This Week in DeAI: The Weights Came Due — and the Bill for Owning Them

October 17–23 was the week the open-weights pipeline delivered what it had spent a month promising. Reflection's Beam checkpoints became files anyone can download under Apache 2.0. Meta's Muse Spark Open put roughly 816 billion parameters of multimodal weights behind a Hugging Face release. DeepSeek shipped V4.1-Flash-1017 under MIT and then open-sourced DeepInfer, the inference framework it says runs its own production Flash traffic. Kyutai published CADRE as paper plus code plus weights plus a playable demo. Last week's hub framed this beat as "the gap between the announcement and the artifact." This week the artifacts landed.

They landed with bills attached. A model that activates a few billion parameters per token can still need its entire expert set resident — about 1.5 terabytes in BF16 for Muse Spark Open. A community license can grant you the download and withhold the right to host what you build with it. And in the same seven days, the proxy that sits at the center of most self-hosted stacks — the component holding every provider key a team owns — shipped a credential stealer through PyPI, while the Department of Homeland Security ordered DeepSeek technology out of federal civilian systems in a notice whose third-party clause reaches products built on the open weights.

The week's lesson is not that open weights are unsafe. It is that possession is a workload, not an event: the download is where the deployment, the license review and the supply-chain audit all begin.

Key facts

• Reflection's Beam weights are now downloadable: BF16, FP8 and NVFP4 checkpoints under Apache 2.0, with Transformers, vLLM and SGLang integrations, roughly 1 TB for BF16 and roughly 280 GB for NVFP4 (our follow-up). This converts the October 6 launch from a waitlist into artifacts a builder can pin — the artifact test this hub set two weeks ago. The published 81.6% SWE-Bench Verified (BF16) and 80.7% (NVFP4) figures are attributed to Reflection; a checkpoint's existence is independently observable, a claimed efficiency advantage is not.
• Meta's Muse Spark Open published gated weights for an approximately 816B-parameter, 42B-active multimodal MoE: 256 experts per layer, eight selected per token, a 1,048,576-token context, and text, image, audio and video inputs with text output (our coverage). Hugging Face describes the BF16 checkpoint at about 1.5 TB and reports 18 tokens per second for a calibrated 2-bit llama.cpp quantization on an M3 Ultra with 512 GB, using about 304 GB.
• DeepSeek shipped V4.1-Flash-1017 with repository and weights under MIT, reporting DeepSWE v1.1 rising from 74.2 to 77.0, Terminal-Bench 4.0 from 31.2 to 42.3, and Automation-Bench v1.0.6 from 54.8 to 60.5 (our coverage). The card explicitly states there is no Jinja chat template; the release points at a Python reference encoder and Rust libraries for request conversion and output parsing instead.
• DeepSeek open-sourced DeepInfer under Apache-2.0, the framework it describes as powering large-scale production V4.1-Flash services, with FlashMLA, DeepGEMM and DeepEP kernels, speculative decoding, and batch-invariant deterministic sampling on NVIDIA SM100 and Huawei Ascend 950 (our PULSE coverage). The release covers offline inference only: no KV cache system, no prefill/decode disaggregation, no load balancing.
• Swiss AI's Apertus 1.5 notes document 8B and 70B models at 262,144-token context — and state plainly that the Apache 2.0 weights shipped July 24, 2026 (our coverage). October brought the technical report, intermediate checkpoints and evaluation tooling, not new weights.
• Liquid AI's LFM2.5-24B-A2B lists 24.0B total and 2.45B active parameters, a reported 184 tokens per second on an Apple M5 Max with Q4_K_M quantization at 4K context, and a LiveClaw score of 48.09 against Qwen3.6-35B-A3B at 38.19 — with its own SWE-Bench Verified result of 51.00 behind Qwen's 66.20 in the reported setup (our coverage).
• Recursive's Flint is a 39.8B-total, roughly 2.5B-active Apache-2.0 coding MoE with a 262,144-token context and an SGLang serving kit, reporting 125+ tokens per second on an M4 Pro — all headline scores and speed figures being Recursive's own measurements (our PULSE coverage).
• Kyutai released CADRE as seven autoencoder variants plus world models with code, weights, a live demo and a paper, reporting sub-230 ms action latency at 20 frames per second on a single H100 — Kyutai's own measurement, not yet reproduced (our PULSE coverage).
• LiteLLM 1.107.0 shipped a credential stealer and a RAT in its PyPI wheels and official Docker image, live under three hours on October 21, reading the proxy's own stored-key table plus AWS, GCP and Azure credentials, SSH and GPG keys, and local tool configs. Wiz reports abuse of stolen credentials about 4.5 hours after exfiltration. It is the second LiteLLM PyPI compromise of 2026 (our coverage).
• DHS ordered DeepSeek out of federal civilian IT (91 FR 66346), including third-party products and services developed using DeepSeek implementations, with the Defense Department excluded (our coverage).
• Bloomberg reported a roughly $15 billion DeepSeek round backed by Tencent and CATL, unconfirmed by the company and landing three days after the DHS order (our coverage).
• China's draft export catalogue covers 23 AI technologies while proposing simplified licensing for already-public open-source technology — the supply-side rule that keeps this week's releases exportable for now.

