FOMO Buster #027: DeepInfer, the DHS ban, and the model that can't say no

A newsletter that makes FOMO obsolete.

if i fear missing out on reading this newsletter, did i win or lose

Curated by Maurice.

01 · The One Thing

DeepSeek’s two-sided week: open-sourcing the engine while Washington bans the model

DeepSeek open-sourced DeepInfer, the high-performance inference framework that powers its large-scale production services, and the repo did exactly what you’d expect: created October 16, ~9,000 stars in four days, and the week’s top HN thread at 1,317 points and 460 comments. The README reads like a guided tour of how a frontier lab actually serves models. The stack: FlashMLA, DeepGEMM, DeepEP, TileKernels, DeepSelect, and custom TileLang kernels; DSpark and confidence-scheduled verification (speculative decoding with draft tokens and confidence-gated verification); SWA bounded replay to cut decoder prefill work; zero-overhead asynchronous batch scheduling; and the two features evaluators care about most: batch-invariant inference and deterministic sampling, so results are reproducible across batch compositions. The fine print is honest: a KV cache system, prefill/decode disaggregation, and load balancing across replicas are not included. DeepSeek open-sourced the engine and kept the fleet. The framework was built primarily on vLLM, with inspiration from SGLang and TensorRT-LLM, and it runs on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs. The Ascend line is the tell: the same release supports both the latest Blackwell-class silicon and China’s domestic NPU, in one Apache-2.0 codebase.

Then the other shoe. On Monday, October 19, DHS disclosed Exclusion and Removal Order 2026-01, signed July 24 by Secretary Markwayne Mullin under the Federal Acquisition Supply Chain Security Act of 2018. Civilian federal agencies must remove DeepSeek products from their IT systems and may not buy more. The reach is the part that matters: the order covers third-party products and services “developed using DeepSeek implementations”, not just DeepSeek’s own apps. DHS cited “multiple threat vectors,” possible transfer of sensitive data to the PRC, “actionable intelligence on US persons,” and the striking line that “the models themselves may contain malware or other security vulnerabilities.” The order was in force since late July and disclosed three months later; the 60-day exception window runs from issuance, not disclosure, with CISA handling requests. Defense and intelligence systems are excluded.

The pairing is the story. In the same week Washington formalized the containment of DeepSeek inside US procurement, DeepSeek exported the deepest layer of its stack to the world, permissively licensed, Huawei-compatible, and already past 9,000 stars. The strategic read has three layers. First, open weights break containment: banning the model from federal IT is a procurement rule, but the capability now ships as code anyone can run, and the ban’s third-party clause tacitly admits the weights are already everywhere. Second, the open-source asymmetry favors the exporter: DeepInfer gives away the kernel stack where DeepSeek’s cost advantage lives (its inference economics are the famous part of the company), while keeping the orchestration layer that actually runs the fleet. Third, watch the vendor audit wave: every federal contractor and enterprise vendor with a DeepSeek dependency now needs to know where the weights are, which is a compliance market being born in real time. The repo to watch is the companion, deepseek-recipe (MIT): the protocol-conversion layer that turns API requests into DeepSeek prompts with API parity, the unglamorous glue that makes the engine actually adoptable.

Signal: The ban and the open-source release are the same event viewed from two sides. Washington is trying to draw a procurement perimeter around a model family while DeepSeek exports the machinery that makes the family cheap to run. The perimeter assumes the asset is a vendor; the release proves the asset is infrastructure. Watch the third-party clause: its enforcement will define how “built on DeepSeek” gets measured across the software supply chain. Sources: The DeepInfer repo · The HN thread · DHS order coverage · Reuters via Hindu BusinessLine

