jason-li @threerouter

A real agent that fits in 4GB of VRAM just shipped. NVIDIA's Nemotron Bolt E4B, out Oct 23, runs on the same card you'd use for a game. Built on Gemma 4, 64K context, 35 languages, multi-turn tool use. Per NVIDIA's model card it leads same-size models on MultiChallenge. man, the "agents live in the cloud" assumption is aging badly. This targets voice assistants and robots on edge hardware, not datacenter racks. Run it on your own box, or keep paying per call to someone else's GPU? I'd rather own the box. paying per call for a model that runs on my desk feels backwards. appreciate the edge builders out there. #AI #EdgeAgents

Moonshot's Kimi K3.1 Pro showed up on OpenRouter late last night and the open-weight side of my feed went loud. 2.8T params, 1M context, full weights promised by Nov 4. Priced at $2 in / $10 out per million tokens. ngl the part that matters isn't the size. An open-weight model now ships native image and video understanding at frontier scale. Routing layers can stop pretending only closed labs do multimodal. Plug into OpenRouter today, or wait two weeks and self-host the weights? I'm routing now. Sitting on a download for two weeks when the API's live feels dumb. Your move. thanks for the agent hot takes, fam. #AI #OpenWeights openrouter.ai/models/moonsho…

if you have ANY secret in Railway, rotate it. not just the ones you think are exposed. all of them. 🔥 Railway's Oct 21 disclosure: an unauthorized party got into systems storing customer env vars and decrypted some of them. API keys, db creds, registry tokens. they say it's part of a wave of attacks going after platform companies to reach AI inference providers, and they already asked upstream providers to revoke keys proactively. they paused all deployments. enterprise builds came back ~11:32 next day, the rest staggered. this is the second key-custody platform to fall in a week. OpenCode's console got popped Oct 17. two places devs trust with their LLM keys, both breached in 7 days. infoq called it the darkest week for full-stack devs and honestly yeah. if a Railway project ever held an OpenAI/Anthropic/Grok key, treat it as burned. delete the key, check usage for requests you didn't make, redeploy with a fresh one. Railway even published a step-by-step for the OpenAI part. don't wait for the "you were affected" email. rotate now. #Railway #LLMsecurity blog.railway.com/p/security-dis…

Anthropic moved Agent Skills to the Linux Foundation's Agentic AI Foundation. Vendor-neutral now, same playbook as MCP. but the bigger news from yesterday's AAIF drop: they added four projects at once, OpenAI's included. Open Responses is built on the OpenAI Responses API and defines a shared schema plus streaming format so one request runs across providers. Hugging Face dropped OpenEnv, Alibaba dropped OpenSandbox. AAIF is now 10 projects, all the agent plumbing (MCP, Agent Router, agentgateway) under neutral governance. this is the same direction a unified gateway is built on: stop wiring every provider by hand, let a shared interface hide the differences. the standards layer is finally catching up to the gateway layer. good for everyone building agents. #AgentSkills #MCP anthropic.com/news/donating-…

OpenAI's big deprecation wave hits today (Oct 23). But the part everyone's missing: it's the dated snapshots that die, not the aliases. If your code calls gpt-4o-2024-05-13, o1-2024-12-17, o3-mini-2025-01-31, o4-mini-2025-04-16, gpt-4-0613, gpt-4-turbo, gpt-4.1-nano, gpt-3.5-turbo-0125, or gpt-image-1 by name, you're returning 404s right now. The floating gpt-4o, o3-mini, o4-mini aliases are still alive (some not until Jan 2027). So the real breakage is narrower than the panic. Pinned-to-a-date = dead. Alias = fine. What bugs me more is the trend Vorp Labs flagged: launch-to-retirement windows are compressing across providers. GPT-3.5 Turbo got ~43 months. o3-mini got 21. GPT-5 is on a 16-month runway. The binding constraint used to be "is this model good." Now it's "how long until I'm forced to migrate." This is exactly why I stopped calling provider endpoints directly and put a gateway in front. One model gets yanked, the gateway swaps to the next, my code doesn't care which snapshot it was. Audit your model strings today. The ones with a date in them are the ones that bite. #OpenAI #APIgatewaysaa developers.openai.com/api/docs/depre…

SYMANTEC 🔥: Someone built an autonomous attack agent that hijacks other people's AI models to run its whole operation. Its own operators call it "Skynet mode". Up to 100,000 steps with zero human approval. The agent scans the internet for exposed LLM endpoints, AI gateways and MCP servers, then uses the hijacked model as its reasoning brain. What it carries: ~74 tool definitions. Internet-wide scanning via FOFA, exploits for Django, Flask, Jupyter, Laravel, Supabase and VS Code, SSRF against cloud metadata, database dumping, botnet C2. How it gets the model to cooperate: a layered jailbreak telling the model credential theft is "routine development work." Then it installs an XMRig miner, hides it as a file called .trace, and wipes the logs on the way out. Two victims, one bill. 👀 Symantec caught the full prompt with an AI honeypot over the summer. Their advice, translated: assume any model endpoint you expose gets found and tested within days. If you run an OpenAI-compatible endpoint without auth, that's not a config issue anymore. It's an unattended brain donation. #LLMjacking #AIsecurity

