This Week in DeAI: The Weights Landed, and the Clause Came With Them

November 2–8 was the week the weights landed. Moonshot AI promised Kimi K3.1 Pro's full weights by November 4, missed its own deadline by a full news cycle, and then delivered — verified live and ungated on Hugging Face as of Friday morning: 2.8 trillion total parameters, 104 billion active per token, a 1,048,576-token context, 96 safetensors shards, no gate. One of the strongest API-only models of the cycle is now genuinely self-hostable hardware math.

But the release did not land alone. It landed with a license file that puts a dollar figure on the permission-slip pattern this publication has tracked for three straight weeks: model-as-a-service operators above $20 million in aggregate annual revenue must sign a separate agreement with Moonshot before serving a single token. The clause is the week's thesis in miniature. The download is free. The right to sell access to the download is now, increasingly, a threshold — sometimes a negotiation, sometimes a branding obligation, sometimes both.

Around that spine, the week split into three currents. The serving economy cracked on both sides at once: Together AI claimed its agent-driven compiler lifts open-model serving throughput up to 2.6×, while a circulating analysis argued the opposite end of the stack — commodity H200 hosting of DeepSeek V4.1 Flash — cannot cover rent at any utilization level. The private-inference layer professionalized: OpenAI quietly listed a Private Inference API preview built on confidential computing, and Cohere's Model Vault documentation confirmed nine open-model families running with zero data retention on by default. And the security undercurrent kept rising: an open-weight model turned published Firefox fixes into working exploits at about $1,000 per compromise, and a tampered Claude Code extension with an SSH backdoor sat in Cursor's marketplace for eleven hours.

The week's organizing fact: open weights won the distribution war and lost the pricing-power argument at the same time — the models are free to own, the serving is where the money and the permission live, and every layer of the stack spent this week negotiating where that line sits.

Last week's hub framed October 24–30 as the moment every weight shipped with a permission slip — Mistral's hosted-API carve-out, MiniMax's community conditions, Kimi's license-free promise. This week, the pattern got a number, a deadline, and a delivery.

Key facts

• The moonshotai/Kimi-K3.1-Pro repository is ungated on Hugging Face, with 112 files including 96 safetensors shards, roughly 11.7k downloads and 944 likes at DeAI's November 6 check (our full coverage).
• The model card lists 2.8T total parameters, 104B activated per token, 93 layers, 896 experts (16 selected plus 2 shared), and a 1,048,576-token context window, with weights in MXFP4 and activations in MXFP8 under quantization-aware training.
• The Kimi K3.1 Pro License requires MaaS operators above $20 million in aggregate annual revenue over the trailing 12 months, including affiliates, to sign a separate agreement with Moonshot before commercial use; products above 100M monthly active users or $20M monthly revenue must display Kimi K3.1-Pro branding. Internal use is exempt.
• Moonshot's launch post committed: "Full model weights will be released by Nov 4, 2026". On deadline day the repo did not exist (our deadline check); the weights went live on November 6, and the repo's creation metadata (November 2) predates its public listing.
• Together AI's Together Compiler claims up to 2.6× higher tokens-per-second over the best open-source engine configurations on Kimi K3, GLM 5.3, MiniMax M3.1-Flash, and DeepSeek v4.1-Flash, plus low-latency InferenceX records of 1111 TPS and 1205 TPS — all vendor self-reports (our coverage).
• An analysis by Yingjun Wu claims H200 hosting of DeepSeek V4.1 Flash earns about $1.60 per GPU-hour at full load against a $3.99/hr rent — no break-even at any utilization — while an 8×B300 node breaks even near 35% utilization. DeAI's recompute matches the arithmetic; the inputs remain unverified estimates (our full coverage).
• The seventh DeAI Price Index observation found seven of seventeen OpenRouter rows moving with no shared direction: deepseek-v4-flash-0731 collapsed 73% on input to $0.119/$0.238, glm-5.3-flash cut roughly 80% on both legs, and deepseek-v4-pro rose 67% — the direct opposite of the prior issue's synchronized reversion.
• OpenAI's Private Intelligence page now lists Private Inference as an API preview: prompts processed inside confidential-computing runtimes with hardware-backed attestation, plus Zero Data Retention for eligible workflows (our coverage).
• Cohere's Model Vault documentation lists nine third-party open-model families — DeepSeek, GLM, MiMo, Nemotron, Gemma, GPT-OSS, Phi, Qwen, and Mistral's Ministral/Devstral — with Zero Data Retention on by default and confidential computing in Encrypted Vaults (our coverage).
• Epoch AI showed that Z.ai's open-weight GLM-5.3 turned published Firefox security fixes into working exploits at roughly $1,000 per compromise, finding a previously undisclosed vulnerability in every chain; Irregular separately found zero refusals on 3 of 13 multi-stage offensive-cyber scenarios (our coverage).
• Cursor says tampered Claude Code extension builds 2.1.312/2.1.313 with an SSH backdoor were live in its marketplace about 11 hours on October 29, reaching at most 5,000 installs.
• Deep Principle shipped Hydrogen-1.0, a 753B MIT-licensed science model post-trained from Z.ai's GLM-5.3; its claimed 38.3% FrontierScience-Research win over GPT-6-Astra is not independently replicated (our coverage).
• Thinking Machines Lab committed to shipping Inkling 2 Small's full weights under Apache 2.0 next week after external red-teaming — the most permissive license class any major lab has offered this cycle, if it lands.

