.
If you ever saved a key in OpenCode Console, rotate it and check that provider's usage page.
02#policy #anthropic
Anthropic is pitching its own federal AI bill: wider preemption of state laws, weaker enforcement
Politico reports the draft is being shown to members of Congress before the lame-duck session. Safety advocates who usually side with Anthropic call it worse than the existing FRONTIER Act.
MoreLessReaders of the leaked text say it adds transparency duties, overrides state AI laws more broadly than the Obernolte-Trahan bill, and makes enforcement harder to trigger. One LessWrong reading argues it keeps a federal path to block a model and does not preempt state suspension of models.
03#anthropic #automation
Anthropic: Claude led 26% of model-building work in August, and could lead 80-90% next year
It is the first time Anthropic has put a figure on how much of its own model training Claude leads.
MoreLessMichael Sellitto told an IMF panel the share was 0% at the start of 2026, 3% in April and 26% in August. "Led" means Claude runs a task end to end from one prompt while a human supervises, not that no human is involved.
04#claude-code #harnesses
Claude Code 2.1.302: choose the model behind auto mode's safety check; standalone Claude Design closes 14 December
CLAUDE_CODE_AUTO_MODE_MODEL sets which model the client-side auto-mode classifier uses.
MoreLess/design-sync now warns that claude.ai/design shuts on 14 December 2026. Auto mode with the server-side classifier now compacts a conversation that is too long to check, where it used to deny every checked tool call.
05Verified#evals #open-weights #security
Epoch: open-weight models trail closed ones on cyber tasks by about six to seven months
GLM-5.3 tops open models on Epoch's Cyber ECI with 160, ahead of GPT-5.4 from March.
MoreLessThat gap is how long a capability a closed lab gates today takes to arrive as weights anyone can run.
06#agents #deepseek
DeepSeek opens its web search and fetch APIs to every developer at $0.75 per 1,000 calls
Agents on DeepSeek can now search and read the web through the same API account as the model.
MoreLessEach endpoint allows 5 requests a second per account. Server-side tool calls from Claude Code, Codex and DeepSeek Harness stay free until 31 October, then billing starts.
07Claim#agents #gemini
Four Gemini 4 Argon agents beat Minecraft from scratch in 27 hours, with no human help
They worked only through code and text in a sandbox, wrote 2,783 programs and split the work over chat.

Concept of the day

Bring-your-own-key

You hand a valet your car key so they can park the car. If someone breaks into the valet stand, they take every car.

Your API key→Hosted console

↳ Model provider↳ Attacker

The mechanism: with bring-your-own-key, a service stores your provider API key and calls the model for you, billed to your account. Each request is signed with your key, so whoever holds the key can spend your money.

What it means today: OpenCode Console stored keys for convenience. When it was breached, the attacker could bill OpenAI, Anthropic and Google to its users until each provider revoked the keys.

Voices

Was the OpenCode breach "distillation"?

“We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users”

OpenCode
the breach notice that started it

“There's something very odd going on with "distillation" if a cyber attack to steal api keys is looped under the same term.”

Nathan Lambert
questioning the word OpenCode chose

“Why is Kimi serving Claude tokens directly to users? Other Chinese labs likely are too. I wouldn't call this distillation but it is a shady pattern and we should have appropriate language to understand it.”

Nathan Lambert
naming what he thinks is really going on

“We've been working with OpenCode on yesterday's breach and have revoked Claude API keys we believe were affected.”

Lydia Hallie
Anthropic's response

“We've blocked exposed API keys are working with impacted customers and OpenCode.”

Evan Otero
Google's response for Gemini keys

Also on the record

“This bill is substantively worse and weaker than Obernolte-Trahan's FRONTIER Act.”

Alexander McCoy
a safety advocate rejecting Anthropic's draft

New models

2 released today · 1 publish a price · a dash is never “free”

Sort

DeepSeek · MIT · claim

DeepSeek-V4.1-Flash-1017

1 machine

Cheap worker model for coding agents

Size763B (HF tensor count) · active not published

$ in / out per M$0.15 / $0.60

text · vision · tools · thinking

Try if you want a cheap worker model under Claude Code: ollama launch claude --model deepseek-v4.1-flash:1017-cloud.

Our takeClose

Terminal-Bench 4.0 rises from 31.2 to 42.3 (Sol 39.9) and DeepSWE to 77.0, using shorter outputs. DeepSeek trained it inside several agent harnesses. OpenRouter lists it at $0.15/$0.60 per million tokens off-peak and $0.30/$1.20 at peak. It has a 1M context, and no Jinja chat template ships.

#open-weights #harnesses #deepseek

NVIDIA · Open-custom · claim

Nemotron 3.5 Parse

1 card

Turning page images into structured text

Size—

$ in / out per Mweights only

vision · text

Watch if you run PDF or form intake through a general model.

