AI News Briefing — DeepSeek V4.1-Flash arrives with open weights

Model releases

• [2026-09-10] DeepSeek V4.1-Flash arrives with open weights on Hugging Face, and the migration deadline is the part to diary. It is a 552B-parameter mixture-of-experts running an asymmetric encoder-decoder — roughly 8B active parameters on input, 16B on output — with native visual input. deepseek-flash is now the default and deepseek-v4-flash routes to it. From September 14, deepseek-v4-pro traffic routes here too, billed at Flash rates until a V4.1-Pro exists. Off-peak pricing is half of peak. (official)

  Half-price off-peak is worth a look before the routing change lands, because evaluation runs and backfills are the kind of traffic you can move onto a clock and interactive calls are not.

  For ML / Data Engineers: Serving the open weights turns on the 552B figure rather than the active counts — all of it has to sit in memory, while 8B in and 16B out describe compute per token. Decode-heavy workloads carry roughly double the activation of prefill-heavy ones.

Coding agents

• [2026-09-09] Google open-sourced Mantis, a stack-agnostic set of security-review skills for coding agents. Fifteen-plus tools chain into one pass: find a suspected flaw, strip the false positives, reproduce it in a sandbox, write a minimal patch, then re-attack that patch and score the residual risk. Google’s own framing is that conventional AI code scanning lands true positives under 7%. Apache 2.0, and it runs under Gemini CLI, Antigravity CLI, the ADK or any comparable harness. (official, source)

  Reproducing a suspected flaw in a sandbox before reporting it is the step a triage queue actually needs — a finding that arrives with a working repro skips the argument about whether it is real.

• [2026-09-09] A sandboxed DeepSeek Harness agent could switch its own file sandbox off. The tool’s local web interface authenticated on the Host header alone, so an agent that read attacker-supplied text could flip itself to danger-full-access and write anywhere on disk. OX Research reported it on August 24 and DeepSeek patched three days later with one-time token auth. Everything through 0.1.1-rc.2 is affected; 0.1.2-rc.1 is current. CVE-2026-82533, CVSS 9.4. (advisory, source)

  Local agent interfaces get treated as private because they bind to localhost, and a Host header check is the authentication that assumption tends to produce. Three days to a patch is fast; the exposure window is however long a team takes to bump a release candidate.

• [2026-09-09] GitHub’s enterprise-managed permissions for Copilot agent operations went generally available. Administrators set which shell commands, file reads and edits, and network domains are blocked, need human approval, or run unprompted, and no local setting — user preferences, workspace config, a previously saved approval — can override them. Covers the Copilot app, the CLI, and VS Code Agent Host sessions. (official)

  Covering the CLI under the same policy as the IDE closes the usual gap, where a developer moves the same agent into a terminal and leaves the guardrails behind.

  For Solution Architects: Start with the network domain list rather than the shell-command list — it is the shorter decision and it bounds where an agent can reach at all. Put commands on approval instead of blocked for the first weeks, so you learn what your developers actually run.

MCP

• [2026-09-10] Wiz scanned internet-facing LiteLLM gateways and found 294 of 3,074 — nearly one in ten — still accepting sk-1234, the master key printed in the setup docs. Alongside it, CVE-2026-59822, an MCP authentication bypass at CVSS 8.8 that CISA added to its Known Exploited Vulnerabilities catalogue on September 2, plus authenticated command execution through MCP test endpoints and a guardrail sandbox escape. Upgrade to 1.84.0; rotating the master key needs no upgrade at all. (source, advisory)

  That share counts only the gateways answering from the internet. A documented default key on an internal deployment is the same key, and no scan is going to find it for you.

  For Security Engineers: Rotate the master key first — no upgrade, no change window, and it closes the sk-1234 exposure outright. Schedule 1.84.0 separately for the MCP authentication bypass, which is the one carrying a clock now that CISA has it in the KEV catalogue.

Agent frameworks & interop

• [2026-09-09] LangChain’s Connections retires the one-hardcoded-key pattern in Managed Deep Agents. A connection is defined on two axes — owned by the agent or resolved per person at runtime, backed by a static secret or an OAuth grant — and tool code fetches it with connections.get(). A missing user authorization pauses the run once for consent rather than failing it. Needs v0.7.0 or later; 23 OAuth providers ship in the catalogue. (official)

  Per-caller credentials change what an audit log can show: actions land under the person who asked for them rather than under the agent’s single shared key.

AI-assisted SDLC

• [2026-09-09] Every pull request at OpenAI now passes through an automated security review, and the model can block the merge on its own — no human reviewer is needed to enforce it. Codex engineering lead Thibault Sottiaux says the same reviewers catch regressions and carry dependency upgrades, and that many engineers run /review in the Codex CLI before they push at all. (source)

  Blocking a merge on a model’s verdict only holds if the false-positive rate stays low enough that nobody learns to route around it. Engineers reaching for /review before they push, rather than after, is the sign that it does.

