DeepSeek gets banned in Washington and licensed in Beijing in the same week

The big story

On 19 October DHS posted a Federal Register notice ordering civilian agencies to stop buying anything from Hangzhou DeepSeek, its affiliates, or third parties building on DeepSeek technology, and to remove existing deployments or file for an exception within 60 days (CyberScoop, BleepingComputer). The legal hook is the Federal Acquisition Supply Chain Security Act; the attached letter from Secretary Mullin is dated 26 June, so the ban has quietly been in force for four months. It is a procurement order, not a consumer ban, and it says nothing about MIT-licensed weights on a drive. But "products built using DeepSeek technology" is broad enough that any federal contractor shipping a V4.1 fine-tune should be reading it twice.

Three days later Chinese state media said DeepSeek and MiniMax had completed the new pre-export registration with the commerce ministry, and MiniMax confirmed it to Reuters on 23 October. This is the filing regime Beijing floated a week earlier alongside a draft list of 23 controlled AI technologies. MOFCOM's stated line is that open-sourced models and online services sit outside the controls while local overseas deployment of a restricted model sits inside — which is precisely the boundary that matters to anyone running weights on their own hardware, and nobody has said which side a torrent falls on. The first visible consequence arrived in Moonshot's K3.1 Pro post the same day: for the open-weight checkpoint they removed cyber-related data from both mid-training and the RL environment mix, and published the cost — 90.5% to 81.0% on their internal exploit benchmark, pass@3. Credit for the transparency. But the pattern is now clear: labs are pre-emptively cutting specific capabilities to keep the release path open on both sides of the Pacific. The architecture is yours; the data was curated by a compliance office. Expect similar paragraphs in the next DeepSeek and MiniMax cards.

New open-weight releases

• MiniMax-M3.1-Flash (428B MoE, 23B active, MiniMax Community License) — Weights hit Hugging Face on 23 October, a week after the API launch; 1M context, text/image/video input, 252 GB repository. The licence is free below a US$20M revenue threshold and requires MiniMax's written authorisation above it — weights-available, not open. TensorSharp had GGUF and vision support on day one.
• Kimi K3.1 Pro (2.8T MoE, 104B active, licence TBC) — API-only for now; full weights promised by 4 November. It is K3 with a much larger post-training budget, claims 65.7% on Terminal-Bench 4.0 against Opus 5.5's 66.4%, and debuted fourth on the Artificial Analysis index — a placement LocalLLaMA testers disputed within hours. VentureBeat is also reporting paid-influencer allegations around the launch. Not a release until the files exist.
• Flint (39.8B MoE, ~2.5B active, Apache-2.0) — Recursive's first model, a coding-agent MoE claiming 54.9% on Terminal-Bench 2.1 and 89.7% on SWE-bench Pro v2 (model card). The llama.cpp PR merged in six hours and Unsloth GGUFs followed; early community runs of the Q3 quant scored well below the card, so judge the BF16 before the quant.
• Ling-3.1-flash (560B MoE, 25B active) — inclusionAI's latest, on HF; someone already spread it across four DGX Sparks over llama.cpp RPC. Sibling Ming-3.0-audio-flash (126B MoE, 6.5B active, MIT) does audio in, speech out.
• Nemotron 3.5 Super VL (120B MoE, 12B active, NVFP4) plus Bolt 74B-A9B, Bolt E4B (post-trained from Gemma-4-E4B) and the looped-recurrent Dory1.0-4B — NVIDIA's weekly drop; one user reports a 3M-token pool on a single RTX PRO 6000.
• Raon-1-mini-preview (30B MoE, 4B active) — KRAFTON's from-scratch, Korean-centric MoE.
• Carbon-X (14.8B, Qwen3 fine-tune) — HuggingFaceBio's joint DNA-and-text model; raw sequences go in a chat turn, and it runs in llama.cpp.
• Smaller: Ornith-1.5-122B (Qwen fine-tune, claims 76.9 SWE-bench Pro), elephant-1 (9B, MIT, Baseten's decision model), Kitten-TTS 2 (1.58-bit CPU TTS), OvisOCR3 (0.8B, Apache-2.0), Mistral's Timestral-209M for time series.

Policy & politics

The cyber argument is now the whole argument. Altman told Stanford GSB that OpenAI's best model "can't responsibly be open-sourced" until cyberdefence and biosecurity improve; the same week Vals AI reported DeepSeek V4.1 Flash 1017 beating GPT-6 Sol on a multi-step offensive-cyber task, and Nathan Lambert argued the risk discourse is broken. The think-tank pile-on continued — the Manhattan Institute floated a safe harbour for US open weights, Just Security argued export controls on open models will not win the race, Nature ranked which "open" models are actually open — but the operative facts this week were the DHS order and the MOFCOM filings, not the essays. Also worth noting: Corporate America is "getting hooked" on open-source AI per the NYT, while the FT calls open weights the next China shock. Both can be true.

Ecosystem

• LiteLLM 1.107.0 was backdoored. The 21 October PyPI release shipped a credential stealer and an hourly RCE daemon that run on every Python start, even without importing litellm; the implant came from a single injected data = "cook" line in the build config, with no trace upstream (SafeDep). PyPI pulled it by 13:23 UTC; Docker images carried it for a few hours. 1.106.2 is clean. If you proxy local models through LiteLLM, rotate keys.
• ISTA-DASLab GSQ-RCO quants for DeepSeek-V4.1-Flash-1017: 1.75–2.25 bpw, with the IQ2_XXS at 138 GB plus a shared 110.6 GB Engram table, claiming 100% of the base model's task average (HF). The benchmarks are AIME25, GPQA-Diamond and LiveCodeBench — saturated, as the "too good to be true" thread pointed out. Runs on a 12 GB GPU in Strata; llama.cpp support is in PR #31086.
• Benchmark drift: 1017's Terminal-Bench 4.0 is 42.3% on the card, 34% at AA, 31.8% at Vals. whatmodel.sh's analysis of 1,629 scores finds labs report 6.4% higher than independent testers on average.
• Engines: Strata and its forks (Basalt, Xolotl, capy-flash) dominated the week — 552B V4.1 Flash on a single 4090 at ~27 tok/s, Qwen3.8-Flash-Next at 250 tok/s on a 5080. DeepSeek open-sourced DeepInfer; Eagle-4 drafting claims to beat DFlash2. llama.cpp v0.7.0 moved the default server port from 8080 to 9931 — check your scripts.

From the index

No new listings this week, and the catalog is now visibly behind the releases. /torrent/deepseek-v4-1-flash/ (552B, MIT, 510 GB) is the pre-1017 checkpoint; the 1017 revision adds the Engram table and a new vision tower and deserves its own torrent, more so given the DHS "derivatives" language and this week's thread about models quietly vanishing from Hugging Face. /torrent/minimax-m3/ is 854 GB; M3.1 Flash at 252 GB would be the cheapest way to seed a frontier-class MiniMax. And /torrent/kimi-k3/ (1561 GB) tells you what K3.1 Pro will weigh on 4 November — the same architecture at the same precision. Keep that swarm warm; it is about to matter.