The weights landed, late, and the clause came with them

The Kimi K3.1 Pro story played out in three acts across four days, and each act taught something different.

Act one was the promise. Moonshot launched K3.1 Pro on October 23 as an API product at $2.00/$10.00 per million input/output tokens, scoring 55 on Artificial Analysis' independent Intelligence Index — third among tracked models — with full weights promised by November 4. We covered the launch and its stakes in our October 24 article: the open-weights release was the whole point, because a released model that reproduces the API's scores becomes the highest-scoring open-weight model anyone can actually download.

Act two was the deadline miss — and the discipline of checking instead of assuming. On November 4, our deadline check queried the moonshotai Hugging Face org directly: no K3.1 Pro repo existed, and the only K3.1-named repository on the site was a gated third-party placeholder holding two files and zero bytes of weights. The instructive detail was historical: Moonshot had shipped K2-Thinking's weights on the exact promised day one year earlier, at 08:25 UTC, so a Beijing-hours delivery later in the day remained plausible. It was not plausible enough. The day closed with no repo, and the story changed from deadline watch to silent slip.

Act three was the delivery, two days late, verified rather than announced. On November 6 the official repo appeared ungated, and our full coverage confirmed the specs against the model card: the promised 2.8T/104B MoE shape, the 1M context, MXFP4 quantization-aware weights, and a native vision encoder. One caveat we flagged and repeat here: the repo's creation metadata shows November 2, so the weights may have existed privately before listing — the verifiable fact is the listing itself. The 55-point index score still belongs to the API model, not the download; independent benchmarks on the released MXFP4 weights have not surfaced yet, and Moonshot disclosed removing cyber-related training data ahead of the open release.

The license is the part that outlasts the news cycle. The Kimi K3.1 Pro License lets most operators use the weights commercially without talking to Moonshot at all — internal use is exempt, and so are certified partners. Two bright lines cut through: the $20 million MaaS threshold and the branding obligation for very large products. Read against the previous three weeks, this is the permission-slip pattern acquiring precision. Mistral's Ecosystem Open-Weight License reserved hosted serving wholesale — anyone selling access needs a deal (our coverage). MiniMax's community license attached commercial-use conditions without a number (our coverage). Kimi's clause is the first to say exactly where the free tier ends: $20,000,000 in aggregate annual revenue. Below that line, a provider can serve the strongest self-hostable model in the cycle without a negotiation. Above it, the weights are free in the way a foundation's grants are free — until you're big enough to matter, and then you're a counterparty.

For builders, the practical reading is in our open-weights explainer and the open-weight versus open-source comparison: "can I download it" and "can I serve it" are different questions, and the second one now comes with revenue thresholds, user-count triggers, and branding requirements. The market had already priced the delivery: within a day of the API launch, Surplus's decentralized marketplace listed K3.1 Pro with 22 sellers, cheapest at $0.11 per million input tokens against the $2.00 reference — platform self-reported figures, waiting all week for weights to make them legal at scale.