Our takeClose

A small vision encoder plus a 10-layer decoder, built to turn page images into structured text, tables and charts. NVIDIA reports 75.2 mean on ParseBench and 83.73 on IndicVisionBench OCR across 10 languages. It is cleared for commercial use.

#documents #nvidia

The leaderboard

The frontier by Artificial Analysis · 0 boards changed hands since yesterday

Rank by

Claude Opus 5.5

Anthropic · $4 / $20 per M · $5.98/task · 98 tok/s

57.6

Claude Sonnet 5.5

Anthropic · $2 / $10 per M · $5.46/task · 144 tok/s

Muse Wonder FullNEW

Meta · price not published

55.8

Claude Fable 5.1

Anthropic · $10 / $50 per M · $7.63/task · 67 tok/s

53.4

GPT-6 Astra

OpenAI · $10 / $50 per M · $3.26/task · 61 tok/s

52.7

Gemini 4 Argon

Google · $2 / $10 per M · $1.99/task · 104 tok/s

52.6

Muse WonderNEW

Meta · $4 / $20 per M · $4.52/task · 184 tok/s

52.4

GPT-6.1 Sol

OpenAI · $2 / $10 per M · $0.72/task · 60 tok/s

51.8

Vals Index

an independent blend, with cost per test

Gemini 4 Argon68.90%

2. Claude Sonnet 5.5 67.04% · 3. Claude Opus 5.5 66.97%

Terminal-Bench 4.0

agent work in a real shell

Opus 5.564.8%

2. Sonnet 5.5 61.8% · 3. GPT-6 Astra 58.2%

Vals SWE-bench

fixing real GitHub issues

Claude Opus 597.00%

2. DeepSeek V4 Pro 0813 96.40% · 3. GPT-5.6 Sol 96.20%

ARC-AGI-2

puzzles a model cannot have memorised

GPT-6 Astra95.0%

2. GPT-6.1 Sol 94.2% · 3. Claude Opus 5.5 93.3%

SimpleBench

trick questions that catch pattern-matching

Claude Opus 5.588.4%

2. Claude Fable 5.1 86.6% · 3. GPT-6 Astra Pro 86.5%

AA hallucination rate

how often it makes things up (lower is better)

Gemini 4 Argon15.1%

2. MiniMax-M3 18.4% · 3. Muse Wonder Full 23.0%

Cost per task

what one finished task bills (lower is better)

GPT-6 Luna0.068

2. MiMo-V2.6-Pro 0.133 · 3. Nemotron 3.5 Super VL 0.188

OpenRouter usage

what developers actually run, tokens served this week

DeepSeek-V4.1-Flash35894.2B

2. Step-5-Preview 13928.4B · 3. GLM-5.3-Flash 12599.2B

New on OpenRouter: DeepSeek: DeepSeek V4.1 Flash 1017 $0.15 / $0.60 · Elorian: Glimpse $0.60 / $3 · XingChen: Xing4.0 29B A4B (free) free · Reflection: Beam 1.0 501B A23B $1 / $3 · Moondream: Moondream 3 Preview $0.30 / $2.50 · Moondream: Moondream 3.1 $0.30 / $2.50

On your card

The best Ollama models that fit 32 GB · fit is our arithmetic

qwen3-vlNEW

2 hours ago · 6.7M pulls

vision · tools · thinking32B · Q6_K ~26 GB

not measured

nemotron-3-nanoNEW

7 hours ago · 919.4K pulls

tools · thinking30B · Q6_K ~25 GB

not measured

pplx-decider

5 hours ago · 721 pulls

vision · decision27B · Q8_0 ~29 GB

not measured

nemotron-3.5-lightning

yesterday · 240.4K pulls

tools · thinking30B · Q6_K ~25 GB

not measured

bonsai-2

yesterday · 16.5K pulls

vision · tools · thinking27B · Q8_0 ~29 GB

not measured

lfm2.5

2 days ago · 230.2K pulls

tools · thinking24B · Q8_0 ~25 GB

not measured

2 days ago · 14.3K pulls

vision3B · F16 ~6 GB

not measured

gemma3n

3 days ago · 2.3M pulls

visionno

not measured

tev1

4 days ago · 99.6K pulls

tools · decision · thinking4B · F16 ~8 GB

not measured

nimble

4 days ago · 48.9K pulls

tools · decision · thinking9B · F16 ~18 GB

not measured

clef-flash

4 days ago · 27.4K pulls

vision · decision9B · F16 ~18 GB

not measured

clef

4 days ago · 20.7K pulls

vision · decision27B · Q8_0 ~29 GB

not measured

From the whole ollama.com/library, read this morning, newest version of each line. Fit is the largest size that fits at ~0.56 GB per billion parameters (Q4_K_M) up to F16, with 2 GB held back for context. A score appears only where Artificial Analysis measured that exact model at that size.