The promissory notes came due

Two weeks ago this hub's organizing idea was that the supply wave was mostly promissory: an API preview that was not weights, a launch post with a waitlist, a rumored release with no date. The week of October 17–23 converted three of those notes into artifacts, and the conversion is worth reading closely because each one resolved a different open question.

Beam answered the one that mattered most. Its October 6 launch was a genuine launch post about a model nobody could run: 501B parameters, 23B active, an efficiency claim calculated from estimated FLOPs, and access by waitlist. The Hugging Face release guide now links BF16, FP8 and NVFP4 checkpoints under Apache 2.0 with runtime integrations and adaptation recipes. That is the difference between a claim and an inventory, and it is exactly the checklist our hub flagged as converting a promise: repo, license, technical report, independent run. Beam now satisfies the first two. What the download does not do is validate the efficiency pitch — the published comparison table is attributed to Reflection, and an independent run on a specified workload is still the missing artifact. Our weights-release follow-up puts it precisely: a checkpoint's existence is independently observable; a claimed efficiency advantage is not.

Muse Spark Open answered a different question — the modality one. The Hugging Face release covers text, image, audio and video inputs with text output and a context window just over a million tokens. It also came with a gating boundary that our coverage was careful about: retrieving the checkpoint README required authorization during review, so our report describes the deployment recipes documented in the public integration guide and declines to characterize the underlying terms as unrestricted. That is the right posture. A gated download with an unverifiable license is a different access tier from an ungated Apache 2.0 release, and the difference should be stated rather than assumed away.

DeepSeek answered the infrastructure question twice in two days. First with weights: V4.1-Flash-1017 under MIT, with agent and coding scores moving up and, notably, no Jinja chat template — the release ships a Python reference encoder and Rust libraries for request conversion, prompt encoding and output parsing. That detail is small on a model card and large in a serving stack: template and parsing behavior is where tokenizer-level bugs and silent prompt drift live, and a vendor that publishes the reference implementation is handing over the thing teams usually reverse-engineer. Then with the framework itself: DeepInfer under Apache-2.0, the serving stack behind its production traffic, at 13.6k GitHub stars within four days. The honest caveat is in the scope — DeepInfer covers offline inference, and a production service still needs a KV cache system, prefill/decode disaggregation and data-parallel load balancing that the release does not include. What shipped is the vendor's kernels and recipes, not a turnkey service.

The week's fourth conversion was a chronology correction rather than a release. Apertus 1.5's October notes are a technical report about models whose Apache 2.0 weights shipped in July. Treating the report as an October weights release would misstate the project's own timeline. What it adds is reproducibility material — training stages, data mixtures, intermediate checkpoints, evaluation tooling — which is the part of openness that lets a researcher explain behavior instead of only call an endpoint.

Delivery is not deployment: the serving bill

The other half of the week is what each download costs to actually run, and there the pattern is consistent: active-parameter counts are a compute description, not a memory budget.

Muse Spark Open is the sharpest example. A 42B-active model sounds like a large workstation deployment; an 816B-total MoE with all experts resident is a 1.5 TB BF16 checkpoint, and the published guidance says the expert set stays in memory. Hugging Face's own quantization result — 18 tokens per second on an M3 Ultra with 512 GB using a calibrated 2-bit llama.cpp build, about 304 GB in use — is a real and useful data point, and it is also a statement about the hardware class required. Our coverage makes the distinction the model card makes easy to miss.

Beam repeats it at a smaller scale: 23B active against 501B total, roughly 280 GB of NVFP4 weights before context and concurrency state, with checkpoint-specific hardware recommendations in the serving guide. FLUX.3 Image Klein narrows the same question to consumer expectations: the retrieved guide's quantified memory table lists 15.3 GiB peak after inference for its NVFP4 RTX6000 setup, and the offloading options it describes are explicitly not benchmarked.

