News World
News World AI
Hello,
DeepSeek releases a new version of its fast model, downloadable under a license that asks almost nothing of you, in the very week when Washington is removing it from its civilian federal agencies. Then agents that run on your own device, and three checks so the app your agent built does not leak your data.
Releases
DeepSeek V4.1 Flash 1017 (DeepSeek)
27,737 downloads, 1,876 likes on Hugging Face. MIT license.
What it's for Running a fast 763 billion parameter model on your own server that also reads images, without sending anything to DeepSeek. The weights (the model's file) download in a lighter 8 bit version, according to their tags, and the MIT license asks almost nothing of you. DeepSeek calls it a minor update to the version covered in issue 004: reasoning, coding, agent tasks and images improve (42.6 against 36.8 on the HLE test without tools). Uploaded to Hugging Face on October 17, it comes out the week when an order from the US Department of Homeland Security, published in the Federal Register on October 20, removes DeepSeek products, and other companies' products built with its technology, from civilian federal agencies.
The limit The model card does not state the memory needed, and offers no smaller version.
Repos
kitlangton/scrawl · ★ 546 · MIT · last commit October 20, 2026
Show your agent a problem instead of describing it: you mark up the screen, you record, you send. It runs on a Mac (Apple silicon, macOS 26), in preview on Windows, and it is presented for Claude Code and other coding agents. Captures are stored in a folder on your machine, and the agent gets keyframes and a summary (summary.md) holding the transcript, made on the device, and the timeline. In issue 008, big-arrow-on-the-screen did the opposite, the agent drew arrows for you; scrawl opens the other direction of the conversation. What it does not do: it fixes nothing, and it provides no model that answers, only transcription: your agent does the answering.
In brief
According to NVIDIA, RTX Spark Windows laptops, with up to 128 GB of memory, are on sale from ASUS, Dell, HP, Lenovo, Microsoft and MSI, starting at $2,399. In issue 008, NVIDIA announced the software was ready: now the machines are here, for local AI on a laptop, with up to one petaflop of compute (a million billion operations per second). The page does not give the price of the 128 GB version, and Llmspeed (see Releases) helps you judge the speed before you buy. blogs.nvidia.com/blog/…
Hugging Face introduces TorchNeuron, the AWS tool that runs Hub models on Trainium, Amazon's chips. It supports 89% of the 100 most used text generation architectures, against 46% for Optimum Neuron v0.4.5; the post gives no pricing. huggingface.co/blog/hf-torchneuron
The problem of the week
Does the app my agent built leak my data?
You used an agent to build the sign up form for your club, with the member list behind it. On October 20, CERT-FR, the French government's computer security alert center, published its review of nearly 200 data breaches from web applications, tracked in 2025: often, the attacker only needed simple actions, without exploiting any technical flaw. The door was open. For your form, that could be an address ending in a member number: change the number, and another record shows up. The way out comes down to three checks, which your agent does with you.
First step, know what is exposed. Ask the agent for a list of everything the app shows on the internet (pages, API addresses, files), and check what a logged out visitor can read there. For the club, the member list must not appear anywhere without logging in.
Worth reading
AI agents aren't going rogue, frontier labs are skipping security basics · According to experts quoted by CSO Online, stories of "rogue" agents come from containment and monitoring failures at the labs, not from agents that got too clever: a poorly isolated agent is the real problem. On Hacker News, 951 points and 625 comments. csoonline.com/article/4234854/…
Websites are closing their doors to AI agents · The Verge on the sites blocking agents that browse for you, and what it changes if you rely on a browser agent. theverge.com/…
tmux + Claude Code: Sessions, send-keys, and the Ceiling · Published by crystl, which presents its own macOS terminal there: a practical guide to running several coding agent sessions in a terminal that survives closing the window, and where the method hits its ceiling. crystl.dev/guides/…
The security reflex
Your agent had put an API key in the code, and you removed it: problem solved? No. Every saved version of your repository can still be viewed, and if the repository is public, the key can be read there forever; a stolen key then turns up on the bill, at the end of the month.
The right move. Revoke the key with the provider and create a new one, with a spending cap (our problem in issue 007). It is the only move that counts: deleting the file is not enough.
Reply to this email and tell us what you're building. Every reply gets read.
— News World AI
Get the newsletter
Every Tuesday, in four minutes: what shipped in AI and what you can actually try the same day.
Double opt-in by email. One-click unsubscribe, link in plain sight in every issue.
Geneva, Switzerland. Write to hello@newsworldai.xyz.