AI Brief, 20 October 2026: two counts of the same stealth run

MiniMax rolled out MiniMax M3.1 Flash on 19 October and used the launch to answer a question that had been open on Hacker News since late September: the anonymous model listed as Space Bunny Alpha, which appeared on OpenRouter around 23 September with no stated provider, was an early version of it. The announcement says Space Bunny "processed more than 200 trillion tokens while operating anonymously".

That number is worth sitting with, because the company that hosted the run publishes its own. OpenRouter's rankings list Space Bunny Alpha second across all models at 56.7 trillion tokens, behind DeepSeek V4.1 Flash at 124 trillion. The two are not strictly contradictory: OpenRouter counts only its own traffic over its own ranking window, while MiniMax may count its direct API, its Code product and any other router. But the gap is a factor of about 3.5, MiniMax's figure is unaudited, and the only count visible from outside the company is the smaller one. Inference volume is now a marketing number, and this is the first case where the claim and a host's public tally can be set side by side.

What shipped is narrower than the headline suggests. M3.1 Flash is available through MiniMax's API, its M Plan subscription and MiniMax Code; the post states plainly that "model weights will be released later", and the MiniMaxAI organisation on Hugging Face carries 21 repositories, none of them M3.1, the newest dating from 7 August. So this is an announcement with a working API and no artifact, from a company whose previous M-series and H-series checkpoints did ship weights. Press coverage has named 23 October; that date appears nowhere in MiniMax's own post, so treat it as provisional.

The pricing is the part that lands immediately: $0.15 per million input tokens and $0.60 per million output, with cached input at $0.015. Those are, to the cent, the figures DeepSeek's V4.1-Flash-1017 carries, covered here on the 18th. Two Chinese labs are now advertising the same number for their agentic workhorse, 48 hours apart. On OpenRouter, though, the only M3.1 Flash endpoint is a free one, listed at 03:12 UTC on 19 October with no metered variant alongside it, so the advertised price is not yet purchasable through the largest router.

Separately, and almost unnoticed, MemTensor uploaded weights for two models at 22:06 UTC on 19 October whose central claim is that a conversation's state does not have to grow as the conversation does.

• MiniMax M3.1 Flash launched 19 October: API, M Plan and MiniMax Code only, weights deferred.
• Artificial Analysis measured it at 42.71 on Intelligence Index v4.3.2, 4th of 173 models.
• MiniMax says the stealth run processed 200T+ tokens; OpenRouter's public table says 56.7T.
• $0.15/$0.60 per million tokens matches DeepSeek's newest Flash exactly; OpenRouter lists only a free endpoint.
• MemT-1.0-Nano (Apache-2.0) and MemT-1.0-Flash (MIT) keep a fixed-size memory state, claimed at 66× less storage than a full KV cache at 128K.
• The OpenCode incident was a breach of its hosted Console, not of the open-source client, and it drained users' own provider credit.

MiniMax M3.1 Flash: measured fourth, and uneven underneath #

Artificial Analysis scored the model on 19 October at 42.7057 on Intelligence Index v4.3.2, flagged in its own data as measured rather than estimated, placing it fourth of 173 models. For a model priced at $0.15 and $0.60, that is the substantive claim of the launch, and it is not MiniMax's own number.

The composite hides a wide spread. Seven of the index's ten evaluations are scored on a common percentage scale, and on those M3.1 Flash lands anywhere from the low twenties to the high seventies.

That spread matters because of what the launch post emphasises. MiniMax leads on agentic work and coding, reporting 73.7% on DeepSWE v1.1, 76.2 on BankerToolBench, 61.7 on OSWorld V2, 29.6 on Agents' Last Exam and 82% on CyberGym. Every one of those is self-reported, and the post's benchmark charts are rasterised images whose plotted values appear nowhere as text. Meanwhile the agent benchmark AA runs itself, Terminal-Bench 4.0, comes back at 25.8. These are different harnesses testing different things, so one does not refute the other. But the only independently measured agentic figure is the low one, and the two cannot be reconciled from published material.