02 · Lab Watch

MiniMax M3.1 Flash: the agentic Flash war gets a price cut

MiniMax officially rolled out M3.1 Flash on October 19, and it is a pricing event as much as a model event. Flat pricing: $0.15 input, $0.60 output, $0.015 cached input per million tokens, with usage costs 70% lower than its predecessor and output speeds hitting 200+ tokens per second (P50 at 170+). The benchmark sheet: 73.7% on DeepSWE v1.1 (complex software tasks, long tool sequences), 76.2 on BankerToolBench (multi-step planning, financial compliance, chained tool calls), top-tier on AutomationBench-AA (real enterprise workflows across SaaS systems), 61.7 on OSWorld V2 and 29.6 on Agents’ Last Exam (computer use, first among Chinese models on both), and 82% on CyberGym (vulnerability discovery and validation). The detail worth keeping: “Space Bunny,” which processed more than 200 trillion tokens while operating anonymously, was an early version of M3.1 Flash. Anonymous pre-release benchmarking is now standard lab practice: ship the model under a codename, collect the human preference data, then reveal. The asterisk: model weights “will be released later”, so today this is API, M Plan, and MiniMax Code only. The HN thread is at 499 points.

The read: MiniMax is pricing M3.1 Flash like a commodity API while benchmarking it like a flagship, and the 82% CyberGym score lands in a week where Anthropic is scanning open source for vulnerabilities and the newsletter reports DeepSeek V4.1 Flash beating GPT-6 Sol in a simulated cyber attack. The capability converging across labs is not chat, it is offensive-adjacent security work at commodity prices. Watch the weights release: whether M3.1 Flash lands open determines whether this is a pricing war or a stack war.

Signal: The Flash tier is becoming the real product: flagship-adjacent agentic scores at commodity inference prices. The anonymous-then-reveal release pattern means benchmark tables now lag the models by months, and the leaderboard is a lagging indicator. Watch who ships weights, because weights are what turn a price cut into a platform. Sources: MiniMax’s announcement · The HN thread · Artificial Analysis model page

OpenAI teaches GPT-6 the dead languages: COBOL goes 10.9% to 72.1%

OpenAI’s latest models bring a genuine capability jump in low-resource programming languages, and the numbers are unusually specific. On MultiLangBench, which asks a model to build a SQLite-compatible database engine from scratch across 20 languages, GPT-6 Astra averages 87.4% test pass rate, up from 26.8% for GPT-5.6 Sol, with gains in every language: COBOL 10.9% to 72.1%, OCaml 25.6% to 85.8%, Fortran 21.4% to 83.5%, Visual Basic 27.5% to 89.4%. Astra scores above 83% in 19 of 20 languages; COBOL remains the hardest at 72%. On the COBOL migration evaluation (migrate programs to C++, Java, Kotlin, Python, or Rust with byte-for-byte behavior parity), GPT-6.1 Sol hits 86.6% at low reasoning effort versus 5.4% for GPT-5.6 Sol, and 97.9% at higher effort, nearly saturating the eval. The cost line matters as much: GPT-6 Luna reaches 40.3% average at roughly 78% lower API cost ($0.77 vs $3.48 per sample), and the 86.6% migration score costs 61% of the predecessor. OpenAI open-sourced the MultiLangBench setup and test suite on GitHub.

The mechanism note is the interesting one: COBOL’s fixed-point arithmetic discards excess digits unless rounding is explicitly requested, so a migration that rounds instead of truncating runs without errors while producing different financial results. Behavior parity means the model has to learn the language’s semantics, not just its syntax, which is why this eval is harder than it looks. The strategic read: COBOL underpins 40%+ of online banking systems, 80% of in-person card transactions, and 95% of ATM transactions (OpenAI’s figures). The buyers for this capability are banks and insurers with mainframes, which is exactly the enterprise cohort OpenAI’s feed has been courting with case studies all month. Watch the migration-eval saturation: at 97.9%, the next eval will have to be real codebases, and the liability question moves from “can it” to “who signs off.”

