AI Brief, 23 October 2026: the conversions that beat the weights to publication

MiniMax published the weights for M3.1 Flash at 2026-10-23T03:37:20Z, under an hour before this edition. The repository carries exactly one commit, titled "Init MiniMaxAI/MiniMax-M3.1-Flash", holding 48 shards across 72 files. This brief flagged the absent weights on the 20th, 21st and 22nd of October against a press-reported 23 October date, and that date turned out to be right almost to the hour.

The odd part is what was already there. A third party had published converted weights from the same model 22 hours and 55 minutes before MiniMax published the originals, and a second had posted a 4-bit conversion an hour and fifty minutes before. Whatever the explanation, the derivative copies reached the public before the source did.

Two other developments stand up. Anthropic's Frontier Red Team published roughly 180 million lines of machine-checked Rocq proof about compiled binaries of open-source C libraries on 22 October, with a subset released. And agent containment stopped being a niche concern and became the argument of the week, from four unrelated directions inside twenty-four hours.

• M3.1 Flash: 428B total, 23B active, published quantised only, and on its own scorecard it leads the model it is positioned against on two of six shared rows.
• Anthropic's proofs: 239 entry points claimed, 60 released; the public statement corpus is 0.68% proved.
• Containment: NVIDIA's OpenShell took the Hacker News front page with no release behind it, Google shipped per-agent micro-VMs, Symantec documented an agent running 100,000 autonomous attack steps on someone else's inference budget, and US banks started locking agents out.
• Outside the labs: a 360M-parameter model trained to impersonate a terminal, on 75 GPU-hours.

A 428B flagship that ships only quantised #

MiniMaxAI/MiniMax-M3.1-Flash is a natively multimodal mixture-of-experts model with about 428 billion total parameters and 23 billion activated per token, a context window of up to 1,000,000 tokens, text, image and video input and text output. Its card calls it "a native multimodal mixture-of-experts model for coding, agentic workflows, computer use, and cybersecurity" and claims "a generational leap in agentic tasks, coding, and cybersecurity". The licence is neither MIT nor Apache 2.0 but a bespoke minimax-community licence, and the card does not summarise its terms.

The structurally interesting part is not the size. It is that there is no unquantised checkpoint. The card states that "the routed MoE experts and the attention paths are quantized during training", and the only weights published are mxfp8. The arithmetic shows what that means in practice. Let $B$ be the repository's total weight storage in bytes and $P$ the parameter count; the average number of bits carried per parameter is

$$\overline{b}=\frac{8B}{P}=\frac{8\times \mathrm{252,429,151,663}}{4.28\times {10}^{11}}\approx 4.72$$

A straight 8-bit checkpoint of 428B parameters would need about 428 GB and a straight 4-bit one about 214 GB. At 252.4 GB the published repository sits close to the 4-bit end, consistent with most expert weights being stored packed rather than one parameter per byte. The practical consequence is that every third-party build re-quantises weights that were already quantised in training, and the card says plainly that "third-party quantizations may differ" from its own figures. There is no reference checkpoint against which to measure that drift.

Which brings back the ordering. RadixArk/Minimax-M3.1-Flash-Dflash2 committed "MiniMax M3.1 Flash DFlash2 weights, config, and model card" at 2026-10-22T04:42:47Z, and mlx-community/MiniMax-M3.1-Flash-Text-4bit uploaded a converted checkpoint at 2026-10-23T01:46:52Z, both before MiniMax's own single commit at 03:37:20Z. Early access, a brief earlier publication since withdrawn, and a leak would all produce this pattern, and nothing public distinguishes them. What is checkable is the sequence.

It is also a reminder that a Hugging Face repository's createdAt is when the record was made, not when anything was published: this repository's createdAt reads 2026-10-17T06:37:50Z, six days before its only commit. The commit log is what dates a drop.

REPO=MiniMaxAI/MiniMax-M3.1-Flash
curl -s "https://huggingface.co/api/models/$REPO" | python3 -c 'import sys,json;print("createdAt",json.load(sys.stdin)["createdAt"])'
curl -s "https://huggingface.co/api/models/$REPO/commits/main" | python3 -c 'import sys,json;[print(c["date"],c["title"]) for c in json.load(sys.stdin)]'
# createdAt 2026-10-17T06:37:50.000Z
# 2026-10-23T03:37:20.000Z Init MiniMaxAI/MiniMax-M3.1-Flash

On the numbers, "generational leap" is doing more work than the table supports. MiniMax benchmarks M3.1 Flash against DeepSeek V4.1 Flash-1017, the MIT-licensed model published six days earlier and covered here on the 18th. Six rows carry a figure for both. M3.1 Flash leads on two.