The efficiency claims are checkable in principle: "200+ TPS" output with a "170+ TPS" median, three times faster online inference, and 70% lower usage cost on agentic tasks, attributed to "more aggressive sparsity" with no architecture detail. AA's run reports 120 output tokens per second against a 118 median across the models it tracks, and $0.2201 per task over 78,612 output tokens, 54,668 of them reasoning. A model spending 70% of its output budget thinking has a different cost profile than a flat per-token price suggests, the same arithmetic this brief put to DeepSeek on the 18th and which nobody has published for either model.

MemT-1.0: a conversation state that stops growing #

The more interesting architecture of the day came from an organisation on nobody's watch list. MemTensor, a Chinese group whose earlier work is the MemOS memory system, pushed weights for MemT-1.0-Nano and MemT-1.0-Flash at 22:06 UTC on 19 October. Nano is Apache-2.0, built on Qwen3.6-35B-A3B at 36B total and 3B active parameters; Flash is MIT, built on DeepSeek-V4-Flash at 288B and 17B active. Both add 451M and 3.61B trainable memory parameters respectively, trained over 34B tokens.

The mechanism is a Native Memory Block running alongside each layer's ordinary attention. It holds a multi-channel memory matrix that evolves across turns, plus trainable query, key and value projections and erase, write, forget and output gates. During generation, memory attention reads the current state, normalises and gates the readout, and adds it to the backbone attention output. At the end of a turn, a gated delta update writes the turn back into the state, and the plaintext of that turn is discarded.

The storage argument is the whole point, and it is worth doing the arithmetic rather than accepting the headline. A standard KV cache grows linearly with history. For $n$ tokens, $L$ layers, $h_{kv}$ key-value heads of dimension $d_h$ , at $b$ bytes per value:

$$M_{\mathrm{KV}}(n)=2nL{h}_{kv}{d}_{h}b$$

The factor 2 is keys and values. MemT's state, by contrast, is a fixed matrix: Nano's dynamic memory state is 10M values, Flash's 336M, and neither depends on $n$ at all. In bfloat16, Nano's state is therefore about 20 MB, permanently.

The card claims roughly 66× less storage than a full KV cache at 128K history. Take that ratio at its word and it pins down the comparison: $66\times 20\mathrm{MB}\approx \mathrm{1,320}$ MB of KV cache at $n=\mathrm{131,072}$ , which is about 10.1 KB per token. The same ratio then says where the trade reverses. Setting $M_{\mathrm{KV}}(n)=20$ MB gives

$$n^{\ast }=\frac{\mathrm{131,072}}{66}\approx \mathrm{1,990}\text{tokens}$$

So below roughly two thousand tokens of history, a 20 MB fixed state costs more to keep than simply caching the conversation, and the advantage grows linearly after that: about 16× at 32K, 66× at 128K, 132× at 256K. This is a long-session technique, not a general compression win, and the card does not say so.

Six lines show the mechanism better than prose does. The second call answers from state, with the first turn's text gone from the context:

session = model.create_session(tokenizer)
session.chat("My kitten Memmy is three months old.", enable_memory=True)
session.save_state("memmy.safetensors")              # state, not transcript

restored = model.create_session(tokenizer, state="memmy.safetensors")
print(len(restored.messages))                        # 0 — no plaintext history
print(restored.chat("How old is my kitten?"))         # "3 months old"

The caveats come from the card itself, which is more candid than most. Across 11 memory benchmarks the two models rank first and second among evaluated parametric-memory methods only, and the card concedes that "strong textual-memory systems remain ahead overall, particularly on long histories that require detailed evidence retrieval". Retrieval over a transcript still wins the thing this is built for. The supporting figures are images with no values in text, and all are MemTensor's own.

OpenCode: the console was breached, not the client #

This brief asked on the 18th whether OpenCode would publish a postmortem naming the legacy system behind its incident and defining the "large-scale distillation attack" it blamed. Two days on, there is still no advisory of any kind: nothing on the project's site, no GitHub security advisory, no npm advisory, and no CVE. The company's disclosures have run through emails to affected users and posts on X. What has arrived instead is TechCrunch's account at 19:28 UTC on 19 October, and a scope figure.

The correction worth making first is what was actually breached. The key rotation reported here on the 18th was day two of an intrusion that began on the night of Friday 16 October, and the system entered was the hosted OpenCode Console, not the open-source client. Co-founder Dax Raad has said the problem is the Console rather than OpenCode itself. The package registry agrees: the newest opencode-ai release is 1.19.3, published 16 October at 12:32 UTC, with nothing published since and no versions withdrawn. No client version is implicated, and there is no release to upgrade to.