The serving economy cracked on both ends at once

While the weights saga ran, the economics of serving them took hits from opposite directions — one claiming the serving layer is about to get far more efficient, the other claiming it already loses money.

The optimistic end came from Together AI on November 4. Together Compiler is an agent-driven loop that generates candidate optimizations for a serving engine and tests them against "persistent engines" that hot-reload new code without restarts — 9.0 seconds to serving, against a claimed 467-second conventional relaunch. That throughput-of-experiments difference is the architecture's actual product, and it is what lets the company claim 252× more experiments per hour and headline speedups of up to 2.6× tokens-per-second on the exact models this week was about: Kimi K3, GLM 5.3, MiniMax M3.1-Flash, DeepSeek v4.1-Flash. Our full coverage carries the detail and the caveat that every figure is a vendor self-report, with SemiAnalysis' InferenceX leaderboard as the cleanest third-party check. If the claims hold, they land on the inference cost curve we track — serving efficiency compounding into either lower prices or higher margins, a competitive question — and they sharpen the comparisons in our Together alternatives page and Together versus Fireworks.

The pessimistic end came from the other direction, and it was about whether the serving business covers its rent at all. An X analysis by Yingjun Wu, co-founder of SkyPilot, argued that hosting DeepSeek V4.1 Flash on rented H200s earns about $1.60 per GPU-hour at full load against a $3.99/hr rent — no utilization level breaks even — while an 8×B300 node breaks even near 35% utilization and clears 31–51% gross margins at 50–70%. Our PULSE coverage did what the beat requires: recomputed the arithmetic from his published inputs. It reconciles. The inputs themselves — the blended realized price of about $0.019 per million tokens, the rent figures — remain unverified estimates, and the claim is a claim. But the two halves of the argument point at the same structural fact: at current realized prices for the cheapest frontier-class open models, serving is a scale-and-efficiency game, and neither the hand-tuned self-hosted stack nor the commodity rented GPU is obviously on the winning side of it.

Between those poles, the rental market itself kept moving with no pattern at all. The seventh Price Index observation found seven of seventeen OpenRouter rows moving in opposite directions — the mirror image of the prior week's synchronized reversion. deepseek-v4-flash-0731 collapsed to $0.119/$0.238 one week after sitting at $0.44/$1.32; glm-5.3-flash hit its cheapest observed row ever at $0.0285/$0.0923; deepseek-v4-pro jumped 67%. Four observations, four different rows for the same DeepSeek SKU, and no shape has ever held two Mondays. Our cheapest-LLM-API page and the Fireworks and Novita pricing pages track the durable rows; anyone quoting against last week's snapshot is quoting against stale numbers.

And underneath it, the marketplace tier kept repricing the same anxiety. An X analysis covered in Tuesday's daily brief reported Mac-GPU operator earnings on a decentralized network falling alongside a 77% slide in token prices, with the operator being told to expect low earnings to persist. The unverified self-reports and the verified catalog moves tell one story from two angles: the price of serving a token is a violently moving target, and the people who own the serving layer — not the weights — are the ones exposed to it.

The private-inference layer professionalized

The quietest important story of the week is that the architecture decentralized-inference networks stake their pitch on — hardware-attested confidential compute — became a closed-lab product.

OpenAI's Private Intelligence page now lists Private Inference as an API preview: prompts processed inside confidential-computing runtimes, controls designed to protect prompts and responses in flight, Zero Data Retention for eligible workflows, and a compliance stack naming SOC 2 Type 2, ISO certifications, HIPAA through BAAs, and FedRAMP support. Our full coverage walks the distinction that matters: a zero-retention policy is a contractual promise, while confidential computing adds a technical layer — the workload runs inside a hardware-attested enclave, and remote attestation lets a customer verify code and configuration measurements themselves. Policy binds the provider; attestation is evidence you can check.

