DeAI Daily Brief — 26 October 2026

Today in DeAI: MiniMax shipped the M3.1 Flash open weights under a community license, Mistral Large 4's weights head into release week with no license announced, Anthropic's enterprise retention rollout advanced, and llama.cpp patched a publicly exploited CVE.

MiniMax M3.1 Flash open weights land on Hugging Face

MiniMax delivered its promised October 23 weights drop: a 428B-total-parameter MoE with about 23B active per token, downloadable ungated and quantized by community maintainers within hours. The license carries commercial-use conditions rather than an Apache 2.0 grant. Why it matters: the release makes the hosted endpoint's reported 93% hallucination rate independently testable on self-hosted weights for the first time. ([Hugging Face] (https://huggingface.co/MiniMaxAI/MiniMax-M3.1-Flash)) — our full coverage

Mistral Large 4 weights due this week, license still unpublished

Mistral's own announcement commits only to "weights by the end of the month"; the Hugging Face repo lists an ETA of October 31 and secondary reporting says October 27. The confirmed shape: roughly 1T total parameters with 49B–52B active, 1M context, trained in Europe. Why it matters: Apache 2.0 versus a conditional community license is the whole story for self-hosters — it decides whether a trillion-parameter model is genuinely servable by anyone. ([Mistral AI] (https://mistral.ai/news/mistral-large-4/)) — our preview coverage

Anthropic's EFS customer-held retention rollout advances

Anthropic's Enterprise Frontier Safeguards, announced September 2, are in phased rollout with broad availability targeted for this fall: safety-monitoring data lands in the customer's own S3, Azure Blob, or GCS under customer keys, and AWS reportedly extends zero-data-retention coverage for Claude Fable 5/5.1 through December 2026. Anthropic retains read rights into customer-held stores, so this is not true zero retention. Why it matters: treat the December 2026 ZDR window as a deadline — after it expires, the retention calculus changes again. ([Anthropic] (https://www.anthropic.com/news/enterprise-frontier-safeguards))

llama.cpp patches a publicly exploited CVE in Pocket-TTS

CVE-2026-116096 is a heap out-of-bounds write triggered by a manipulated mmproj argument; the exploit is public, local access is required, and builds from b11796 onward trip an assertion on malicious input. The by-construction fix remains an open pull request. Why it matters: anyone running llama.cpp behind a multi-tenant or agent-facing surface should update now, and note that "updated" and "fixed" are not yet the same thing here. ([NVD] (https://nvd.nist.gov/vuln/detail/cve-2026-116096))

Nanbeige4.3-33B ships dense Apache 2.0 weights with a day-one GGUF ladder

Nanbeige LLM Lab released a dense 33B coder under Apache 2.0 with 512K context and tool calling, plus community quants from 35.2GB down to 13.7GB. Its Terminal-Bench and DeepSWE numbers are self-reported. Why it matters: Apache 2.0 plus a same-week quant ladder makes this one of the few new agentic coders a self-hoster can run on a single 32GB card without license anxiety. ([Hugging Face] (https://huggingface.co/Nanbeige/Nanbeige4.3-33B))

Watching tomorrow

The Mistral Large 4 weights — secondary reporting points at October 27, the HF repo at October 31, and the license terms decide whether this month's conditional-license pattern holds.