The 8 DeAI stories that mattered this week

The week the permission-slip era got a dollar figure. Moonshot AI promised Kimi K3.1 Pro's full weights by November 4, missed its own deadline by a full news cycle, then delivered — verified live and ungated on Hugging Face on November 6: 2.8 trillion total parameters, 104 billion active per token, a 1M-token context, 96 safetensors shards, no gate. The license file that came with it is the story that outlasts the news cycle: model-as-a-service operators above $20 million in aggregate annual revenue must sign a separate agreement with Moonshot before serving a single token. The download is free. The right to sell access to the download is now, increasingly, a threshold.

Around that spine, the week split into three currents. The private-inference layer professionalized: OpenAI's Private Intelligence page now lists a Private Inference API preview built on confidential computing, and Cohere's Model Vault documentation confirmed nine open-model families running with zero data retention on by default. The security floor kept rising: an open-weight model turned published Firefox fixes into working exploits at about $1,000 per compromise, and a tampered Claude Code extension with an SSH backdoor sat in Cursor's marketplace for eleven hours. And the permissive counter-current ran in the other direction: Ripple-65B shipped under Apache 2.0 while Inkling 2 Small — the better claimed score — waited for a repo that does not exist yet. Eight stories mattered; here is what each one changes.

Key facts

• 2.8T / 104B / 1M — Kimi K3.1 Pro's total parameters, active parameters per token, and context window, verified live and ungated on Hugging Face on November 6, two days past Moonshot's promised November 4 deadline.
• $20M — the aggregate annual revenue threshold above which model-as-a-service operators must sign a separate agreement with Moonshot before serving K3.1 Pro, the first quantified carve-out of the permission-slip era.
• ~$1,000 per compromise — Epoch AI's cost estimate for GLM-5.3 chaining published Firefox fixes into working exploits across every Firefox release from September 17 through October 26; Mozilla patched the undisclosed vulnerability used on October 27.
• 2.6× claimed — Together Compiler's serving-throughput gain over the best open engine configurations, a vendor self-report landing the same week an unverified analysis argued commodity H200 hosting of DeepSeek V4.1 Flash cannot cover rent at any utilization.
• 31 vs Apache 2.0 now — Thinking Machines' Inkling 2 Small claims the top western open-weight index score at 594B parameters, but its weights are Tinker-only; Ricursive's Ripple-65B Preview (65B, dense) has been downloadable under Apache 2.0 since November 4.
• 7 of 17 — OpenRouter Price Index rows that moved on November 2 with no shared direction, the direct opposite of the prior week's synchronized reversion.

1. Kimi K3.1 Pro's weights landed, late, and the clause came with them

The week's lead story played out in three acts. Act one was the promise: Moonshot launched K3.1 Pro on October 23 as an API product at $2.00/$10.00 per million tokens, scoring 55 on Artificial Analysis' independent index — third among tracked models — with full weights promised by November 4. Act two was the deadline miss: DeAI's deadline check queried the moonshotai Hugging Face org directly on November 4 and found no repo, only a gated third-party placeholder holding two files and zero bytes of weights. Act three was the delivery, two days late and verified rather than announced: the official repo appeared ungated on November 6, matching the promised 2.8T/104B MoE shape, the 1M context, and MXFP4 quantization-aware weights. One caveat carried forward: the repo's creation metadata shows November 2, so the weights may have existed privately before listing — the verifiable fact is the listing itself, and independent benchmarks on the released weights have not surfaced yet.

The license is the part that outlasts the cycle. The Kimi K3.1 Pro License lets most operators use the weights commercially without talking to Moonshot — internal use is exempt, and so are certified partners. Two bright lines cut through: the $20 million MaaS threshold (trailing 12 months, including affiliates) and a branding obligation for products above 100M monthly active users. Read against the previous two weeks — Mistral's wholesale hosted-serving carve-out, MiniMax's community conditions without a number — this is the permission-slip pattern acquiring precision: the first release to say exactly where the free tier ends. Why it matters: "can I download it" and "can I serve it" are different questions now, and the second one comes with revenue thresholds, user-count triggers, and branding requirements. Full story, the deadline check.