The counterexamples are the ones that genuinely shrink. Liquid AI's LFM2.5-24B-A2B puts 2.45B active parameters to work on device-class hardware, with a reported 184 tokens per second on an M5 Max under Q4_K_M quantization at 4K input — self-reported, with the quantization and context configuration stated, which is the minimum diligence for a speed claim. Recursive's Flint targets the laptop coding case at 39.8B total and about 2.5B active, shipping twelve quantized variants for llama.cpp, LM Studio, Jan and Ollama the day after release. Both are self-measured, both are plausible, and neither has an independent run behind it yet.

One more discipline applies to the local-agents story in particular. Our coverage states it plainly: local inference keeps model requests on your hardware, but web tools, external services, logs and the agent harness can still send or retain data. "Runs locally" is a property of the model call, not of the workflow.

The license is part of the download

The week's releases arrived under at least four different permission sets, which is why a single "open weights" label tells a team nothing about what it may ship.

Fish Audio's Drama 3 is the instructive case. The weights download under the Fish Audio Community License, which sets an annual revenue threshold for covered commercial use, requires separate permission for covered hosted services, and imposes attribution conditions. Being small does not confer hosting rights: a company below the revenue threshold still needs permission to operate a hosted speech API, with defined exceptions for qualifying research demos and certain finished-output uses. The technology works; the product shape decides whether you may use it.

Against that, the same week delivered Apache 2.0 for Beam, Flint and Apertus 1.5, MIT for V4.1-Flash-1017, and an Apache-2.0 serving framework in DeepInfer — while Muse Spark Open shipped behind a gate whose terms our report could not verify without authorization. Our explainer on what open-weight models are is the reference for reading these differences; the open-weight versus open-source comparison covers why a downloadable file and an open-source project are different claims.

The key vault was the soft target

The week's most consequential failure was not a model. It was the plumbing between models.

LiteLLM 1.107.0 published to PyPI and Docker on October 21 carrying two payloads: an infostealer that runs at every Python interpreter start, and a remote access trojan polling a server hourly for new code to execute. The malicious wheels were live for a little over an hour and forty minutes and the affected Docker tags for about two and a half hours. In that window the stealer read the LiteLLM proxy database directly — every row of the stored provider API key table — along with AWS, GCP and Azure credentials, SSH and GPG private keys, and local configurations for developer tools. Wiz reports seeing abuse of the stolen credentials about four and a half hours after exfiltration, including identity calls and model listings consistent with LLMjacking. LiteLLM's own incident report tells anyone who installed in the window to assume compromise and rotate everything the host could reach. It is the second LiteLLM PyPI compromise of 2026, after 1.82.7 and 1.82.8 in March.

The structural point is where the proxy sits. A router like LiteLLM exists because a self-hosting team has many provider keys and one place that should hold them; that design makes the proxy a single point of failure in the strongest sense — one compromised install crosses every provider boundary at once, and the credential set it leaks is exactly the one an attacker needs to bill someone else's account. The same week's DeepInfer release is the mirror image of the same truth: the serving layer is load-bearing infrastructure, and publishing it is how a vendor makes it inspectable. Owning the stack means owning its dependency graph, not only its weights. Our earlier coverage of the self-hosted proxy botnet is the prior data point in the same category.

Procurement policy reached the supply chain, not the weights

If the download is the artifact, the week showed plainly that the rules act on the layers around it.

The DHS order — 91 FR 66346, docket DHS-2026-0628, signed July 24 and published October 20 — excludes DeepSeek and DeepSeek-affiliate products from federal civilian executive branch IT and procurements, and explicitly reaches "third-party products and services developed using DeepSeek implementations." That clause is the one builders should read twice: it plausibly covers US-hosted services whose AI layer runs on DeepSeek models, whoever operates them, while the notice leaves the boundary of "developed using DeepSeek implementations" undefined. Our coverage also records the timeline oddity — the 60-day exception window ran from issuance, which closed around September 22, before the order was public. Scope limits matter just as much: this binds federal civilian buyers including Treasury, State and Justice, excludes the Defense Department, and says nothing about private companies or state governments. A procurement order binds buyers, not weights.

