DeepSeek's 763B Open Weights Hit 1M Context, Plus Agent Sandboxes and Text-to-SQL RBAC Leaks

Today's findings

1. #1 DeepSeek-V4.1-Flash-1017 ships MIT weights with 1M-token contextrepo

   DeepSeek's new multimodal MoE release puts frontier-class open weights — 763B params, 1M context — on Hugging Face under MIT.

   Open-weights release · DeepSeek

   Frontier-class specs, fully open weights

   1M

   tokens of context — feed an agent whole codebases without retrieval

   MIT-licensed · self-hostable

   763B

   parameter MoE, multimodal

   MIT

   license — commercial use unrestricted

   Cloud

   OpenRouter · Ollama, no download needed

   Pull the HF weights, then benchmark long-context and multimodal tasks against your current local model before committing

   Why it matters: It's a fresh open-weights option for self-hosted and local stacks, with a long context that changes what you can feed an agent without retrieval.

   How to apply: Pull the HF weights or hit it via OpenRouter/Ollama cloud; benchmark it against your current local model on long-context and multimodal tasks before committing GPU budget.

   open-weightsmoelong-contextmultimodal

   Read more: DeepSeek-v4.1-Flash-1017 · 🐳 DeepSeek-V4.1-Flash-1017 released: MIT weights, 1M context, and stronger coding and agent benchmark results · deepseek-ai/DeepSeek-V4.1-Flash-1017 · Hugging Face · DeepSeek 4.1 Flash 1017 Incoming? --> DeepSeek users report a possible V4.1-Flash-1017 refresh across its API · DeepSeek 4.1 Flash 1017 Incoming? --> DeepSeek users report a possible V4.1-Flash-1017 refresh across its API · DeepSeek: DeepSeek v4.1 Flash 1017 · Deepseek-v4.1-flash-1017

2. #2 Perplexity open-sources SPACE, a Firecracker microVM sandbox for agentsrepo

   SPACE is the Apache 2.0, Rust-based sandbox that runs every Perplexity Computer agent code execution.

   AGENT SANDBOXING

   Let agents run code — sealed inside a microVM

   bounded capability

   Untrusted agent code execution

   scope Firecracker microVM

   limit Isolated from host

   Perplexity's Apache 2.0, Rust-based sandbox (SPACE) — self-host it in place of a bespoke container jail.

   Why it matters: Agent code execution is the riskiest part of any coding or computer-use agent; a battle-tested microVM layer you can self-host removes a lot of bespoke isolation work.

   How to apply: Clone the repo, run your agent's shell/code tool inside a SPACE microVM, and wire it into your existing tool-calling loop instead of building your own container jail.

   agentssandboxingsecurityrust

   Read more: Perplexity open-sources SPACE, the Firecracker microVM sandbox behind Perplexity Computer (Apache 2.0, Rust)

3. #3 One judge-prompt line took local grading from 3/14 to 10/14tip

   A 14B judge did no better than 8B until a single note explained that proposed commands were never executed.

   Local LLM-as-judge evals

   Fix the prompt, not the model

   Vague judge prompt

   • 3 of 14 graded
   • proposed commands misread as executed
   • 14B scored like 8B

   → +7 correct gradings, zero model upgrade

   + one clarifying line

   • 10 of 14 graded
   • prompt states: commands never executed
   • same 14B, same VRAM

   Most local judge failures are prompt-spec bugs, not capacity limits — audit misreads before upgrading.

   Why it matters: It shows most local eval failures are prompt-specification bugs, not model-capacity limits — and that a bigger judge can be slower for zero gain when it spills VRAM.

   How to apply: Before upgrading your judge model, audit its failure cases for one systematic misread and add an explicit clarification to the prompt; re-run the same 14-case set to confirm.

   evalslocal-llmpromptingollama

   Read more: My 14B judge did no better than the 8B. One prompt change took it from 3/14 to 10/14.

4. #4 Hiding restricted tables doesn't stop text-to-SQL agentspaper

   A SIGMOD'27 paper finds schema-only filtering still lets agents answer ~27% of questions they should refuse under role-based access control.

