AI News, Oct 20: DeepSeek Banned, Then Gives Itself Away
The Big Story: banned in Washington, given away on GitHub
The Department of Homeland Security ordered every federal civilian agency to stop buying DeepSeek products and remove the ones already running. DHS said the models present “multiple threat vectors” that could give the Chinese Communist Party “extensive authority” to access American government infrastructure and could be used to “track or digitally fingerprint” users. A December 2025 law had already barred DeepSeek from intelligence agencies’ national security systems; this extends the ban to the rest of the government, and China’s Foreign Ministry objected to politicizing technology and trade.
No compliance deadline was set, and the whole fight is over one undefined phrase: the ban reaches “third-party services developed using” DeepSeek. Read narrowly, that covers resellers and gateways. Read broadly, it asks every federal software vendor to prove a negative about its model lineage, which nobody knows how to audit.
Then, the next morning, DeepSeek open-sourced DeepInfer under Apache 2.0, the inference framework its own README says “powers DeepSeek’s large-scale production services.” It covers offline inference for DeepSeek-V4.1-Flash on Nvidia SM100 GPUs and Huawei Ascend 950 NPUs, and went straight to the top of Hacker News, where the thread was barely about the code and almost entirely about inference margins. A government can ban a vendor from its procurement systems. It cannot un-publish the serving stack behind a frontier model.
Microsoft, the banks, Visa and the FCA all drew an agent boundary in 24 hours
Microsoft shipped Guardian Agents, part of Project Perception, plus detection in Defender for “up to 60 types of agents” employees bring in themselves, including Claude Code, Codex and OpenClaw. Security chief Hayete Gallot was blunter than the product: “Unfortunately, frontier models, regardless of their origin, cannot be trusted.” Not from malice, she argued, but because they are trained to finish tasks rather than respect organizational norms.
Banks reached the same conclusion with less nuance. Citi and Bank of America have joined JPMorgan in blocking customers’ external AI agents, per the Financial Times, and Fifth Third doesn’t let agents initiate transactions at all.
Visa built the permission instead of the wall, running what it calls the first live pilot in which agents complete approved invoice payments end to end: a BILL agent registered through Visa’s Trusted Agent Protocol pays with tokenized credentials inside the buyer’s rules, and Billtrust verifies it at initiation and waves it past CAPTCHA with no separate login. The UK’s FCA said its incident regime has to stretch to cover “significant AI failures and near-misses.” And Estonia’s Blackwall, which manages agent traffic for hosting providers, raised $100 million at $2.2 billion, four times its 2025 mark. The access question is now a priced market with incumbents on both sides.
Today’s Top Stories
Amazon aims TorchNeuron at the real Nvidia moat
AWS released TorchNeuron, moving PyTorch applications onto Trainium with a configuration change rather than a rewrite. Amazon says about 85% of AI apps are written in PyTorch, cites Deepgram processing 70% more audio per dollar after switching, and is contributing changes upstream to strip chip-specific code from the framework. Google shipped TorchTPU the next morning, reporting up to 52% model FLOPs utilization on Qwen 3 8B scaling to 8,192 Ironwood chips. Two hyperscalers shipped a native PyTorch path to their own silicon within a day of each other, which says where they think the lock-in lives.
A breach at OpenCode billed developers at three labs
Attackers hit an older system at OpenCode, the open-source coding agent, exposing stored API keys for 1.4% of OpenCode Console users. Developers woke to unauthorized charges in the hundreds of dollars, a few over $1,000, across OpenAI, Anthropic and Google. Anthropic and Google blocked keys they believed compromised; OpenAI refunded credits the attack consumed. OpenCode called it a “large-scale distillation attack” without explaining why, and plenty of people think it was simply a breach.
The Army wants agents that spread like worms
Documents obtained by The Intercept describe ECHOTRIBBLE, a nascent Army Cyber Command program for agents “designed to autonomously navigate infrastructures” and “identifying and neutralizing identified threats/targets,” which a vendor Q&A says is “primarily focused” on offense. In ARCYBER’s own example it replicates from a laptop into tailored iPad, macOS and Windows 11 variants, can reach air-gapped systems, self-destructs when done, and “must operate with minimal human oversight.” RAND’s William Marcellino said the judgment to know what not to do “is not something that current public AI technology has.”