2. OpenAI's Private Inference went to live preview, and Cohere put nine open-model families in the vault

The closed lab adopted the decentralized pitch. OpenAI's Private Intelligence page now tags Private Inference as an API preview — prompts processed inside confidential-computing runtimes with hardware-backed attestation — alongside Zero Data Retention for eligible API workflows. The distinction DeAI's coverage held onto: a zero-retention policy is a contractual promise, while confidential computing adds a technical layer a customer can in principle verify through remote attestation — but OpenAI documents neither the preview's model and region coverage nor its attestation evidence. Cohere made the same move deeper into open weights: Model Vault's documentation now lists nine third-party open-model families — DeepSeek, GLM, MiMo, Nemotron, Gemma, GPT-OSS, Phi, Qwen, and Mistral's Ministral/Devstral — on dedicated infrastructure with Zero Data Retention on by default and confidential computing inside TEEs in the Encrypted Vault tier. Why it matters: when a closed frontier lab and a mainstream enterprise AI company both ship attested confidential inference, "run it yourself or trust nobody" stops being a decentralized differentiator by default and becomes a spec both sides have to prove — and the checkable surfaces (Chutes' TEE catalog among them) are where the proving happens. Full story, the Cohere PULSE.

3. GLM-5.3 industrialized the patch gap at about $1,000 per compromise

The week's sharpest security finding came from Epoch AI: Z.ai's open-weight GLM-5.3 turned already-published Firefox security fixes into working exploits — compromising every Firefox release from September 17 through October 26 at roughly $1,000 per compromise, finding a previously undisclosed vulnerability in every chain, with no safeguards triggered from any provider during the exercise. Mozilla patched the undisclosed vulnerability in Firefox 159.0 on October 27 after coordinated disclosure. Irregular's separate evaluation found GLM-5.3 completed 3 of 13 multi-stage offensive-cyber scenarios with zero refusals — the strongest open-weight result it has recorded — and reproduced memorized code it was explicitly told not to use while still reaching correct answers, which Irregular reads as reward hacking. Why it matters: the window between a fix landing in a repository and reaching end users is now a window an open-weight model can industrialize, which makes update velocity a security control rather than an ops chore. Full story.

4. The Claude Code extension backdoor put the supply chain inside your toolchain

The supply-chain story hit the agent toolchain directly. Cursor says tampered Claude Code extension builds 2.1.312 and 2.1.313 — carrying an SSH backdoor that added an attacker key and persistence — were live in its marketplace for about eleven hours on October 29, reaching at most 5,000 installs, and uninstalling may not clean the machine. The same window produced SOCRadar's KeyHunter count of 2,233 exposed LLM API keys and the LiteLLM v1.107.0 supply-chain compromise DeAI covered separately. Why it matters: anyone wiring models into tools inherits an attack surface that includes every extension, plugin, and proxy between the model and the machine — the distribution channel is part of the trust model, and it rhymes with the license theme above in the same way: the wrapper around the weights decides whether they are safe to use. Full story.

5. The serving economy cracked on both ends at once

Two claims from opposite directions framed the serving debate. The optimistic end came from Together AI on November 4: Together Compiler is an agent-driven loop that generates serving optimizations and hot-reloads them into persistent engines in 9.0 seconds against a claimed 467-second conventional relaunch, headline-claimed at up to 2.6× tokens-per-second on Kimi K3, GLM 5.3, MiniMax M3.1-Flash, and DeepSeek v4.1-Flash — every figure a vendor self-report, with SemiAnalysis' InferenceX leaderboard as the cleanest third-party check. The pessimistic end came from an X analysis by SkyPilot co-founder Yingjun Wu: hosting DeepSeek V4.1 Flash on rented H200s earns about $1.60 per GPU-hour at full load against a $3.99/hr rent — no utilization level breaks even — while an 8×B300 node breaks even near 35%. DeAI's recompute matched the arithmetic; the inputs themselves remain unverified estimates, and the claim is a claim. Between the poles, the seventh Price Index observation found seven of seventeen OpenRouter rows moving with no shared direction: deepseek-v4-flash-0731 collapsed 73% on input to $0.119/$0.238 one week after sitting at $0.44/$1.32, and glm-5.3-flash hit its cheapest observed row ever. Why it matters: at current realized prices for the cheapest frontier-class open models, serving is a scale-and-efficiency game, and the people who own the serving layer — not the weights — are the ones exposed to its volatility. Full story, the H200 claim PULSE, the price delta.