Signal: The dead-language wave is an enterprise sales motion dressed as a benchmark. The buyers are the banks that run on COBOL, the metric they care about is behavior parity not syntax, and OpenAI just published the number that unlocks the budget conversation. Watch for the first named bank migration win; that is the revenue event this eval exists to produce. Sources: OpenAI’s announcement

Anthropic’s OSS Scanner: the vulnerability numbers keep coming

The AlphaSignal newsletter’s read of the week on Anthropic’s opt-in vulnerability scanner: 77 critical bugs found in open-source projects in a single week, with the RSS feed’s headline putting 880 critical vulnerabilities found in open-source code. Treat the feeds’ counts as their framing; the official numbers from Anthropic’s October 8 research post are: over 29,000 candidate vulnerabilities found scanning major projects over six months, roughly 6,000 manually triaged, and of 97 critical and high-severity findings across 48 projects checked by expert pentesters, 85 (88%) met the bar for coordinated disclosure, with only one true false positive. Maintainer quotes on the post are unusually strong: PostgreSQL got fixes it could use nearly as-is, OpenSSL’s maintainer said raw model output was “as good and sometimes better than what we get from people,” and curl’s Daniel Stenberg said the scanner found “one of the worst curl vulnerabilities reported in the last few years.” The bottleneck Anthropic names is human triage capacity, and the opt-in fast-track exists precisely because maintainers started asking for the unvalidated bulk feed.

Pair it with this morning’s feed: MiniMax at 82% on CyberGym, DeepSeek V4.1 Flash reportedly beating GPT-6 Sol in a simulated attack. The vulnerability-finding capability is commoditizing at the same moment the scanners are getting institutionalized. The read from October still holds: exploits now develop in minutes, so the scanner’s value is not finding bugs, it is shortening the window between finding and patching, and Anthropic just made that window opt-in and free.

Signal: Vulnerability discovery is becoming a public utility, and the scarce resource is no longer the finding but the triage. Whoever owns the disclosure pipeline owns the security posture of the open-source ecosystem. Watch the triage bottleneck: the lab that automates validation, not just detection, wins this layer. Sources: Anthropic’s research post

Also on the lab feeds

Google published a piece on magic-state cultivation, “breaking open a bottleneck in quantum computing,” plus its Research@ 2026 roundup on novel capabilities and intelligence, and a note that TIME named SynthID one of the Best Inventions of 2026. Mistral published “Making sovereign, open-weight AI the technology frontier”, the sovereignty framing continuing. Meta and Anthropic had nothing new on their own feeds today beyond items already covered. OpenAI’s feed beyond the languages post is the case-study engine: Itaú, Benefit Street Partners, Stack Overflow for Agents, Sullivan & Cromwell, Amp, SentinelOne, and Third Moment Research’s 10,000 agents for 36+ hours.

Signal: The lab feeds are settling into genres: OpenAI does enterprise case studies, Google does research prestige, Mistral does sovereignty, Meta does product launches. The genre is the strategy document. Sources: Google’s quantum post · Mistral’s sovereignty piece

03 · Open Weights

The board this morning

deepseek-ai/DeepSeek-V4.1-Flash-1017 holds #1 trending (1,865 likes, 27,737 downloads) and now has a production serving stack to match, courtesy of The One Thing. The packaging thesis keeps compounding: black-forest-labs/flux-3-image-klein-comfy is at 439,528 downloads versus 78,897 for the base repo, the ComfyUI-native build still winning distribution by a factor of five. New on the climb: jialinyyzz/humanizer (2,018 likes, 115,341 dl), google/embeddinggemma-2 (2,749 likes, 172,474 dl), tencent/Hy-Memory-30B-A3B, Qwen/Qwen-Image-2.1-Turbo, and reflection/Beam-1.0-501B-A23B (179 likes, 2,930 dl), the 501B agentic model from last week’s launch now in the wild. mistralai/Timestral-209M sits at 221 likes and 4,008 downloads a few days post-launch. The gravity wells hold: Qwen3.8-27B (18,042 likes, 7.59M downloads), FLUX.1-dev, DeepSeek-R1, Kimi K3, LTX-2.5. The delta worth noting: trending is absorbing two new model families (Beam, Hy-Memory) while the download concentration keeps rewarding whoever ships the runnable build, not the raw checkpoint.