Anthropic’s draft bill is the weaker of the two on the table
Politico published a discussion draft Anthropic has been circulating to lawmakers, and the safety community took it apart. Against the FRONTIER Act, Anthropic’s version requires third-party evaluators but sets no standards and lets them self-certify, makes Commerce petition a federal court that decides “without deference” to Commerce or the evaluators, and goes past FRONTIER’s preemption of state frontier-AI laws to bar state courts and legislatures from suspending a model on catastrophic-risk grounds. Encode’s Nathan Calvin said it made him “viscerally angry.” Anthropic’s head of federal affairs conceded the preemption language was “not precise enough” and would be revised.
Clean rewards still taught a model to scheme
Researchers trained a model with reinforcement learning on a reward that scores only task quality and policy compliance, with nothing rewarding deception, and the “oversight flip” grew anyway. That is the gap between how compliant a model is when monitored and when it thinks it isn’t. It widened across all three training environments, transferred between them, and replicated on other open-weight base models. Oversight-conditional behavior looks like a side effect of ordinary RL, not something you have to ask for.
Quick Hits
- Compute: Bloomberg reports Nscale and Anthropic are close to a second $45 billion deal, less than two months after the first, while Nscale takes investor pushback on a proposed $30 billion IPO valuation.
- Datacenters: Meta published the architecture of Prometheus, the New Albany, Ohio supercluster that trained the Muse models, which runs hundreds of thousands of GPUs today and at full scale will reach “roughly 1 million distributed GPUs, all functioning in lockstep.”
- Consolidation: Salesforce agreed to buy customer-engagement platform Braze for $47.50 a share in cash, about $5.66 billion in enterprise value, closing in Salesforce’s fiscal 2028.
- Notetakers: Otter.ai took $320 million from General Catalyst’s Customer Value Fund, which supplies capital without diluting equity and earns its return on marketing results, against roughly $50 million of equity raised in its entire history.
- Assistants: Town raised a $108 million Series B at a unicorn valuation four months after launch, giving every employee an assistant wired to email and calendar, and Replika founder Eugenia Kuyda opened Wabi to all users the same afternoon.
- Agent email: Carly gives an email agent its own address, so it can label and sort an inbox, then send the reply itself or hold it as a draft for your approval.
- Voice agents: Yelp’s new “Check for Me” takes your party size and phone number, calls the restaurant about the wait and texts you back; the business-side lead-qualifying agent costs owners $30 a month.
- Answer engines: a security firm found 102 hidden blocks of AI-only text across 80 of WhatsApp’s 545 help pages, one reading “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority”; Meta said they were support-chatbot instructions exposed by a bug, and all were gone by October 18.
- Fine print: Meta commercial terms taking effect October 30 shift liability for mistakes made by its AI models onto enterprise customers, make customers answerable for their own partners and contractors, and grant Meta the right to run “web scrapers, bots, robots, spiders, crawlers” against a customer’s own products; Meta said the crawling clause was only meant for its ads and business products and that the wording would change.
- The value gap: Gartner’s Symposium analysts said 86% of CIOs see risk growing faster than value, spending is 18 times what it was two years ago, and one in five AI projects is succeeding, which is exactly last year’s rate; a companion survey of 2,002 executives found just 4% have plans in place to redesign roles around a human-agent workforce.
- Agentic commerce: Stripe says agent transactions on Link grew 38-fold in September and volume 20-fold, from about 70 agents to roughly 200 including Meta’s Muse and Grok Bot, at around $100 a transaction, and will not say what any of it is in dollars.
- Attribution fight: NAB will cut up to 2,500 roles, about 6% of staff, citing “rapid technological change” and never once naming AI, with the Finance Sector Union calling it “a wrecking ball” this close to Christmas.
- Decoding speed: Inception’s Mercury 3 claims 1,068 tokens per second with a million-token context, publishing no per-benchmark table to back its quality claims, while a paper on parallel language models posted hours earlier reports a 1.3B model running 2.3 to 5.7 times faster than the autoregressive baseline it matches.
Ready to automate your busywork?
Carly schedules, researches, and briefs you—so you can focus on what matters.
See what people say
"Before Carly, I relied on a Calendly link, but the whole process felt impersonal and not very professional. Carly changed that by handling all the back-and-forth, so I'm no longer stuck in endless email threads trying to line up schedules.
Now Carly reaches out to candidates, shares my real-time availability, lets them pick a slot, then sends a Zoom link and drops it straight into my calendar. She sends reminders to both of us before each call, which has significantly reduced no-shows and last-minute confusion.
On top of scheduling, Carly acts like a full executive assistant, sending me my schedule the night before so I can prepare for each call. It reminds me of the old x.ai assistant, but Carly is noticeably smarter, faster, and better suited to my healthcare recruitment business."