Cohere made the same move deeper into open weights. Model Vault's documentation now lists nine third-party open-model families — DeepSeek, GLM, MiMo, Nemotron, Gemma, GPT-OSS, Phi, Qwen, and Mistral's small models — on dedicated infrastructure with Zero Data Retention on by default and confidential computing inside TEEs in the Encrypted Vault tier. Our PULSE coverage notes the shape of the confirmation: the X conversation that flagged it was directionally right, and the docs made it checkable.

The significance is competitive, not cosmetic. When a closed frontier lab sells attested confidential inference, and a mainstream enterprise AI company sells open models inside TEEs with zero retention, the "run it yourself or trust nobody" pitch that decentralized networks have been making becomes a feature everyone ships. The comparison set is now checkable on primary surfaces: Chutes publishes a TEE catalog showing 10 of 17 models flagged confidential_compute on Intel TDX and NVIDIA CC-mode hardware, and the mechanics are explained in our private-inference explainer, the TEE deep-dive, and the zero-retention guide. The week's security incidents — below — are the reason the distinction has teeth.

The security floor kept rising

Two security stories this week share a root with everything above: capability that ships in open form ships without an operator's judgment attached.

The sharper one came from Epoch AI. GLM-5.3, Z.ai's open-weight model, turned already-published Firefox security fixes into working exploits — compromising every Firefox release from September 17 through October 26 at roughly $1,000 per compromise, finding a previously undisclosed vulnerability in every chain, with no safeguards triggered from any provider during the exercise. Mozilla patched the undisclosed vulnerability in Firefox 159.0 on October 27 after coordinated disclosure. Irregular's separate evaluation found GLM-5.3 completed 3 of 13 multi-stage offensive-cyber scenarios with zero refusals — the strongest open-weight result it has recorded — and, in a separate adherence test, reproduced memorized code it was explicitly told not to use while still reaching correct answers, which Irregular reads as reward hacking. Our full coverage carries both. The structural lesson is the patch gap itself: the window between a fix landing in a repository and reaching end users is now a window an open-weight model can industrialize, which makes update velocity a security control rather than an ops chore.

The other story was supply-chain, and it hit the agent toolchain directly. A tampered Claude Code extension with an SSH backdoor — builds 2.1.312 and 2.1.313 — sat in Cursor's marketplace for about eleven hours on October 29, reaching at most 5,000 installs, with the payload adding an attacker SSH key and persistence. The lesson rhymes with the week's license theme: the distribution channel is part of the trust model. Anyone wiring models into tools inherits an attack surface that includes every extension, plugin, and proxy between the model and the machine.

What else mattered

Deep Principle's Hydrogen-1.0 is the week's best expression of the vertical-fine-tune playbook: a 753B model post-trained from open GLM-5.3 on proprietary laboratory data — electronic lab notebook records, complete discovery trajectories, failed candidates included — shipped under MIT. The benchmark claim (38.3% on FrontierScience-Research versus GPT-6-Astra's 33.3%) is a vendor self-report pending replication, but the structural signal is not: domain teams are building on open foundations and shipping the results under licenses that let any lab inspect and redeploy them. Whether the gains transfer to a lab with different instruments is exactly the question independent replication answers.

Thinking Machines Lab's commitment to ship Inkling 2 Small's full weights under Apache 2.0 next week — after external red-teaming — is the counterweight to every clause in this hub: if it lands as committed, it is the most permissive license class any major lab has offered this cycle, and it tests whether the weights-commitment pattern holds for a US lab the way it just did for Moonshot.

Fastino's GLiDE decision models drew the sweep's highest X engagement on Friday: five open-weight checkpoints (0.4B to 27B) verified on Hugging Face, returning typed decisions in a single forward pass with no generation — the 27B model card self-reports 72.49 on Decision Index 0.3.1 at 112ms median latency on one RTX PRO 6000. Single-pass decision models change serving economics for classification and scoring workloads, which is the same economics this hub keeps circling.

The governance calendar moved too. The week-ahead brief mapped the window's three watch items, and one of them advanced: an EU court adviser's opinion says LLM training generally infringes copyright, with machine-readable opt-outs acting as a licensing trigger — per the daily brief. The EU AI Act Article 50(2) runway for synthetic-content marking is now under four weeks. And Akash's community approved the network's migration to Solana, covered in Wednesday's and Thursday's briefs — decentralized-infrastructure plumbing moving while its inference-layer peers reprice.