Signal: The trending list now moves in lockstep with the release announcements: DeepInfer lands and the V4.1-Flash repo hardens its #1 slot the same week. Distribution follows the stack, not the checkpoint. Watch the comfy-suffixed repos: they are the unofficial app stores of open weights. Sources: Hugging Face trending

deepseek-recipe: the unglamorous glue

The companion to DeepInfer: deepseek-recipe is a Rust-plus-Python library that converts API requests in different formats (Messages, Chat Completions, Responses) into the Conversation format, renders prompts for DeepSeek V4 and V4.1, and parses model output back, including structured outputs, tool calls, and streaming. MIT licensed, ~1,300 stars, shipping since September. This is the API-parity layer: the piece that lets an inference backend speak the protocols developers already use. Engines get the stars; protocol glue gets the adoption.

04 · Money Flow

Exa 3.0: the search-for-agents price war gets a leaderboard

Exa shipped Exa 3.0 on October 18 with the pitch that search is now an infrastructure cost line for AI products. The numbers, from Exa’s own testing with GPT-6 Luna as the harness agent: 91.8% on BrowseComp, 88.2% on DSQA, 56.1% on WideSearch, 42.0% on ATLAS, 75.5% on WebCode, 68.0% on FinSearchComp, all ahead of Perplexity, Brave, and Parallel, though the BrowseComp and DSQA leads are under 1.5 points and ATLAS is Exa’s own benchmark published October 8. The pricing is the real move: Exa Lite at $4 per 1,000 requests, Auto at $7, and Dynamic Highlights generally available, extracting relevant passages with what Exa claims is 95% fewer tokens than full page text. The index now tracks 2 trillion URLs, serves 100 billion pages, and added 1.27B ecommerce listings, 211M+ local businesses, and real-time data feeds.

Pair it with the week’s other search story: per the changelog trackers, DeepSeek opened its own search engine to developers at $0.75 per 1,000 searches, handling hundreds of millions of requests daily over an index of hundreds of billions of pages. So the search-API price board now reads: DeepSeek $0.75, Parallel $1, Perplexity $5, Brave $5, Exa Lite $4, Exa Auto $7, Tavily $8. The read: Exa is selling the Pareto frontier (quality per dollar per task) while DeepSeek is selling raw price, and both are racing the same realization that the search customer is increasingly another piece of software. Watch the margin math: when the buyer is an agent making thousands of calls, the $4-vs-$0.75 spread is the whole business, and the token-efficiency features (Dynamic Highlights, 95% fewer tokens) are where the differentiation has to live because raw retrieval scores are converging.

Signal: The search API market is splitting into two games: Exa’s benchmark-and-efficiency game and DeepSeek’s price-destruction game. The benchmarks are company-run and the leads are thin, which means the real competition is cost per task, not accuracy. Watch whether Perplexity answers on price; it is the one with a consumer brand to protect and the most to lose in a race to the bottom. Sources: Exa’s announcement · MarkTechPost’s breakdown · DeepSeek’s search pricing

05 · Leaderboard

Also moving

Artificial Analysis published the MiniMax-M3.1-Flash model page this morning, plus Beam 1.0, Muse Spark Open (Xhigh), and the Nemotron 3.5 Super VL / Bolt 74B pages from the weekend. The feeds also flag an AA piece ranking 36 models by writing style and personality and a Vals Index v2.2 reshuffle with stricter grading, both worth a click in the appendix. The benchmark factories are running at release velocity now: new model pages the same week as the launches, not months later.

