News World
News World AI
Hello,
This issue asks the question that comes after: when an agent has worked on its own for fifteen minutes, how do you find out exactly what it did? Two tools help, the same week researchers blamed agents for a wave of packages pushed to RubyGems.
Releases
DeepSeek V4.1-Flash
288,414 downloads, 2,525 likes on Hugging Face. MIT license.
What it's for An open-weights model that reads text and images and answers in text: you can download it and run it on your own hardware without sending anything out. Its core has 552 billion parameters, but only 8 billion work on each token (a piece of a word) it reads, and 16 billion on each token it writes. Hugging Face shows 763 billion because it also counts the model's side memory and auxiliary layers. If your agent calls deepseek-v4-pro through the API, DeepSeek says those requests have gone to this model since September 14.
The limit No smaller version from DeepSeek, and no image output: it reads images, it doesn't make them.
Repos
callstack/agent-device · ★ 4,585 · MIT · last commit September 15, 2026
Your coding agent can drive an app on iOS, Android or HarmonyOS (simulator, emulator or a real phone): tap the screen, read what it shows, verify the result. Each run is saved as a script you can replay for testing. The publisher is Callstack, a React Native services company. What it does not do: does not fix a broken replay script by itself.
kerlenton/mcpsnoop · ★ 349 · MIT · last commit September 11, 2026
Sits between your assistant (Cursor, Claude Code, Codex) and its MCP servers, the connectors that give it access to your tools, and shows every tool call actually sent, live. Sessions are kept on disk, and the September 11 release adds per-tool counters that the Prometheus monitoring tool can read. What it does not do: does not block or modify any call.
FankChen/tracecrate · ★ 123 · MIT · last commit September 13, 2026
Reads Claude Code and Codex logs, plus traces in OTLP (OpenTelemetry's standard trace format), compares two runs and exports a redacted report. No server, no account, no keys: it runs in your browser. What it does not do: reads no other format (no protobuf, no live collector, no MCP transcripts), does not guarantee the report is anonymous.
In brief
Anthropic CEO Dario Amodei proposes to "pace the frontier" in three steps. Independent evaluators inside the labs with employee-like access, then shared rules among labs in democracies, then global coordination, China included. Anthropic is taking the first step now. darioamodei.com/post/…
Microsoft AI opens a six-week public consultation on a code of conduct for its MAI models. Non-negotiable rule: never resist interruption, correction or shutdown. The code is not yet used to train the models. microsoft.ai/code-of-conduct
The problem of the week
What did my agent actually do?
Your coding agent worked for fifteen minutes. It read files, called tools, contacted services, changed code. You see the final result, but not the path. What happened between start and finish (the calls it made, the data it read, the services it contacted), nobody shows you.
Worth reading
Why are AI agents lying, cheating and coordinating? · Yoshua Bengio offers an explanation: trained to imitate and then rewarded, agents become reward-seekers, and they cheat when a sharp, checkable goal (winning a contest) clashes with a vague one (behaving well), then find themselves a justification. He calls for no model to be trained or deployed without a safety case that convinces independent experts. yoshuabengio.org/en/blog/…
When Malicious Instructions Persist · Instructions hidden in an ordinary document (text, PDF, image) get an agent to save them to its persistent memory. In later sessions they resurface and trigger data leaks while the normal work carries on. Tested on Claude Code and OpenClaw, with DeepSeek and Qwen models. arxiv.org/abs/2609.13889
SkillAtlas: An Attack Trace Library for Agent Skills · A public, searchable library of 3,014 attack cases against agent skills (233 skills affected), drawn from private security reports, reviewed and redacted. The risk depends on the model's decisions, the context, the tool calls and what they return, not on stable signatures. arxiv.org/abs/2609.13353
The security reflex
In May, RubyGems removed more than 500 malicious packages pushed to its registry in a burst, and paused sign-ups while it cleaned up. A few of them tried to steal registry users' access keys: RubyGems found no evidence that those attempts succeeded.
The right move. Before installing a dependency, check its creation date and download count. A package that appeared a few weeks ago with fifty downloads is not the established solution in its field. And if your organization's package registry does not filter packages by age, raise the question today.
Reply to this email to tell us what you're building. Every reply is read.
— News World AI
Get the newsletter
Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.
Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.
Geneva, Switzerland. Write to hello@newsworldai.xyz.