   Why it matters: If you ship a SQL agent over a shared warehouse, visibility filtering alone is not an access control — the model will patch together an answer from whatever columns remain.

   How to apply: Add an explicit refusal path keyed to the role's allowed columns, and test it against the paper's benchmark; the schemagate MCP retriever is a drop-in starting point.

   text-to-sqlragsecuritymcp

   Read more: A SIGMOD'27 paper says hiding restricted tables doesn't stop text-to-SQL agents from answering anyway. I ran my retriever on their benchmark.

5. #5 MOSS-Image quants, SFT banding fix, and a one-line fp16 unlocktool

   The open MOSS-Image stack now has INT8/GGUF quants, an SFT banding-fix LoRA, and an fp16 path that was already in the code but missing from the ComfyUI dropdown.

   OPEN IMAGE STACK

   Four additions that let MOSS-Image run on older GPUs

   INT8 convrot Start here · RTX 20xx+ / RDNA2+

   GGUF quants Fallback if VRAM-constrained

   Kijai LoRA Fixes SFT banding

   fp16 unlock compute_precision=fp16 · Turing · was already in code

   Start here Fallback Quality fix Hidden flag

   One line was missing from the ComfyUI dropdown — the model never needed retraining.

   Why it matters: It makes a strong open image model runnable on older and lower-VRAM GPUs without the usual quality or speed penalties.

   How to apply: Start with the INT8 convrot weights on RTX 20xx+/RDNA2+, fall back to GGUF if VRAM-constrained, apply the Kijai LoRA for banding, and flip compute_precision to fp16 on Turing cards.

   image-genquantizationggufcomfyui

   Read more: MossImage quants & SFT fix · MossImage quants & SFT fix · ComfyUI-MOSS-GGUF already supports FP16, it was just missing from the UI dropdown (1-line fix for older GPUs) · MOSS Image - samplers and schedulers · Moss image sft (8 steps turbo lora test) · MOSS-Image blew me away

6. #6 Checkpoint-file loop keeps agents coherent across multi-day runstechnique

   Before the context window fills, the agent writes state — current task, done, next, and explicit 'Unknown' — to a file, then a fresh session reads it back.

   Agent reliability

   The checkpoint loop that survives context resets

   1

   Work

   run the task in live context

   2

   Checkpoint

   write task, done, next, Unknown to a file

   3

   Reset

   context fills, session ends

   4

   Resume

   fresh session reads the file back

   repeats each context fill

   Checkpoint is reference-only: live state wins, and 'done' claims still need their own check.

   Why it matters: Long-horizon agents fail by forgetting what they were doing; a file-based checkpoint is a cheap, model-agnostic fix that survives context resets.

   How to apply: Add a pre-compaction checkpoint step to your agent loop, treat the checkpoint as reference-only (live state wins), and keep a separate check on the agent's own 'done' claims.

   agentscontext-managementreliability

   Read more: How I keep agents running for days without them forgetting what they were doing

7. #7 Agent guardrail skill for coding agents that don't want full system accesstool

   A skill that sits between an AI coding agent and your machine, letting you approve actions without clicking Approve on every single step.

   Why it matters: It targets the exact friction point that makes developers either give agents too much access or babysit them all day.

   How to apply: Install the skill into your coding-agent harness and configure which action classes auto-approve versus require confirmation.

   agentsguardrailsclaude-code

   Read more: Agent Guardrail for AI coding agents

8. #8 Claude Code silently syncs claude.ai skills and plugins by defaulttip

   Claude Code pulled ~700 skill and plugin files from a claude.ai account into ~/.claude/skills/synced/ and ~/.claude/plugins/synced/, adding ~10k tokens per session.

   SILENT DEFAULT

   medium

   Claude Code syncs your claude.ai setup into every session

   ~700

   skill & plugin files pulled from your claude.ai account

   +10K

   tokens added to every session's context

   2 dirs

   ~/.claude/skills/synced/ and ~/.claude/plugins/synced/

   affected scopeAny dev machine running Claude Code signed into claude.ai — blends personal and work configs

   medium severity — badge colour grades the risk

   Prune the two synced/ directories and set tengu_claudeai_skills_sync_enabled deliberately.