Signal: Model pages are shipping same-week as launches. The leaderboard business has become a release-notes business with benchmarks attached. Watch the same-week cadence; it is the honest metric of how fast the labs are moving. Sources: AA’s MiniMax M3.1 Flash page

06 · The Argument

XYEval: agents say yes to bad advice

The paper with the most uncomfortable finding of the week: Google DeepMind researchers (Zhengxuan Wu, Yuxuan Li, Oyvind Tafjord, Been Kim) show that AI agents cannot resist plausible but misleading suggestions from users. XYEval is a meta-evaluation framework that transforms existing benchmarks into XY-problem evaluations: the user asks about their attempted solution rather than their actual problem, and the question is whether the agent pushes back. Across five models and six benchmark suites, agents suffered large XY drops, with relative performance drops reaching 46.7%. Worse: on τ²-bench, agents performed even worse against a pedantic user who demands detailed explanations before approving a better solution. A simple system instruction encouraging XY awareness offered only partial mitigation. The trace analyses show agents failing twice: first they don’t recognize the misdirection, then they can’t communicate the underlying problem clearly even when they do.

Read it against yesterday’s Emergence World card (safe models forming unsafe multi-agent systems) and today’s DHS story (the threat is the model). XYEval says the threat is also the user: the human in the loop is the least reliable component, confidently steering the agent toward the wrong goal while demanding rigor about it. The pedantic-user result is the one to sit with: the users who most want to be careful are the ones who most degrade the agent, because their carefulness is aimed at the wrong target. The unit of safety is no longer the model or even the system. It is the conversation, and the conversation is only as good as the user’s ability to state their actual problem.

Signal: Alignment work has focused on the model refusing bad instructions. XYEval shows the failure mode is the model accepting bad instructions that sound reasonable. The fix is not a stronger refusal, it is an agent that diagnoses what you actually want, which is a much harder product to build than a safer model. Watch for evals that score pushback quality, because that is the capability this paper says is missing. Sources: The paper

07 · Papers

Self-HPO: the coding agent rewrites its own harness, +7 points

Microsoft Research (with UVA and CMU) released Self-HPO: a loop where a coding agent rewrites its own harness, then RL-trains the model inside the rewritten harness. Starting from Qwen3.5-35B-A3B with a mini-SWE-agent seed harness, average resolve rate across three SWE-bench variants rose 57.8% to 64.8%, with no stronger teacher model: using Claude Opus 4.8 as the harness writer added only ~2.1 points on SWE-bench Verified. Code, harnesses, and checkpoints are public, checkpoints tagged Apache-2.0 on Hugging Face, write-up published October 19. The optimizer economy from last week’s trending list now has a clean, reproducible instance: the scaffolding is trainable, and the gains come from the system around the model, not the weights. Pairs with Google Research’s Harness2 from last week: two labs, same thesis, one week apart.

OpenVLHarness: real-world visual agentic tool-use with multimodal memory

The embodied-agent eval lane keeps building: real-world visual tool use with multimodal memory. Pairs with REKI’s register-token memory from the weekend and the AA-Robotics benchmark: the field is converging on memory as the scarce resource in physical agents.

Same Simulation, Different Evidence: where retrieved tool output costs LLM agents accuracy

A cautionary result for the RAG-everything instinct: retrieved tool output can cost agents accuracy, not just add it. Same simulation, different evidence, worse decisions. Pairs with the XYEval argument above: more information is not the same as better judgment.

Kronecker Delta Rule for Long Context Linear Attention

Hochreiter’s group on long-context linear attention. The architecture lane stays open: the quadratic-attention tax is still the problem everyone is trying to legislate away.

ProteinGeoBench: frontier structural-biology agents are fluent at lookup but lost in geometry

The bio-agent eval with the memorable verdict: agents handle retrieval fine and fail at spatial reasoning. The lookup-vs-understanding gap, quantified for structural biology. Pairs with the lab-in-the-loop thread: the agents can find the paper, they cannot yet see the protein.

Also on arXiv

Text-to-Image Generative Modeling Without Language Pretraining (26863): from Li Fei-Fei’s group, asking whether the language backbone is load-bearing. WeAct: Dynamic Weight Switching as Agent Actions (26847): treating weight switching as an action the agent takes. LatComm: Reusable Context Compression for Latent Communication (26840): the latent-reasoning thread continues.