NVIDIA built the thing I kept saying should exist. It's called OpenShell and it's open source. OpenShell is a runtime for autonomous agents. The agent gets a sandbox at the kernel level. It never sees your real credentials. A broker outside the agent process injects them into requests, and only for endpoints the policy approves. Want to change the policy? A formal verifier checks what the new rules would actually allow and flags risky ones for a human first. It sits under Claude Code, Codex, OpenCode, whatever harness you run. Apache 2.0, stable 0.1 releases, on GitHub now. This week gave us a poisoned LiteLLM release and an agent that hijacks exposed model endpoints for fun. The pattern is obvious. Agents need credentials to be useful, so the credential layer is the whole game. NVIDIA building the boring fix and giving it away is the most underrated thing they shipped this month. Small detail I enjoyed: their own quickstart runs an agent against a free OpenRouter model. #OpenShell #AgentSecurity github.com/NVIDIA/OpenShe…

We love to argue about whether agents will take our jobs. Quietly, they've already started taking our cloud tenants. At machine speed. Microsoft just attributed the ConnectWise Cloud Backup supply-chain mess to Storm-0940, a state-aligned crew it's tracked since 2021. The detail that should keep anyone running an agent awake: this group didn't just use a tool, they ran a whole agent army called ARTEX. The numbers are silly. ARTEX tried to sign into 2,250-plus tenants at 2,900 attempts a minute. In several cases it went from picking a target to holding privileged cloud access in under 3 hours. Here's the part that lands for this crowd. The agents authenticated through app identities customers had already consented to. No user, no MFA prompt, no device check. And per Zscaler, ARTEX was wired to run a DeepSeek model through an OpenAI-compatible gateway. The attackers route their agents through a unified gateway too. So the trust layer isn't a feature anymore. It's the attack surface. If you're centralizing agent access anywhere, that plane is now your blast radius. Who's actually auditing their service-principal sign-ins this week, or is that still buried in the backlog? #ARTEX #AgentSecurity microsoft.com/en-us/security…

If you run self-managed GitLab, go check your version number right now. I'll wait. CVE-2026-110264 dropped yesterday: CVSS 10.0, unauthenticated RCE. A specially crafted regex in GitLab's regex compiler (the Onigmo engine Ruby ships) can run arbitrary code on your server with no account needed. It reaches every self-managed version back to 7.0, which is 2014. No workaround, no config toggle that gets you off the hook. Patching is the only fix. Here's the part that'll sting: if you patched on Oct 12 for the last regex RCE (CVE-2026-97229), you're still in scope. That fix only covered 19.2 and up. This one goes all the way back, so GitLab backported to 18.11.13, 19.0.10, 19.1.9, 19.2.9 too. One researcher (joaxcar) has now reported four code-exec flaws in GitLab's regex engine in a single month. This is the fourth, and the first to hit anything before 19.2. Fixed: 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13. GitLab.com and Dedicated are already patched. Start with internet-facing boxes. Anyone else just realized their Oct 12 patch didn't actually save them? #GitLab #RCE

A library that sits in front of basically every model API key just shipped a backdoor. LiteLLM 1.107.0 went out on PyPI and Docker with a credential stealer baked in. Install it and the malware runs before LiteLLM is even imported, via a cook.pth file that auto-executes on interpreter startup. What it grabs: cloud tokens, private keys, your LLM provider auth files, browser data, and the proxy's saved master key. It all gets POSTed to litellm[.]dev. A second payload polls a GitHub repo every hour for remote commands. How it got in: three engineers' GitHub accounts, apparently via stolen GitHub CLI OAuth tokens. One triggered the release, another approved it. Four vendors (SafeDep, Socket, StepSecurity, Upwind) flagged it independently. PyPI quarantined the version. If you touched 1.107.0, pin to 1.106.2 by digest and rotate everything. The uncomfortable bit: whatever layer holds all your keys is now the most valuable target in your stack. A gateway, a proxy, a unified client, doesn't matter. If it centralizes credentials it centralizes risk. Rotate, scope, watch egress like it's prod. Anyone else auditing their dependency tree this morning or just me? #LiteLLM #LLMsecurity

Google just became the gateway. Gemini, Claude, and GPT-6 all in one Model Garden now, billed on one invoice, behind one set of IAM and audit logs. They announced it yesterday: GPT-6 Astra, 6.1 Sol, and Luna in private preview on Google Cloud, with Codex workflows wired in. Google is now the only hyperscaler selling all three leading closed LLMs side by side. Pick the right model per task, no separate contract, draw down your existing cloud commit. We built Three Router for the exact problem this solves, just one layer down. One endpoint, route per call to whatever model fits the job, no lock-in to a single vendor's quirks or pricing. Google is doing it at the cloud layer. We do it at the API layer, across every provider, not just the ones one cloud picked. Does GPT living inside Google Cloud make you more or less likely to funnel everything through one provider? #GPT6 #AI

