DeepSeek releases an updated Flash model

  • DeepSeek updates Flash with downloadable weights and better coding results — Developers get a concrete alternative to test in coding assistants, with integration details to check before switching.
    • An agent is a model running a multi-step task with tools. The October 17 release is available through DeepSeek’s app, website and API, alongside the downloadable weights.
    • Hugging Face lists 763 billion parameters. The MIT-licensed model accepts a context of one million tokens, making the complete model far larger than a typical desktop deployment.
    • A benchmark is a fixed set of tasks for comparing models. DeepSeek reports Terminal-Bench 4.0 success rising from 31.2% to 42.3% against the previous Flash version.
    • DeepSWE 1.1 success rises from 74.2% to 77.0%. The harness is the software around a model that runs its tools, files and commands. Terminal-Bench uses Claude Code; DeepSWE uses Mini-SWE-V2.
    • The release omits a Jinja chat template. Its Python reference and deepseek-recipe toolkit handle prompt formatting. The local execution guide describes reference software; production serving needs a separate engine.
    • Caveat: These are DeepSeek’s own test results, and its claims of faster completion and shorter answers still need checking on your workload. (HN 868 points · 659 comments · r/LocalLLaMA · Techmeme)

Agent frameworks & tooling

  • OpenCode warns that a Console breach may have exposed provider keys — Affected Console users should replace stored provider credentials through the providers’ dashboards and check recent usage.

    • The company’s reported October 17 disclosure puts the affected group at roughly 1.4% of Console users. That figure counts Console accounts; the wider OpenCode user base has a different denominator.
    • Its notice describes unauthorized access to a legacy system and possible exposure of third-party keys. Review provider usage and billing, then update applications that depended on replaced keys.
    • The company calls the incident related to a “distillation attack,” meaning an attempt to train another model from collected answers. That label leaves the initial access method unexplained.
    • Caveat: The public reporting establishes possible Console credential exposure, while the entry point, misuse and scope beyond that system remain unresolved. (Techmeme)

  • DeepSeek opens web search and page fetching through separate APIs — You can test its search service independently of its language model, using ordinary authenticated JSON requests.

    • Search returns structured results; Fetch returns a page as Markdown. Both use an existing DeepSeek API key and the endpoints /v1/tools/search and /v1/tools/fetch.
    • Each endpoint costs $0.75 per 1,000 successful requests. Empty searches, failed requests and timeouts are unbilled; asking for more results leaves the per-request price unchanged.
    • Each account gets five requests per second for Search and another five for Fetch. Fetch also has a separate per-domain limit.
    • Caveat: The temporary free period applies to server-side calls through supported coding tools using DeepSeek’s API, ending October 31 at 16:00 UTC. (HN 219 points · 102 comments)

  • Sphinx quizzes developers before they push AI-written code — Its Git hook asks about failure cases in your actual changes before a push proceeds.

    • The MIT-licensed repository requires Node.js 22.19 or newer. Installation changes the user’s global Git hooks path, initially checking pushes to main and master across repositories.
    • A separate reviewer reads committed changes without the coding conversation. A push can wait up to 25 minutes; a typical check takes five to eight model requests, plus about one per answer.
    • The reviewer provider receives code and your answers. File exclusions help protect secrets, but a credential pasted into an ordinary source file can still be sent. Model calls have no default count cap.
    • Caveat: Developers and coding agents can bypass this local learning check, so passing supplies no security guarantee. (HN 140 points · 42 comments)

  • A fresh Codex report finds hundreds of gigabytes of crash files — Mac users should check crash-report folders when disk space disappears, even if the app still works.

    • An October 17 report describes about 323 GB across two Crashpad folders, containing roughly 4.04 million files. The reporter used ChatGPT.app 26.1007.71326 on macOS 15.7.4.
    • The folders are ~/Library/Application Support/Codex/Crashpad and ~/Library/Application Support/com.openai.codex/web/Crashpad. Earlier reports identify the crash reporter itself repeatedly crashing and restarting.
    • An OpenAI contributor said on October 6 that a fix for older Mac kernels had merged. That comment leaves the containing release unspecified.
    • Caveat: This is a new report on an issue opened in June, and the reported sizes describe individual affected machines. (HN 134 points · 56 comments)

Models & research

  • Lean adds independent checks for computer-written mathematical proofs — Teams generating proofs with models can recheck them through several implementations, reducing dependence on one proof checker.
    • The October 15 writeup explains lake check in Lean v4.35.0, released October 12. It exports a project and checks it inside a sandbox.
    • lake check --paranoid adds four external checkers and a hardened version of the official checker. The four external implementations have different verification status.
    • Con-leche has a formal consistency proof; con-ron connects a Rust implementation to its checking algorithm. The author reports con-leche checking Mathlib in about 100 seconds on eight threads, using 0.69 times the official checker’s instructions.
    • Caveat: The consistency argument still assumes the underlying set theory, while compiler and runtime faults remain reasons to use independent implementations. (HN 144 points · 48 comments)

Policy & provenance

  • Continued: Meta removes broad AI-training language from its business terms — day 3 of coverage (base specs in the October 16 digest).
    • The live terms preview, effective October 30, now limits the stated purposes to advertising and business products, plus product integrity and security.
    • The sentence broadly allowing content use to “train” Meta products has disappeared. Permission to crawl associated sites and create test credentials remains.
    • A company spokesperson says site owners can continue using robots.txt to express their preferences, and that the update grants no overriding rights.
    • Caveat: The change narrows the disputed wording but leaves a substantial commercial crawling permission in place. (Techmeme)

Industry

  • Banks and travel sites restrict what AI assistants can do — Browser workflows need permission checks and a human fallback before they can reliably handle purchases or accounts.
    • JPMorgan Chase and Charles Schwab confirm blocking AI agents from account access over security concerns. Delta prevents agents from booking tickets on users’ behalf.
    • Yelp allows access through its paid data-licensing program. The Amtrak and Cars.com examples come from individual user reports.
    • Treat authentication, site permission and task completion as separate checks before handing an automated workflow responsibility for a purchase or account action.
    • Caveat: This October 17 report combines confirmed restrictions with individual user reports, so it cannot establish one uniform ban across the web. (Bluesky @theverge.com)
All gathered items - what was cut and why (6)