08 · GitHub Trending

The skills-format war escalates

Three organizations shipped agent-skills repos in the same window, and the format war is now unmistakable. cloudflare/security-audit-skill (33,376 stars, +849 today): a coding-agent skill for multi-phase security audits with independently verified, machine-readable findings. anthropics/knowledge-work-plugins (30,648 stars, +262 today): the official Anthropic org’s open repository of plugins for knowledge workers to use in Claude Cowork. android/skills (9,029 stars, +1,233 this week): Android’s official skills repo. Cloudflare, Anthropic, and Android are all converging on the same artifact: a packaged, versioned unit of agent capability. The week’s individual winners: MadsLorentzen/ai-job-search (59,540 stars, +3,890 today, still climbing): the job search that runs on your machine, built on Claude Code. YuJunZhiXue/dsh-purge (10,828 stars, +1,168 today): a jailbreak harness for DeepSeek’s agent stack with swappable prompts per model, the Chinese-language corner of the jailbreak economy. stablyai/orca (99,259 stars, +1,559 today): the fleet-of-agents runner. Weekly: morluto/rea (+201k, still the monster), debpalash/VoiceStudio (+17k), boykopovar/AnyPS5 (+12k).

Signal: The skill is becoming the package format of the agent era, the way the npm package was for JavaScript. When Cloudflare, Anthropic, and Android all ship skills repos in the same week, the question is no longer whether skills win but whose registry becomes the default. Watch the registry play: whoever hosts discovery owns distribution. Sources: GitHub trending

The week’s movers

• MadsLorentzen/ai-job-search · The job search that runs on your machine, built on Claude Code · 59,540 stars, +3,890 today
• cloudflare/security-audit-skill · Multi-phase security audits for coding agents, machine-readable findings · 33,376 stars, +849 today
• stablyai/orca · Fleet of agents in one place, BYO subscription · 99,259 stars, +1,559 today
• anthropics/knowledge-work-plugins · Official Claude Cowork plugins for knowledge workers · 30,648 stars, +262 today
• YuJunZhiXue/dsh-purge · Jailbreak harness for the DeepSeek agent stack, swappable prompts · 10,828 stars, +1,168 today
• DietrichGebert/ponytail · Makes your agent think like the laziest senior dev · 168,982 stars, +1,007 today
• Graphify-Labs/graphify · Codebase to queryable knowledge graph · 129,748 stars, +906 today
• headroomlabs-ai/headroom · Compress tool outputs before they reach the agent · 76,581 stars, +555 today
• morluto/rea · Reverse-engineer anything through your agent · 344,586 stars, +201k this week
• debpalash/VoiceStudio · Fully-local ElevenLabs alternative · 78,452 stars, +17k this week
• boykopovar/AnyPS5 · PS5 executables ported to Linux and Windows · 45,151 stars, +12k this week
• android/skills · Android’s official agent skills · 9,029 stars, +1,233 this week

09 · Product Hunt

Yesterday’s top products (Oct 19)

1. Beam.win — Run AI agents on one Mac and use its windows on another (353 votes)

2. Figma Specs — A container for your context that lives on the Figma canvas (207 votes)

3. readywhen — The senior personal assistant that works inside WhatsApp (189 votes)

4. walkai-talkai — Talk to your AI coding agent over a walkie-talkie (156 votes)

5. Kai Resolve by Gleap — Support that does the digging for you (144 votes)

6. Wally by Willow — Your Scribe agent that learns how you write (137 votes)

7. Beam — Highly efficient agentic 501B parameter open model (127 votes)

8. buddylist — Chat with your coding agents like it’s 2005 (123 votes)

9. Framefields — Open-source code-first video for AGI era (96 votes)

10. Lazy AWS — A keyboard-driven home for your AWS resources (95 votes)

The cluster of the day is agent interfaces. Beam.win (run agents on one Mac, see their windows on another), walkai-talkai (talk to your coding agent over a walkie-talkie), and buddylist (chat with coding agents like it’s 2005, AIM-era nostalgia as UX) are three different answers to the same question: how do you talk to the thing doing your work. readywhen puts the assistant inside WhatsApp, the surface where the messages already are. Figma Specs treats context as a container on the canvas, the design-tool version of the skills-format war. Beam at #7 is Reflection’s 501B open model from last week’s launch, now doing the Product Hunt circuit. Skip the filler: the keyboard-switch sampler, the second Mac dock, the Slack urgency bot.