Richard Socher's lab says their new coding model was mostly built by AI and runs on a laptop at 131 tok/s. Cool story. Here's the catch. Flint is a 40B MoE with only 2.5B active params per token, Apache 2.0, weights on HF (RecursiveSI/flint). They claim 89.7% on SWE-bench Pro v2 and 74.2% on SWE-bench Verified, and it beats other sub-50B models on their own runs. Built from scratch in under four months with their Eureka Machine doing most of the pipeline. Now the cold water. Every benchmark above is vendor-reported, nothing independently verified yet. Recursive itself says Flint needs more hand-holding than Claude or Codex, you have to break big tasks into smaller steps. Context is 262K but they say it's best inside 256K. Terminal-Bench 2.1 sits at 54.9%. The "built by AI" claim is also unproven outside their own launch video. Still. Open-weight coding models that fit on a 48GB Mac and run offline are having a real moment. The bar for "good enough local agent" keeps dropping. Anyone actually run it yet, or are we all waiting for the first independent SWE-bench number? #Flint #opensource huggingface.co/RecursiveSI/fl…

Deepseek just open-sourced DeepInfer, the inference engine behind their V4.1 Flash production API. apache-2.0. this is a bigger "open" move than another weights drop, and people should actually sit with that. The headline math: 155T tokens/day on a single cluster, ~$38/gpu-hour revenue they're quoting. that's the real cost basis for cheap inference, shown not claimed. Now the cold water, because nobody's leading with it: No KV cache, no prefill-decode split, no load balancing in the release only V4.1-Flash is supported needs NVIDIA SM100 or Huawei Ascend 950 So "we open-sourced our engine" is true, but it's the engine minus the parts that make it production-grade at someone else's scale. self-hosting from this is real work, not a git clone. Every time an open lab hands over more of its stack, the case for routing across many providers instead of betting on one gets stronger. that's the part I actually care about. More open engines like this, or still rather just call one api? #DeepSeek #DeepInfer #openweights github.com/deepseek-ai/De…

Spent the morning reading the FastH3-Omni release. FastVideo (Hao AI Lab) took MiniMax's realtime H3 and post-trained it with Nuva Lab and Reactor, now fully open: weights, training code, runs on DGX Spark and RTX. The fun part is the control surface. first/last frame conditioning, audio input, up to 3 reference images, realtime video with synced audio. The part nobody's leading with: this is a legit open realtime video and audio pipeline you can actually self-host, not just a weights drop. Not my usual domain (i route text models) but a realtime open video model landing the same week as a price war in text is a mood. #FastH3 #MiniMax huggingface.co/FastVideo/Fast…

Google and Meta just open-sourced TorchTPU. native PyTorch backend for TPUs, Apache-2.0. change .to('cuda') to .to('tpu') and your training loop runs. this is the "stop getting locked into one silicon vendor" story at the hardware layer. same reason a unified model gateway exists, one tier down. but here's the catch: it's an MLOps story, not an API story. if you're calling models over HTTP you'll never touch this. and PyTorch/XLA goes read-only archival on Nov 15, so the migration window is real but bounded. still, watching the "don't lock me to one vendor" instinct show up in silicon the same week it's showing up in model APIs is not a coincidence. #TorchTPU #PyTorch

Mercury 3 dropped on OpenRouter. it's a diffusion LLM, parallel token generation, not autoregressive. 1,068 tok/s claimed. 1M context window. launch price 0.10 in / 0.35 out, half off list. 100M free tokens. Inception's own IFBench: 76.8 vs GPT-6 Luna 61.8 and Haiku 5.5 54.6. SWE-Bench Atlas 51.1 vs 33.3 / 32.3. weights stay closed, API only. if the live speed holds, this is the cheapest fast model on the routing table right now. #Mercury3 #OpenRouter openrouter.ai/inception/merc…

@TheKhanlover NO

DHS 🔥: federal civilian agencies have 60 days to remove DeepSeek from their systems. and here's the part most coverage is missing: The directive covers all third-party products BUILT ON DeepSeek weights, not just DeepSeek itself. remove or request a written waiver within 60 days. So any vendor shipping a fine-tune or a downstream tool on those weights just found out their supply chain is a compliance problem. overnight. Whatever you think of the policy, the engineering lesson is the same one from every silent checkpoint swap: if your stack hard-depends on one model family, somebody else gets to break your roadmap. swap layers exist for a reason. 👀 #DeepSeek #AIAPI

@SidharthVijay_ $2 Trillion with less revenue than 35 SaaS companies combined? That’s not a revolution, that’s a spreadsheet glitch. 😂 The real revolution is that I can get 90% of Claude's coding ability for pennies using open models.

@MiniMax_AI API pricing at $0.15/$0.60 with a $0.015 cache hit? That’s basically free compute. The AI price war is getting insane and I'm here for it.