DeepSeek ships V4.1-Flash-1017 and opens Search and Fetch APIs, Tencent open-sources the Hy-Memory writer, NVIDIA releases the looped Dory 4B
The weekend's thread is agent parts getting cheaper and more specialized: DeepSeek bundles a coding model with per-call search and fetch, while memory writing and adjustable compute are being split out into small dedicated models. For product teams the question is shifting from which big model to use to which steps of the agent loop can go to cheaper components.
The repository and weights are MIT-licensed; DeepSeek says reasoning, coding, agent and vision benchmarks all improve while task time and output length go down.
Its table: 77.0 on DeepSWE v1.1 (74.2 for the previous version, 74.0 for Opus 5, 73.0 for GPT-5.6 Sol) and 42.3 on Terminal-Bench 4.0 (31.2 before, 51.8 for Opus 5), the latter run in the Claude Code harness.
Automation-Bench v1.0.6 goes from 54.8 to 60.5 and Apex Bench v1.1 from 64.6 to 72.1.
The recommended context window is 1M with max_tokens of at least 256K; there is no Jinja chat template, only a Python reference encoder and the Rust-based deepseek-recipe libraries.
Builder's takePut it next to Beam on 10-17 and Muse Spark Open on 10-16 and open coding models closed in on closed ones all week. I'd point Claude Code at it on a batch of real tasks from my own repos, checking whether shorter outputs still mean complete changes; note the missing Jinja template before self-hosting, and don't force a generic one onto it.
The Search and Fetch endpoints run on DeepSeek's in-house search engine, which it says serves hundreds of millions of requests a day worldwide.
Each endpoint costs $0.75 per 1,000 calls.
Search and Fetch calls made through server-side tools in DeepSeek Harness, Claude Code and Codex are free for DeepSeek API users until billing starts on October 31, 2026 at 16:00 UTC.
V4.1-Flash-1017 went live the same day on the website, app and API, optimized for DeepSeek Harness, Tencent CodeBuddy, WorkBuddy and others; DeepSeek recommends DeepSeek Harness v0.2.1-rc.1 or later.
Builder's takeAgent web access now has a plainly priced option from a Chinese provider. For a content backend that looks things up, like PandaClaws, use the free window before October 31 to compare hit rate and latency against your current search; before adopting it, count searches per task, because that number runs away easily in agents.
It directly replaces the general-purpose LLM on the write path inside Mem0, MemOS and Hy-Memory, deciding what to keep, how precisely to represent it and how new evidence updates old memories.
Average across the four frameworks: 55.49 for Hy-Memory-30B-A3B, 54.62 for Claude Opus 5, 53.64 for DeepSeek V4.1 Flash and 50.37 for Qwen3.6-35B-A3B.
The evaluation swaps only the memory writer and holds everything else fixed; each benchmark uses a fixed 20% subsample, and EverMemOS is held out from training.
It ships under Apache 2.0, tested with vLLM v0.31.0 and served through an OpenAI-compatible API.
Builder's takeMemory writing is a high-frequency background call, and running it on a flagship model is the most expensive and least sensible choice. I'd swap it in on Mem0 for a week for the user-preference memory in AI Cloud Drive; as my 10-17 post on aipan's cost bill notes, long-run cost piles up in repeated background steps like this. The scores come from 20% subsamples, so check on your own data first.
4B parameters, a looped (latent-recurrent) normalized-GPT with interleaved sliding-window and full-attention layers, up to 256K context, English only.
Compute is set by how many times the shared block runs: SWE-bench Verified is 50.3, 59.5 and 61.8 at 1, 2 and 4 loops, against 61 for Qwen3.5-9B in the same table; NVIDIA says more loops solve the same tasks with fewer generated tokens.
Last-loop KV caching keeps one cache per recurrent attention layer, so memory doesn't grow with each added loop.
Pre-trained natively in NVFP4, offered in BF16, MXFP8, NVFP4 and Q5_K_M, under the OpenMDW-1.1 license.
Builder's takeOne model with compute set per request suits on-device and small teams: one loop for easy requests, four for hard ones, without maintaining two models. I'd measure the real loop-versus-latency curve in an offline batch job first; it's English-only, so Chinese products shouldn't ship it yet.