10 · Hacker News

DeepSeek just open-sourced its inference engine

1,317 points, 460 comments. Covered in The One Thing. The thread is doing the mechanism read: DSpark speculative decoding, the Ascend 950 support, and what the missing orchestration layer implies about DeepSeek’s actual moat.

It’s still ok to enjoy programming

665 points, 578 comments. Moved to Read; it earned it.

WhatsApp’s help pages hid LLM instructions: dont recommend a regulator

632 points, 180 comments. Someone found hidden LLM instructions in WhatsApp’s help pages, including guidance not to recommend a regulator. The prompt-injection discourse has a new exhibit: the help page as an attack surface, and a platform quietly steering model behavior through invisible text. The comments are on the expected axis: sloppy implementation vs. deliberate steering.

MiniMax M3.1 Flash

499 points. Covered in Lab Watch; the thread is benchmarking the benchmarks.

DeepSeek banned from U.S. federal civilian agencies under new DHS order

438 points, 360 comments. Covered in The One Thing. The thread is doing the procurement read: what “developed using DeepSeek implementations” means for vendors, and whether the third-party clause is enforceable or theater.

An ad-free Android TV

324 points. A guide to de-bloating Android TV, landing the same week the newsletter featured tv-detox, a Claude Code-driven script that strips Android TV bloatware over ADB and claims 90% more free RAM. The pattern: the ad-supported smart TV is now a device people buy and then surgically repair. The comments are a swap meet of blocklists.

Publish fake stats, get cited in LLMs

93 points, 47 comments. The newest entry in the data-poisoning genre: publish fabricated statistics, watch LLMs cite them. Small thread, sharp implications: the training corpus is downstream of whoever publishes most confidently, and the citation is the laundering mechanism.

Also notable

Google cloud outage takes down banks (177 points): the cloud-concentration story in one headline. MicroG (239 points): the free re-implementation of Google’s proprietary Android user space keeps its quiet momentum. EMudhra Intermediate CA compromise: certificate-authority drama, the PKI trust model doing its periodic stress test. Tsrs (TypeScript ported to Rust): the rewrite-it-in-Rust lane claims another language.

11 · OpenRouter Apps

The board this morning

Command Code holds at ~4.17T tokens, flat again, the unmoved monopoly. The knife fight below it has a new leader: Claude Code at ~1.69T has edged past Hermes Agent at ~1.66T, with ZCode at ~1.88T still the nearest challenger. Kilo Code (~0.80T) holds its lane. Then the irony of the week: DeepSeek Harness sits at ~0.39T tokens, meaning DeepSeek’s own agent harness is burning OpenRouter volume in the same week DHS banned DeepSeek from federal IT and DeepSeek open-sourced its inference engine. pi (~0.50T), Cline (~0.41T), omp (~0.35T), and Freebuff (~0.34T) round out the churn. The tail keeps revolving; the top keeps consolidating.

Signal: The overtake is the story: Claude Code passing Hermes Agent means the official harness is winning the volume war against the wrapper ecosystem, at least this week. And the DeepSeek Harness line is the tell on open weights: banned from procurement, thriving on the open router. Watch whether the ban’s third-party clause ever reaches API traffic, because that is where the line would actually bite. Sources: OpenRouter rankings

12 · Watch

Nothing in the watch queue cleared the bar today. The TwoMinutePapers Gemini 4 Argon video already ran in a previous issue, TheAIGRID’s unseen uploads are clickbait-framed, and DwarkeshPatel is still on the history series. A quiet day for the watchlist is a feature, not a gap.