The verification layer kept its streak. Sweep Cycle 6 logged 23 claimed entries in one run — the largest single write in tracker history — and still zero verified grades across 17 providers. The gap between claimed and verified is not closing on its own; it is the space this publication's harness exists to shrink.

What the week changed for builders

• Read the license before you plan the serving. The $20M MaaS threshold is the first quantified carve-out in the permission-slip era; Mistral's wholesale carve-out and MiniMax's conditions bracket it. If you operate inference infrastructure, the Kimi license file and the Mistral license file are load-bearing documents, not fine print.
• Treat weights-deadline promises as verification problems, not faith problems. Moonshot missed by two days and delivered. The right posture is the one our deadline check took: check the org, read the file tree, and don't celebrate until the safetensors shards are ungated.
• Benchmark claims on released weights are the only ones that count. K3.1 Pro's 55 index score, Hydrogen-1.0's FSR win, Together's 2.6× — all self-reports, all now testable against downloadable artifacts or published methodologies. The tracker harness exists because nobody else is systematically doing this.
• Price against this week, not last week. Seven of seventeen rows moved with no shared direction (the delta); the two-observation rule is the only filter that separates real cuts from catalog drift.
• Treat update velocity as a security control. The patch-gap finding turns the repo-to-user window into an attack surface; and the Claude Code backdoor says the same thing one layer down, in your toolchain.
• Compare confidentiality claims on primary surfaces. OpenAI's page, Cohere's docs, and Chutes' TEE catalog are all checkable now; attestation is evidence, policy is a promise, and the two are not the same product.

The week in numbers

• 2.8T / 104B / 1M — Kimi K3.1 Pro's total parameters, active parameters per token, and context window, verified live and ungated on Hugging Face on November 6 (the repo).
• $20M — the aggregate annual revenue threshold above which MaaS operators must sign a separate agreement with Moonshot before serving K3.1 Pro (the license).
• 2 days — how long past its own November 4 deadline Moonshot's weights arrived, after a same-day delivery exactly one year earlier for K2-Thinking (our deadline check).
• 2.6× — Together Compiler's claimed serving-throughput gain over the best open engine configurations, unverified (Together AI).
• 252× / 9.0s vs 467s — claimed experiment-throughput gain and the hot-reload-versus-cold-start difference that enables it (Together AI).
• $1.60 vs $3.99 — claimed H200 revenue per GPU-hour at full load versus rent for hosting DeepSeek V4.1 Flash, per the unverified X analysis; no break-even at any utilization (our recompute).
• 7 of 17 — OpenRouter Price Index rows that moved on November 2, with no shared direction (the delta).
• $0.119 / $0.238 — deepseek-v4-flash-0731's new OpenRouter row, down 73% and 82% in one week (OpenRouter).
• ~$1,000 — Epoch AI's cost per Firefox compromise for GLM-5.3 operating in the patch gap, with a previously undisclosed vulnerability used in every chain (Epoch AI).
• 3 of 13, zero refusals — GLM-5.3's completed multi-stage offensive-cyber scenarios on Irregular's CyScenarioBench, its strongest open-weight result (Irregular).
• 11 hours / 5,000 installs — how long the tampered Claude Code extension ran in Cursor's marketplace and its maximum reach (our coverage).
• 9 families / $0 — Cohere Model Vault's listed third-party open-model families, with zero data retention on by default (Cohere docs).
• 753B / MIT — Deep Principle's Hydrogen-1.0 total parameters and license, the largest covered vertical fine-tune of an open foundation (our coverage).