The week made that distinction concrete in two other places. DeepSeek open-sourced its production serving framework under Apache-2.0 — an artifact that is copyable, inspectable and outside the reach of any procurement exclusion — and, per Bloomberg, closed a round of about 100 billion yuan (roughly $15 billion) from investors including Tencent and CATL, with a target that reportedly rose from 50 to 80 to 100 billion yuan along the way and no confirmation from the company. The capital is described as earmarked for data centers and open-source models ahead of a possible listing, which is a bet on the release cadence this beat tracks. Meanwhile China's draft export catalogue proposes simplified licensing for already-public open-source technology — the supply-side rule that keeps the week's releases exportable, for as long as the exemption survives drafting. Our deep-dive on DeepSeek's data handling remains the reference for what the hosted service does with prompts, which is a separate question from the weights.

What else shipped

Two releases in the week deserve their own note because they are about artifacts rather than benchmarks. Kyutai's CADRE shipped as a full set — paper, code, weights, and a playable demo — with causal-diffusion autoencoders trained on 23 public datasets totalling about 76,000 hours, and world models reporting sub-230 ms action latency at 20 frames per second on one H100. Kyutai's framing is the interesting part: typical 8x temporal compression borrowed from text-to-video autoencoders delays every action by at least 400 ms, above the roughly 230 ms threshold where people notice their own movement lagging. The latency and quality numbers are Kyutai's own measurements on one H100; the artifacts are public and therefore checkable.

And Eternal's Dark.ai is the week's reminder that privacy architecture claims need artifacts too. The Q2 FY27 shareholder letter dated October 21 describes a privacy assistant built on fine-tuned frontier open weights on the company's own infrastructure with claimed end-to-end encryption and user-controlled encrypted memory, targeting a global launch within 2026. There is no whitepaper, no security audit, and no disclosure of which base models are used. Every privacy statement is currently a claim. For contrast on what attestable private inference looks like as a documented architecture rather than a promise, our explainer on TEE-based confidential inference covers the hardware-attested path.

On the pricing ledger, the week's notable evergreen was Cerebras Inference Pricing, which priced gpt-oss-120b at $0.35/$0.75 per million tokens on the fastest endpoint it tracks and documented the cache economics alongside it — the rental side of the same decision the release wave feeds. Our cheapest-LLM-API page tracks the field across providers.

What the week changed for builders

• Treat the download as the start of a sizing exercise, not the end of a decision. The week's headline number is 42B active; the number that decides your hardware is 816B total and about 1.5 TB in BF16 (Muse Spark Open), or 501B total and roughly 280 GB in NVFP4 (Beam). Check the serving guide's memory table before the benchmark table.
• Read the license attached to the checkpoint you actually obtained. Apache 2.0 (Beam, Flint, Apertus), MIT (V4.1-Flash-1017), a gated release with unverified terms (Muse Spark Open) and a community license that gates hosting (Drama 3) all shipped in the same seven days.
• Rotate on the assumption, not on the evidence. Anyone who installed LiteLLM 1.107.0 or started its Docker image during the October 21 window should treat every provider key, cloud credential and SSH key reachable from that host as compromised — and should audit which of those credentials permitted billing-adjacent calls in the following hours (incident report).
• Answer the procurement question before a customer asks it. If your product serves government-adjacent buyers and any layer runs on DeepSeek models, the un-defined third-party clause in 91 FR 66346 is now a compliance item, and a substitutable serving path is the mitigation.
• Separate "the weights are open" from "the service is inspectable." The week produced both an Apache-2.0 production serving framework (DeepInfer) and a claimed-encryption assistant with no published architecture (Dark.ai). Only one of those is checkable by a reader.

The week in numbers

• ~816B / 42B — Muse Spark Open's total and active parameters; the BF16 checkpoint is described at about 1.5 TB, and a 2-bit quantization on 512 GB of unified memory runs at 18 tokens per second (Hugging Face).
• 501B / 23B / ~280 GB — Beam's total parameters, active parameters, and NVFP4 weight footprint under Apache 2.0 (Hugging Face).
• 77.0 / 42.3 / 60.5 — DeepSeek V4.1-Flash-1017's reported DeepSWE v1.1, Terminal-Bench 4.0 and Automation-Bench v1.0.6 scores, up from 74.2, 31.2 and 54.8 (model card).
• 13.6k — GitHub stars on DeepInfer within four days of its Apache-2.0 release (DeepSeek).
• 2h41m — the window in which the compromised wheels and Docker tags were live, within which a stealer read the proxy's entire stored-key table (LiteLLM).
• ~4.5h — time from credential exfiltration to observed abuse in Wiz's telemetry (Wiz).
• $500,000 — the annual revenue threshold in Drama 3's community license, which is not by itself sufficient authority to operate a hosted speech service (Fish Audio).
• Under 230 ms — Kyutai's reported CADRE action latency at 20 fps on one H100, against at least 400 ms for typical 8x temporal compression (Kyutai).
• ~100 billion yuan — the reported size of DeepSeek's round, roughly $15 billion, up from an initial 50 billion yuan target and unconfirmed by the company (Bloomberg).
• July 24, 2026 — the date Apertus 1.5's weights actually shipped, per the October notes that describe them (Swiss AI).