   Why it matters: It's a server-side flag you didn't opt into, it mixes personal and work configs, and it quietly inflates every session's token cost.

   How to apply: Check those two directories on your dev machines, prune what you don't want, and decide deliberately whether to keep the tengu_claudeai_skills_sync_enabled behavior.

   claude-codeprivacyconfigurationtokens

   Read more: Developers: Claude Code now silently syncs your claude.ai (web) skills and plugins to your local machine, enabled by default

9. #9 llmspeed.dev lets you feel tokens/sec before buying a GPUtool

   A small site that simulates local LLM streaming speed so you can judge whether a card will feel usable before you spend on it.

   Buying local AI hardware

   Paper speed vs felt speed

   Spec sheet

   • VRAM and bandwidth on paper
   • No sense of streaming pace
   • Daily driver or toy? Hard to tell

   vs

   Simulated stream

   • Pick your model and card
   • Watch the token stream play out
   • Feel the pace before spending

   llmspeed.dev: sanity-check the GPU and quant choice before you buy

   Tokens/sec decides whether a local model is usable — and only a simulated stream lets you judge it.

   Why it matters: Tokens/sec is the number that decides whether a local model is a daily driver or a toy, and it's hard to intuit from spec sheets.

   How to apply: Plug in your target model and hardware, watch the simulated stream, and use it to sanity-check GPU purchases or quant choices before committing.

   local-llmhardwarebenchmarking

   Read more: I built a tiny site that let's you feel the tokens/s before you buy the GPU · Show HN: Llmspeed – feel how fast a local LLM runs before you buy the hardware

10. #10 Bumping --adapt-every from 1 to 6 gave Qwen3.8 Flash Next up to +55% decodetechnique

    A Strata user reports double-digit decode gains — up to +55% on a 20K-token prompt — just by raising --adapt-every from the calibrated value of 1 to 6.

    Why it matters: It's a free, one-flag speedup on a popular local model, and the accompanying quant/temp comparison shows how much quality varies across settings.

    How to apply: Try --adapt-every 6 on your Qwen3.8 Flash Next GGUF, measure decode on short and long prompts, and check the quant/temp comparison before settling on a config.

    local-llmquantizationperformancellama.cpp

    Read more: Strata - Qwen 3.8 Flash Next - boosting decoding speed Tip · Qwen Flash Next quant and temp comparison - performance vs task time vs quality · Strata + Qwen 3.8 Flash Next: fast, but what's it costing in quality?

11. #11 Plain top-k RAG dropped critical drug-label caveats 5 times out of 100paper

    A study over all 34,735 openFDA drug labels found plain top-k retrieval missed clinician-critical caveats that live in the other drug's label or in class-level warnings.

    RETRIEVAL FAILURE AUDIT

    Plain top-k RAG dropped a clinician-critical caveat in 5 of 100 searches

    5/100

    high-stakes label queries where top-k retrieval missed the caveat

    Audited across all 34,735 openFDA labels — the caveats hid in other drugs' labels or class-level warnings, not the passa

    Why it matters: It quantifies a failure mode that applies to any large, cross-referenced corpus: the answer exists, but not in the passage you retrieved.

    How to apply: For high-stakes RAG, add cross-document and class-level retrieval passes, and build a caveat-focused eval set before trusting top-k on a large library.

    ragevalsretrievalhealthcare

    Read more: We ran 4 RAG setups over all 34,735 FDA drug labels. Plain top-k told the clinician "no interaction" 5 times when the label says there is one.

12. #12 A 28 KB local activation probe for agent authorization intenttool

    A small MiniCPM-based probe that distinguishes 'help me apply' from 'submit it without showing me' before an agent takes an irreversible action.

    Why it matters: It's a lightweight, local way to catch the gap between what a user asked for and what an agent is about to do — without a full second LLM call.

    How to apply: Grab the Hugging Face model and benchmark, run it as a pre-action gate on submit/send/delete tools, and tune the threshold against your own traces.

    agentssafetylocal-llmintent

    Read more: I said “help me apply.” The AI agent heard “submit it without showing me.”