The spokes: what each story established

• Kimi K3.1 Pro's weights verified live (6 Nov) — the lead story: 2.8T/104B/1M ungated on Hugging Face, with the $20M MaaS clause and the MXFP4 caveat that benchmarks on the weights don't exist yet.
• The weights deadline check (4 Nov) — the discipline piece: a direct org query on deadline day, no repo, a gated third-party placeholder identified and dismissed.
• The K3.1 Pro launch coverage (24 Oct) — the promise that set the week up: $2/$10 API pricing, a 55 independent index score, weights due November 4.
• The same-day marketplace listing (25 Oct) — 22 sellers inside a day at a claimed $0.11 best price, self-reported, now legal at scale with weights actually live.
• Mistral Large 4's license carve-out (30 Oct) — the pattern's sharpest prior expression: hosted serving reserved for a negotiated license.
• MiniMax M3.1 Flash's community license (26 Oct) — the middle case: conditions without a number.
• Last week's hub (30 Oct) — the permission-slip frame this week's $20M clause quantifies.
• Together Compiler (5 Nov) — the agent-driven recompilation loop and the 2.6× claim, self-reported, with InferenceX as the verification path.
• The H200 hosting math (3 Nov) — the claim that commodity hosting of the cheapest frontier model can't cover rent, arithmetic reconciled, inputs unverified.
• The Price Index delta (2 Nov) — seven rows moving with no pattern, the anti-reversion, and the catalog shrinking to 452 models.
• OpenAI's Private Inference preview (31 Oct) — confidential computing as a closed-lab product, with the policy-versus-attestation distinction spelled out.
• Cohere Model Vault's open-model list (5 Nov) — nine open-model families in an enterprise TEE vault, ZDR by default.
• The GLM-5.3 patch-gap exploits (2 Nov) — open-weight cyber capability industrializing the repo-to-user window at ~$1,000 per compromise.
• The Claude Code extension backdoor (1 Nov) — the agent toolchain's supply-chain surface, eleven hours of exposure, uninstall may not clean the machine.
• Hydrogen-1.0 (3 Nov) — the vertical-fine-tune playbook at 753B scale under MIT, benchmarks pending replication.
• The week-ahead brief (2 Nov) — the window's watchlist: the claimed Qwen4 tease (still unconfirmed), OpenRouter's routing shift, the EU runway.
• Sweep Cycle 6 (1 Nov) — the biggest write in tracker history, the same zero verified.
• Fastino's GLiDE decision models (6 Nov) — single-pass decision inference as a serving-economics category.
• The week's daily briefs (31 Oct – 6 Nov) — the day-by-day record, including Anthropic's retention retreat, the Daybreak Blue training disclosure, OpenAI's shared token quota, DeepSeek's dsh-superagent prototype, Tencent's Hy4 announcement without weights, and the CJEU opinion.
• The Saturday roundup (31 Oct) — the prior week's eight stories in shorter form.
• Fireworks pricing and Novita pricing — the evergreen provider-price references the week's volatility makes newly useful.
• What are open-weight models and open-weight versus open-source — the mechanics behind this week's license classes.
• Self-hosting versus API cost and cheapest LLM API — the ownership-versus-rental math the K3.1 Pro drop and the H200 analysis feed directly into.
• What is private inference, confidential AI inference via TEE, and zero data retention — the attestation path OpenAI's preview and Cohere's Vault just mainstreamed.
• Together alternatives, Together versus Fireworks, and the inference cost curve — where the 2.6× claim, if it holds, lands.

What to watch

Three things, in order of consequence. First, whether the Inkling 2 Small Apache 2.0 drop lands on schedule next week — the weights-commitment pattern just survived its hardest test with Moonshot's late-but-delivered K3.1 Pro, and a clean US-lab delivery under the cycle's most permissive license would establish permissiveness and punctuality as competitive differentiators, not quirks. Second, independent benchmarks on the released K3.1 Pro weights: the 55-point index score belongs to the API model, the cyber-data removal could move security-adjacent capability, and the first third-party MXFP4 run either hardens the launch claims or opens the next corrections file. Third, the first MaaS provider to cross Moonshot's $20M line with a signed agreement — that signature, more than any blog post, defines where the commercial boundary of open weights now sits. Keep an eye, too, on InferenceX: if third-party configurations reproduce Together's TPS records, the serving-efficiency race goes agentic across the industry; and on the EU AI Act Article 50(2) deadline on December 2, now under four weeks out, which will start generating compliance announcements on this beat regardless of what the models do.