Every figure there is MiniMax's own, run in-house on harnesses including Claude Code, OpenCode and Codex; three exceptions are marked, with the GDP.pdf row taken from Artificial Analysis and CharXiv judged by GPT-5.5. The release also swaps speculative decoding schemes, replacing "the earlier EAGLE-like MTP approach" with a draft head called DSpark.

180 million lines of proof, and the quarter of it that is public #

Anthropic's Frontier Red Team, working with Theorem, compiled developer-written fuzz tests from Google's OSS-Fuzz to RISC-V executables, turned each into a specification stating that the binary never crashes on any input under 64 MB, had Claude write proofs of those specifications, and checked them with the Rocq proof assistant. The post calls it "the first large-scale effort to use AI to apply formal verification to production software at the assembly code level". The headline figures: 239 entry points across 123 open-source libraries, about 180 million lines of Rocq, a typical proof around 600,000 lines for binaries with a median of 18,000 RISC-V instructions, and "hundreds of bugs" surfaced along the way, including a rediscovery of CVE-2026-56132 in libexpat.

This is a real result, and the artifacts being public is what makes the gap between claim and release checkable. The released repository, theorem-labs/oss-verify-proofs, states that 60 entry points in 25 libraries have proofs, checked with Rocq 9.2.0: a quarter of the entry points and a fifth of the libraries in the headline. Anthropic says why, and the reason is sound, that proofs which might reveal unpatched bugs were withheld. But the repository also ships a much larger corpus of unproved statements, and its own status line is the number worth keeping: 20,164 statements, of which 138 are proved, 229 blocked by the model, and 19,797 open.

Both readings are fair and they answer different questions: 239 entry points describes what the effort achieved internally, 138 of 20,164 describes what an outsider can check today.

The limitation that matters most for anyone reading this as shipped safety is in the post itself: the proofs cover static musl binaries compiled for RISC-V, assuming a single thread, a fixed memory budget and Linux, while most production software runs dynamically linked against glibc on x86 or ARM. Anthropic states it directly: "'Formally verified' does not mean 'bug-free.'" The trusted base includes the Rocq checker, the RISC-V and Linux process models, and the compiler Rocq depends on. The repository is blunter, warning that its Linux process model "is best effort and not complete". A proof is exactly as good as the machine it assumes, and the machine assumed here is not the one most code runs on.

On cost, the post reports that Opus 5.5 proved half of 36 small verification tasks with about 40% fewer tokens than Opus 5, and that sharing proofs across agents in one workspace cut token use by 17%. Proof efforts still run to hundreds of millions of tokens, which it names as the key limitation.

The containment layer became the argument #

Four unconnected things landed in the same twenty-four hours, and together they are the most consequential story of the window for anyone running agents.

NVIDIA's OpenShell took the Hacker News front page on 22 October at 338 points and 178 comments. The traction reads like a launch and is not one: the repository was created on 24 February 2026, has 17,936 stars, and its most recent tagged release, v0.1.5, went out on 20 October. The submitter said they had just come back from GTC Europe, where "a significant part of the demos used that".

What the thread argued about is the useful part. OpenShell's pitch is that it "instruments the kernel to enforce policy on every file access, system call, and network connection at runtime", and that "agents never see real credentials; OpenShell adds them only to requests bound for approved endpoints". The recurring objection was that an endpoint allowlist is not an exfiltration control: one commenter noted that a compromised agent can leak slowly to an approved host, another that even a public read counter is a channel. Nobody disputed the implementation; they disputed whether the shape of the control matches the threat.

The same day, Google announced Agent Compute Engine, giving each agent a hardware-isolated micro-VM with idle auto-pause, and open-sourced Agent Substrate, the Kubernetes runtime beneath it, claiming roughly ten times the agent density per server. The figure is Google's and the product is pre-preview.

Then the reason any of it matters. Symantec documented an offensive agent that hijacks unauthenticated, publicly exposed language-model endpoints and spends the victim's own inference budget running up to 100,000 autonomous steps, attacking servers and installing cryptominers. The containment question is no longer only about an agent misbehaving on your hardware; it is about an agent funded by someone else's unsecured endpoint.