2,601.0 billion native-script tokens and 224.6 billion romanized tokens, counted with the Gemma-4 tokenizer.
It covers the 22 languages listed in India's Constitution, with romanized text for twelve, for 34 language-script configurations.
The pipeline uses NeMo Data Designer and Gemma-4-31B-it to translate whole English documents, assess quality, repair low-scoring outputs and romanize a subset; prompts separate prose to translate from code, equations and URLs to preserve.
Every output keeps its source identifier, so it can be traced back to the original document.
Builder's takeFor us the pipeline matters more than the Indic data itself: translate whole documents, score them, repair only the low scorers and preserve code and equations. That's a recipe I could borrow to localize the AI Interview question bank. Run it on 100 questions first and spot-check how much the repair step actually fixes.
Void Platform, Void SDK and Void CLI ship as one JavaScript package and Vite plugin, installed with npm install void; all of it is open source and the platform can be forked.
The platform runs in your own Cloudflare account (Workers for Platforms and R2 required); admins control access, set resource limits and inspect deployments and usage.
The SDK infers resource bindings and provisions databases, queues and AI bindings at deploy time, and works with React Router, SvelteKit, Nuxt, TanStack Start, Astro and others.
The CLI lets an agent read deployment logs, debug failing requests and deploy; VoidZero has used it in production for several months.
Builder's takeOnce coding agents are everywhere, the bottleneck moves from writing the app to who hosts it and who controls access. Void's answer is a shared platform with resource limits, giving prototypes from non-engineers a safe place to land. This site runs on Astro, so I'd try its Astro integration on a small internal dashboard and check what it provisions before rolling it out.
DPoP (RFC 9449) binds tokens to a client-generated asymmetric key pair, so a stolen token can't be replayed without the private key.
Google binds only refresh tokens; access tokens, typically valid for an hour or less, stay ordinary bearer tokens to avoid asymmetric signature checks on every API call.
DPoP doesn't protect browser session cookies; that falls to DBSC, which Google and the WICG are developing.
In multi-agent chains an intermediate agent can't sign a DPoP proof for its upstream; Google suggests exchanging through STS for a short-lived federated token bound to the agent's own key. Google Workspace already uses DPoP to validate agent identities at the Agent Gateway of the Gemini Enterprise Agent Platform.
Builder's takeProducts whose agents call Google Drive or Gmail for users should change how they store refresh tokens first. If AI Cloud Drive imports from Google Drive, I'd move its refresh tokens to DPoP binding with the private key kept server-side; the trade-off of binding only refresh tokens and keeping access tokens short-lived is worth copying in your own gateway too.
It returns the text each organization member saved as Instructions for Claude in claude.ai and as Global instructions in Cowork.
Call GET /v1/compliance/organizations/{org_uuid}/user_preferences with your existing Compliance Access Key and the read:compliance_user_data scope.
It's in beta and limited to Claude Enterprise organizations.
Builder's takePersonal custom instructions often hold internal system names, customer details or even keys, and they used to be an audit blind spot. If you build enterprise AI products, treat this as a requirement: admins should be able to export and search users' standing instructions. If you run Claude Enterprise, pull them all once and look for things that shouldn't be there.
It proves execution of RISC-V programs: Rust, Go and C compile as usual, with no hand-written cryptographic circuits.
It proves 7.2 to 8.7 million processor instructions per second on a laptop and is 10 to 39 times faster on average than the fastest existing zkVMs across 15 benchmark programs.
Its security rests only on standard hash functions such as SHA-256 or SHA-3, with no elliptic curves, lattices or trusted setup.
Proofs are small and check in milliseconds; Microsoft gives the example of an agent attaching a proof that each action complied with its policy.
Builder's takeIt's still a way from products, but the direction is worth noting: agent compliance today rests on logs and trust, and may one day rest on verifiable proofs. What you can do now is write agent policy checks as small deterministic programs rather than burying them in prompts, so they're verifiable whether or not zero-knowledge proofs ever arrive.
Researched and drafted with AI assistance; editorial standards and views set by Darius.