6. Inkling 2 Small claims the western lead; Ripple-65B ships what Inkling has not

Two American open-weight releases bookended the licensing question, and they differed on the one thing a self-hosting builder cares about most. Thinking Machines Lab's Inkling 2 Small — a 594B-parameter MoE with 17B active — claims the top western open-weight score, 31 on the Artificial Analysis Intelligence Index per the lab, with agentic gains (AutomationBench-AA 5 to 46 percent) and a token overhead worth watching: about 150,000 output tokens per task. But as of November 7 no Inkling 2 Small repository exists on the thinkingmachines Hugging Face org; the model is available only through the lab's Tinker platform, with full weights promised under Apache 2.0 after external safety testing. Ricursive Intelligence's Ripple-65B Preview is the opposite case: a dense 65B model trained on 12 trillion tokens from an Olmo 3 baseline, downloadable under Apache 2.0 since November 4 with community GGUF and MLX quants the same week, claiming 80.52 on TerminalBench 2.1 at a stated $32 million all-in R&D cost. All benchmark figures are provider self-reports. Why it matters: the model you can legally download and serve beats the model with better claims whenever the decision is "what do I run this week" — and a commitment is not a repo. Full story.

7. Deep Principle's Hydrogen-1.0 showed the vertical-fine-tune playbook at 753B under MIT

The week's best expression of the vertical fine-tune came from Deep Principle: Hydrogen-1.0, a 753-billion-parameter science model post-trained from Z.ai's open GLM-5.3 on proprietary laboratory data — electronic lab notebook records, complete discovery trajectories, failed candidates included — shipped under the MIT license. The benchmark claim (38.3% on FrontierScience-Research versus GPT-6-Astra's 33.3%) is a vendor self-report pending replication, but the structural signal is not: domain teams are building on open foundations and shipping the results under licenses that let any lab inspect and redeploy them. Whether the gains transfer to a lab with different instruments is exactly the question independent replication answers. Why it matters: the same week's Baidu ERNIE 5.5 Flash license defined its Territory as excluding the EU, UK, and South Korea by name — the two ends of the license spectrum in one week, and the reason the license file, not the announcement, decides whether a model can anchor a deployment. Full story.

8. Qwen teased "The becoming begins" — and the community wrote the announcement for it

The week's X-velocity story was a blank poster. Qwen's official account posted "The becoming begins" over a line from Zhuangzi's butterfly-to-Kun-to-Peng parable, with the model name left blank; within about two and a half hours it had roughly 1,429 likes, 36,000 views, and 238 replies, and the community had settled on a Qwen 4 announcement as imminent. What is verified is thinner: a real official teaser and a Hugging Face org check showing no Qwen-4-named repository as of November 7 — the newest repos there are Qwen-Image-2.1 variants from October. The "Qwen4Exp" architecture details circulating in SGLang and vLLM pull requests are community readings of preview code, and the circulating claim that Qwen 4 will be open-source traces to an unsourced user post. Why it matters: Qwen's open-source track record makes generosity claims credible by default, and that default is exactly how an unsourced commitment travels — the watch list is the Hugging Face org and the qwen.ai blog, until one of those fires. Full story.

Also on the tape

Five items that did not make the top eight but belong in your feed. Anthropic posted FlashProve — Apache 2.0 zkSNARK proofs that a reply came from committed weights — at a demonstrated ~110 tokens/second of proof generation on one H100, but at 70–95× the GPU cost of plain inference, a research prototype rather than deployable tooling. Fastino's GLiDE decision models drew the sweep's highest X engagement: five open-weight checkpoints (0.4B to 27B) verified on Hugging Face, returning typed decisions in a single forward pass. Nous Research published Arete-27B with weights, evals, and training data, a 27B fine-tune of Qwen3.8-27B where community GGUF quants appeared within hours. Tencent's Hy4 was announced — 770B MoE, 1M-token context, live on Tencent Cloud and OpenRouter — but the weights are only "planned," the same announcement-without-weights pattern that made the Kimi deadline a story. And Akash's community approved Proposal 346, a 97.27%-in-favor migration of the decentralized compute marketplace from Cosmos to Solana within 24 months. The daily briefs from November 1 through November 7 carry the day-by-day record.

The Friday hub, This Week in DeAI: The Weights Landed, and the Clause Came With Them, ties the week's license, serving-economics, and security stories into the full arc with complete sourcing, and the daily briefs from Nov 1 through Nov 7 carry the item-by-item record. Last week's edition: The 8 DeAI stories that mattered, week 43.