The credential half moved the same day in both directions. Several major US banks began locking out agents that log in with customer credentials, Morgan Stanley blocking agent logins outright and others moving agents to read-only. 1Password shipped a way for agents to authenticate on a user's behalf without the agent being able to read the secret, structurally the same design OpenShell describes, arriving as a product on the day the banks made it a requirement.

Also notable #

• A 360M-parameter model trained to impersonate a terminal. Simon Edwardsson published WorldTUI on 21 October: Qwen2.5-Coder-0.5B with its vocabulary cut to 333 tokens, trained on 336,000 synthetic episodes recorded from real programs in Docker containers, for 75 GPU-hours on a single RTX 4090. It predicts how a terminal screen changes after each keypress with no shell behind it, runs vim and tmux, and at int4 is a 208 MB in-browser download at roughly 38 ms per keypress. It took 514 points on Hacker News. One caveat about the headline table: it scores memory as 9/13 readbacks against 2/13 and 3/13 for prompted baselines, while the post describes the memory test as 32 worlds "giving 64 readbacks overall" and scores its own distilled student 64/64. The denominators do not match and the post does not reconcile them. Weights are not released yet, so none of this is reproducible, and the author calls the result "a pretty weak world model".
• OpenAI's Decisions API reached general availability on 22 October, adding voice and visual modalities and geographically targeted inference, with latency reported at 100–180 ms against 1–3 seconds. This brief has asked every day since 10 October, now fourteen, whether any vendor in the decision-model class will publish a fail-open rate. General availability did not come with one.
• Anthropic donated the Agent Skills standard to the Agentic AI Foundation on 22 October, transferring the name, logo, GitHub organisation and agentskills.io domain to the Linux Foundation body, with maintainers from Anthropic, Google and OpenAI now serving as individuals. Anthropic says more than 70 platforms have integrated it.
• Carbon-X, a 14.8B DNA-and-English model from Hugging Face Bio with Zhongguancun Academy and the Telethon Institute of Genetics and Medicine, was published on 21 October under Apache 2.0: a Qwen3-14B mid-trained on 302B tokens, about 55% raw DNA in 6-mer tokens. Its card reports a 66.7% average against 67.5% for GPT-6.1 Sol "at about 1/1,800 of the inference cost per problem". All figures are the authors' own, two of the five benchmarks are theirs, and the card states the model "has not been clinically validated".
• Exploitation of PHP2Shell predates its disclosure. AWS reported on 21 October, a day before yesterday's brief led on those flaws, that its honeypot network saw an exploitation attempt on 17 October, four days before the embargo lifted at 14:00 UTC on the 21st. AWS says it "remains unclear how the actor acquired exploit information prior to disclosure". This partly answers yesterday's question about the capability claim: the pre-disclosure activity is documented, the model's role in it is not.
• No leaderboard moved. SWE-bench Verified's newest entry is still dated 26 February, the Open LLM Leaderboard space has not changed since May, and LiveCodeBench's published results file has not been rebuilt since August 2025, which makes it an abandoned board rather than a quiet one. LMArena is the exception that cannot be checked at all: its standings are no longer served through any public route, and the Hugging Face mirror is eight months stale, so that board is unverified rather than unchanged.

What to watch #

• Whether MiniMax explains the ordering, or publishes an unquantised checkpoint. Converted weights appeared almost a day before the originals, and every number on the card describes weights quantised during training. A BF16 reference would make the table reproducible; without one, the published figures cannot be separated from the quantisation, and third-party drift has no baseline.
• Whether the proved count in oss-verify-proofs moves. 138 of 20,164 is a public counter on a public repository, which makes it the cleanest available measure of whether model-written formal verification scales or plateaus. The figure to want is a proof for a library whose binary runs dynamically linked on x86.
• Whether WorldTUI's weights land, and whether the 9/13 readback figure survives them. The comparison denominator does not match the test the same post describes, and that is settled either by the author reconciling it or by anyone re-running the memory test once the checkpoint is out.
• Whether any decision-model vendor publishes a fail-open rate. Asked here daily since 10 October, now fourteen days, and OpenAI's Decisions API reached general availability inside this window without one. Voxtral 3 weights are also still absent, flagged on the 21st and 22nd.