What users lost was provider credit. OpenCode puts the exposure at 1.4% of Console users, its own figure with no absolute count attached, and emailed them on the morning of 17 October under the subject "Action Required: Potential provider key breach". The dollar amounts in circulation are user self-reports rather than company-confirmed: about $281 on OpenAI plus $168 on Anthropic in one account, roughly $1,700 in another. OpenCode has not confirmed that any key was copied or used, has disclosed no entry vector or dwell time, and has published no indicator of compromise, so there is nothing a user can grep for locally.

Two operational details generalise past this vendor. Deleting a key from a console does not revoke it; revocation happens at the provider that issued it. And a spend cap set inside a gateway cannot limit usage that flows outside it. So the remediation is entirely provider-side: rotate each key where it was issued, audit billing back to 16 October, and set limits at the provider rather than in the tool.

Also notable #

• Inception launched Mercury 3 on 19 October, a diffusion language model claiming 1,068 tokens per second "on NVIDIA GPUs" at a 1M context, API-only with closed weights. The hardware, batch size and whether the figure is peak or median are all unstated, and Artificial Analysis has not evaluated it. The pricing table repays a careful read: Mercury 3 is shown at $0.10/$0.35 per million against $0.10/$0.50 for both comparators, but that is a launch discount of 50% with no stated end date. At its regular $0.20/$0.70 it is the more expensive model on output, and twice the price on input, against the two it is benchmarked on.
• Nvidia released open models for running agents in enterprises and on PCs on 19 October, and Amazon published TorchNeuron, a developer tool aimed at making Trainium a less painful target than CUDA-only tooling allows. Both are vendor announcements; neither carries independent numbers yet.
• A solo developer trained the AI writing tics out of Qwen3-4B with a rank-16 LoRA on an M2 MacBook Air, one to three hours per round, and published the result. On 40 held-out prompts a regex-based "slop score" fell from 121 to 12.5 per 1,000 words and em dashes from 20.5 to zero, with 30 of 30 factual questions still correct. The honest part is the failure: an intermediate version scoring better still invented a university study and joined clauses with ", which" at 28 times the base rate.
• transformers v5.20.2, released 17:45 UTC on 19 October, fixes zero expert gradients in bfloat16 under expert parallelism when ep_size < fsdp_size. Anyone who fine-tuned a mixture-of-experts model in that configuration was silently training no experts at all.
• Unsloth now runs DeepSeek-V4.1-Flash-1017 in about 125 GB at 1-bit, with the engram tables this brief described on the 18th held on SSD rather than in memory.
• SGLang v0.5.22 raised its minimum Python to 3.11, a breaking change for anyone pinned lower, and added MI350X/MI355X support.
• Two German courts have held Google liable for statements made by its AI Overviews, which puts generated summaries inside existing publisher liability rather than outside it.
• A negative reproduction worth reading: arXiv 2610.26666 nests shared-operator recursion in the HRM and TRM style on ARC-AGI-1 and finds no consistent gain, with exact-solve rates near zero on a modest GPU budget.

What to watch #

• Whether MiniMax ships the M3.1 Flash weights, and on what date. The post commits to "later" and press reports say 23 October. Its own M-series precedent is for weights to follow; the H-series and M3 checkpoints are on Hugging Face and M3.1 is not.
• Whether anyone reconciles 200 trillion with 56.7 trillion. One number is the vendor's, one is the host's, and a sentence from either party naming the surfaces and the window each covers would settle it.
• Whether MemT's 66× figure survives a measurement on stated hardware. The weights are Apache-2.0 and MIT, the loading code is in the card, and KV-cache bytes at a fixed context length are about as checkable as a claim gets.
• Whether Mercury 3's speed claim gets measured, and what it costs when the discount ends. The 2025 Mercury 1 paper cited an independently measured 1,109 tokens per second and named the hardware; this launch names neither, and the comparison that makes it look cheap expires on an unstated date.
• Whether OpenCode publishes a postmortem, and whether any decision-model vendor publishes a fail-open rate. The first was asked here on the 18th and the entry vector is still undisclosed; the second has been asked every day since 10 October, now eleven, with no vendor answer.