Try this

Claude Code

Pick which model runs auto mode's client-side safety classifier

export CLAUDE_CODE_AUTO_MODE_MODEL=<model>, then claude --permission-mode auto

OpenCode

Define your own reasoning variants for a model in config

Update to 1.19.3 and add reasoning options under the model in opencode.json

goose

Adaptive thinking for Claude Sonnet and Haiku 5.5, plus a declarative AI gateway provider

Update to goose 1.55.0 and pick Sonnet 5.5

ai-memory

Quit Claude Code mid-task, open Codex in the same folder and carry on from a typed handoffOne self-hosted memory, kept as plain markdown, follows you across 20+ harnesses and machines, so switching agents stops costing you a re-briefing

claude plugin marketplace add akitaonrails/ai-memory && claude plugin install ai-memory@ai-memory

Update now → Claude Code (breaking) · OpenCode (security) · goose (breaking) · transformers (breaking)

Briefly, and from the threads

Also today

Business Upturn, 17 Octcurl 8.23.0 fixes 24 security flaws, 18 of them found by AISLE's AI scanners

Update curl and anything that bundles it. The 18-of-24 figure is AISLE's own claim.

GBHackers, 16 OctMITRE ATT&CK v20 adds AI attack techniques, including AI-enabled exfiltration and result poisoning

Security teams now have standard names and detection strategies for agent-driven attacks. Five of the nine new Enterprise techniques are AI-related.

TestingCatalog, 17 OctClaude Fable 5.5 has reportedly reached Anthropic's partners

Leakers expect a release next week. An Azure listing at Fable 5.1's $10/$50 price was pulled a day later, so treat the details as unconfirmed.

From the threads

XDeepSeek V4.1 Flash 1017 on 105 hidden bugs: behind Opus 5.5, far ahead of the old Flash

On two real repos it scored 34, against 41.7 for Opus 5.5, 42 for Muse Wonder Full and 21.7 for the previous Flash. The author expects about 1.7 points of run-to-run noise.

Hacker News · 731 pointsHacker News on DeepSeek-V4.1-Flash-1017: fast and open beats slightly smarter

The top thread argues speed from providers and visible reasoning matter more day to day than the benchmark gap with Sol. Several commenters run it as the worker under Opus 5.5 as reviewer.

“deepseek v4.1 flash via deepseek API: took 20m to find one p1 issue that was relevant and a p2 issue that was irrelevant - gpt 5.6 sol: took 5m30s for one p1 and one p2 issue. both relevant” — AmazingTurtle

Redditr/LocalLLaMA: the OpenCode breach was the hosted console, not the harness

The thread worked out which keys were exposed: only keys saved in the SaaS console, not those configured in the local CLI.

“It has nothing to do with the harness. This was their hosted BYOK console service.” — r/LocalLLaMA commenter

RedditXolotl runs the 552B DeepSeek V4.1 Flash on one RTX 4090 at about 27 tok/s

A Strata-based engine spreads the weights across 24 GB of VRAM, 90 GB of RAM and an NVMe drive, loading only the experts each token needs. Prefill runs at 180-320 tok/s.

“it seems to retain a lot of its intelligence but takes like 10x the thinking tokens to get to the same outcome” — the author

Redditr/LocalLLaMA warns the "DeepSeek leads open weights" chart is not Artificial Analysis

The most-upvoted reply says the index comes from a lookalike site posting zero-day agentic scores. Others note llama.cpp still has not merged support for the original V4.1 Flash, 37 days on.

“I trust them to at least actually run the benchmarks. Can't say the same about a random website that has zero day agentic results up already.” — r/LocalLLaMA commenter

Hacker News · 258 pointsLlmspeed lets you feel a local model's speed before buying hardware, and owners say it guesses low

The site animates tokens at the predicted rate for a chosen card and model. Owners report real speeds well above its estimates once speculative decoding is on.

“I get like 80t/s on Q3.8 27b UD Q4_K_XL on my 4090 with 3 drafts and about 110K context window, sim shows mid 20s” — binary132

Cheap open models, expensive stolen keys

Today’s highlights

OpenCode's hosted console leaks provider keys; users report $400 to $1,700 of overnight charges

Anthropic is pitching its own federal AI bill: wider preemption of state laws, weaker enforcement

Anthropic: Claude led 26% of model-building work in August, and could lead 80-90% next year

Claude Code 2.1.302: choose the model behind auto mode's safety check; standalone Claude Design closes 14 December

Epoch: open-weight models trail closed ones on cyber tasks by about six to seven months

DeepSeek opens its web search and fetch APIs to every developer at $0.75 per 1,000 calls

Four Gemini 4 Argon agents beat Minecraft from scratch in 27 hours, with no human help

Bring-your-own-key

Voices

Was the OpenCode breach "distillation"?

How good is DeepSeek's "minor update"?

After "already clean", how much easier is interpretability?

New models

The leaderboard

On your card

Try this

Briefly, and from the threads

Also today

From the threads

Further reading