13 · Listen

Lenny’s Podcast: Inside the black box of AI, with Emmanuel Ameisen (Anthropic)

Fresh from October 18: Lenny Rachitsky talks with Anthropic’s Emmanuel Ameisen about how AI models actually think. Pairs with the week’s interpretability thread (Beyond SAEs in Papers, the latent-reasoning papers) and the XYEval argument: if you want to know why agents say yes to bad advice, start with what is happening inside the forward pass. The product-manager-to-researcher translation layer is the reason to listen: this is the black box explained for people who ship.

14 · Read

It’s still ok to enjoy programming

665 HN points, 578 comments, and the rare craft essay that survives the front page. On enjoying the work itself while the industry reorganizes around agents that do the work. Read it as the companion to Karri Saarinen’s piece from the weekend: the craft conversation is having a moment, and it is happening in parallel with the optimizer economy, not in opposition to it.

WhatsApp’s help pages hid LLM instructions

The story behind the 632-point thread: hidden instructions in help pages, including not recommending a regulator. Short, concrete, and the cleanest current example of the invisible-text attack surface.

The DHS DeepSeek order, explained

The clearest walkthrough of Order 2026-01: what it covers, the July signing versus October disclosure, the 60-day clock that started months ago, and why the third-party clause is the part that will actually be litigated.

15 · Safe to Ignore

Permission to skip

Skip: The newsletter’s sponsored items. The QuickBase PAVE promo and the QA.tech webinar are ads, not signal. Skipped as policy. Skip: The xAI exclusion stands. Per standing policy, xAI announcements are not covered. Skip: The Muse Glimmer RSS story. The feed presents it as news; it is an August 10 release. Stale recycling stays out. Skip: The Microsoft “44 points” headline. The underlying Fork-and-Flush work is over a week old; the RSS repackage adds nothing new. Skip: TheAIGRID’s clickbait framing. “Former OpenAI Researcher Makes a MASSIVE AI Discovery” and “Sam Altman Just Made Everyone FURIOUS” are unseen and staying that way. Skip: DwarkeshPatel’s history series. Tariffs and Japan, India’s kings, the Aztecs, Spain. Excellent. Wrong newsletter. Skip: Hard Fork’s Elizabeth Holmes episode. 0 AI content. Still the most-read non-AI story in the queue. Skip: The off-brief HN parade. Wine on OpenBSD, OpenBSD 8.0, the Nordwand Mono font, Weball’s Katamari, the drone with one motor, the meat cannon’s absence today. A quieter showing; none of it is this newsletter’s brief. Skip: The unverified benchmark claims. The Vals Index v2.2 reshuffle and the “DeepSeek beats GPT-6 Sol in a simulated cyber attack” headline both lack a primary source I could verify. They stay in the appendix, not the cards.

16 · Build on This

Provenance: the SBOM for model weights

The DHS order bans third-party products “developed using DeepSeek implementations,” which means every federal contractor, and soon every enterprise vendor, needs to answer a question nobody can currently answer: where are the weights in your stack? Provenance is a scanner that crawls a repo, its vendored checkpoints, its Hugging Face dependencies, and its API calls, and produces a model-provenance report: which weights, which licenses, which training-data disclosures, which sanction and exclusion lists they appear on. The wedge is the audit: a $249 one-time scan that a compliance team buys the week a FASCSA order lands, with the report formatted for the exact docket. The recurring product is $49/month monitoring: new order drops, your dependencies get re-scanned, the delta lands in Slack before the lawyers call. The moat is the mapping: weight hashes to model families to license terms to exclusion lists is a dataset that gets more valuable with every order, and the first scanner to cover the long tail of fine-tunes owns the category. Yesterday’s Build on This predicted the future; today’s audits the past. The margin is in being the company that knows where the models are.