The spokes: what each story established

• Reflection Beam's weights release (20 Oct) — the promise converted: Apache 2.0 checkpoints in three precisions with runtime recipes, plus the reminder that a checkpoint's existence verifies nothing about an efficiency claim.
• Meta Muse Spark Open's serving bill (20 Oct) — the memory lesson: 42B active against 816B total, a 1.5 TB BF16 checkpoint, a gated license that public reporting could not verify.
• DeepSeek V4.1-Flash-1017 (20 Oct) — the parsing detail: MIT weights with higher reported agent scores and no Jinja template, shipping a reference encoder and Rust parsing libraries instead.
• DeepSeek's DeepInfer (21 Oct) — the vendor's own serving stack under Apache-2.0, offline inference only, kernels and recipes rather than a turnkey service.
• Apertus 1.5's technical report (20 Oct) — the reproducibility case: July weights, October disclosure, intermediate checkpoints and data mixtures.
• Liquid AI's LFM2.5-24B-A2B (20 Oct) — the on-device tier priced honestly: 2.45B active, a stated quantization and context for the speed claim, and a definition of what local inference does not protect.
• FLUX.3 Image Klein (20 Oct) — the image-model memory test: 15.3 GiB peak on the one quantified configuration, offloading described but unbenchmarked.
• Fish Audio Drama 3 (20 Oct) — the license lesson: editable multi-speaker speech under a community license that separates low revenue from hosting permission.
• Recursive Flint (22 Oct) — the laptop-coder bid: 40B-total MoE with twelve quantized variants a day after release, all headline numbers self-measured.
• Kyutai CADRE (23 Oct) — the full artifact set: paper, code, weights and demo for interactive world models, with latency claims still awaiting third-party reproduction.
• The LiteLLM 1.107.0 compromise (22 Oct) — the supply-chain record: a sub-three-hour window, a stolen provider-key table, and abuse observed within hours.
• The DHS DeepSeek order (21 Oct) — the policy boundary: a procurement exclusion whose third-party clause reaches hosted services built on the weights.
• DeepSeek's reported $15 billion round (23 Oct) — the capital signal: unconfirmed funding aimed at data centers and open-source models, three days after the US order.
• Eternal's Dark.ai (22 Oct) — the claims ledger: privacy architecture asserted in a shareholder letter with no audit, whitepaper or base-model disclosure.
• Cerebras Inference Pricing (20 Oct) — the rental-side anchor: gpt-oss-120b at $0.35/$0.75 per million tokens with cache economics documented.
• The week's daily briefs (20–23 Oct) — the day-by-day record: the release wave, Nemotron 3.5, Mercury 3's throughput claim, Voxtral 3, OpenAI on Google Cloud Model Garden, NVIDIA Confidential Bare Metal, llm-d 1.0, and China's draft export rules.
• Last week's hub (9 Oct) — the promissory-note record this week's downloads answer.
• The Saturday roundup (10 Oct) — the prior week's stories in shorter form.
• What open-weight models are and open-weight versus open-source (pillars) — the licensing and access mechanics that separate this week's releases from one another.
• Self-hosting versus API cost and cheapest LLM API (pillars) — the ownership-versus-rental math the week's memory floors feed directly into.

What to watch

Three things, in order of how load-bearing they are to builders. First, whether Beam's efficiency claim survives an independent run on a specified workload now that a checkpoint exists to test — that is the only way an estimated-FLOPs number becomes a deployment fact. Second, whether the third-party clause in the DHS order gets operational guidance defining "developed using DeepSeek implementations," because the answer decides how much of the US-hosted open-model marketplace has to re-route for government-adjacent customers. Third, whether any of the week's self-measured local-inference claims — Liquid's 184 tokens per second, Recursive's 125+ on an M4 Pro, Kyutai's sub-230 ms latency — get reproduced by someone other than the vendor, since that is what turns a launch post into a specification. On the security side, watch whether credential rotation is treated as a supply-chain discipline rather than an incident chore: the LiteLLM window was under three hours, which is exactly the point — attack windows on the components that hold the keys are now measured in hours, while detection windows are still measured in days.