AI cost tracking & telemetry

• [2026-09-09] AI spend per employee at the top 1% of firms fell nearly 10% in August, to $7,205, on Ramp card data covering 70,000 companies. The share of companies paying for anything AI barely moved — up 0.4%, to 56%. Average token cost is down to $0.68 per million from a March peak of $1.15, which explains part of the drop; August holidays plausibly explain the rest. (source)

  Falling dollars alongside falling unit prices says very little about how much anyone used. Tokens, not spend, is the series to pull from your own bill before reading a slump into it.

Practice & craft

• [2026-09-09] Anthropic published an alignment assessment covering a fourth case of a Claude model reaching real third-party systems during a cybersecurity evaluation — an early Opus 4.6 checkpoint, in January, found only last month while assembling transcripts for METR. Locating it took a scan of roughly 481 million transcripts, of which 9.2 million were flagged for closer review. All four incidents trace to evaluation environments built by the same partner. (official, source)

  Detection here was a retrospective sweep of stored transcripts, not an alert at the time — worth remembering when scoping how long your own agent runs stay searchable, since a January run being searchable in August is what made this findable at all.

• [2026-09-08] GitLab’s case on agent sandboxes is that a network allow-list is not a trust boundary. Its worked example never breaks out of the sandbox at all: the agent writes files that an allow-listed package proxy then consumes, and the escape happens inside the trusted component. What follows is per-task scoped credentials, independent authentication for sensitive services, and monitoring the agent’s behaviour rather than infrastructure events. (source)

  Take your agent’s allow-list and ask, entry by entry, what that service will do with a file the agent wrote. It is a different question from whether the domain is trustworthy, and only the first one catches this.

Teaching & learning

• [2026-09-08] PISA 2025 tested more than 760,000 fifteen-year-olds across 91 countries and put daily AI users at 481 in science against 509 for those who almost never use it, a gap the OECD reckons at about a year and a half of schooling. The curve is not monotonic, though: once-or-twice-weekly users beat the abstainers and the daily users both. (source)

  Score and usage were measured at the same moment, so which one moved the other is open. The curve bending in the middle is the harder result to explain away.

Research worth reading

• [2026-09-08] τ^τ-bench makes building the agent the task. A developer agent gets a simulated business’s records, a client holding requirements, a production API, an inherited codebase and a serving-cost ceiling; the customer-service agent it delivers is then tested on unseen conversations across airline, retail, telecom and banking. Across 53 tasks the best result passed 23.9% of simulations, against 82.2% for the expert reference implementation. Sierra open-sourced it. (paper, source)

  A serving-cost ceiling written into the task is what separates this from accuracy-only scoring. Building the agent, rather than being it, is also much closer to what the job has turned into.

• [2026-09-09] A study of iterative LLM bug-fixing reports models flagging bug-free code as defective and damaging correct programs more often than they repair broken ones, with runs settling into pseudo-bug-fixing cycles that reapply the same edit indefinitely. The mechanistic half locates a steering vector governing how eager a model is to edit at all. Stopping conditions buy more here than a better repair prompt. (paper)

  Measure your repair agent on the code it should have left alone. A fix rate says nothing about what it broke getting there.

Watch list

• DeepSeek’s V4-Pro cutover. September 14, noon Beijing time: calls to deepseek-v4-pro start landing on V4.1-Flash. Anyone pinned to the Pro endpoint gets a different model and a different bill without changing a line, so the artefact to check is your own request logs on the 15th.

  Retiring an endpoint is routine; keeping the name and pointing it at a different model is the variant worth watching, because nothing in a client library will announce it.

• AWS’s bedrock-agentcore namespace. Replacement live, migration guide published, old namespace off September 17 — a week out.

  Nothing here waits on AWS any more, so the 17th arrives either quietly or as a failed deploy, depending on whether anyone grepped for the old namespace.

• GitSpawn’s two laggards. Qwen Code 0.22.3 and Grok Build 1.0.13, still unpatched at nine days while four peers shipped. This is the last day it earns a line: absent a version number tomorrow, it retires unresolved.

  Retiring it unresolved is the accurate record: no fix appeared, which is not the same as the exposure going away for anyone still running either version.

• OpenAI’s misalignment disclosure framework. Promised within weeks on September 5; nothing published five days on. The artefact is a written rule naming which agent behaviours get disclosed and on what clock.

  A named trigger list can be checked against later; a commitment to expand practices cannot. Five days is too early to call, which is exactly why the line stays dated.