Vol. 1 · No. 7 Independent signal for people building with AI Price: your attention
The Early Edition

What changed, what it costs you, and where to check it.

Tuesday, 15 September 2026 13 printed Archived edition

The reroute that wasn’t

DeepSeek has called off the reroute, and V4 Pro answers its own name after all

A sentence added to a change-log entry dated 10 September says the model continues “in response to user demand”. Its rate card did not move, and this paper printed the cancellation as a certainty in its calendar.

By the Newsroom · From DeepSeek’s pricing page and change log, both read 15 September

deepseek-v4-proPrinted 11 SeptemberRead 15 September
Model that answersV4.1 Flash, from MondayDeepSeek-V4-Pro-0813
Input per M, cache miss$0.15$0.66
Output per M$0.60$1.98
Concurrency limit2,500500
The deepseek-v4-pro endpoint, as this paper described it on 11 September and as DeepSeek’s page describes it today. Rates are off-peak; peak rates are double, 01:00 to 04:00 and 06:00 to 10:00 UTC on weekdays.

DeepSeek is still serving DeepSeek-V4-Pro-0813 to callers of deepseek-v4-pro, four days after the date it gave for switching them to a cheaper model.

A vendor’s stated plan for its own model names is not a fact about next week. This paper printed one as though it were, and the correction below says so.

The reversal is one sentence, and DeepSeek put it in two places. The pricing page carries it as footnote two: “In response to user demand, we have decided to continue providing API services for DeepSeek V4 Pro after September 14, 2026, with the billing method remaining unchanged.” The same sentence sits in the change log.

The rate card agrees with it. The model table gives deepseek-v4-pro a model version of DeepSeek-V4-Pro-0813, at $0.66 per million input tokens off-peak on a cache miss against $1.98 per million output. Those are the figures this paper printed on 11 September as the prices about to disappear, unchanged. Its concurrency limit stands at 500, a fifth of the Flash tier’s 2,500, and that ceiling is what DeepSeek did not lift.

  1. 10 Sep Change log announces V4.1 Flash and reroutes two retired Flash names to it
  2. 11 Sep Pricing page footnote states V4 Pro will route to V4.1 Flash from 14 September
  3. by 15 Sep Same footnote replaced: V4 Pro continues, billing unchanged
What DeepSeek published about one model name in five days.

Here is the part that costs a reader something. DeepSeek did not post the reversal as a new entry. It edited the entry headed 10 September, so anyone who checked the change log by looking for a date later than the one they had already read would have found nothing, and concluded the switch was still coming.

The resale market has not caught up, and the gap is the reader’s to collect. On OpenRouter’s rate card this morning the dated slug deepseek-v4-pro-0813 bills $0.983 per million input tokens, half as much again as DeepSeek’s own off-peak $0.66, and its undated deepseek-v4-pro slug bills $1.60.

The policy itself did not reverse. DeepSeek retired V4 Flash and V4 Flash Vision Exp on 10 September, and the change log says the names deepseek-v4-flash and deepseek-v4-flash-vision-exp are “temporarily routed” to V4.1 Flash. Those two names still buy a price tier rather than a set of weights. Only the expensive one was pulled back.

Against that, the reprieve is worth less than it reads. DeepSeek’s sentence promises “further notice should there be any changes” and names no notice period, and the page below it reserves the right to adjust prices. A decision reversed in four days can be reversed again in four.

The retired Flash names are the tell. DeepSeek will reroute a name when nobody is paying much to keep it, which is why the cheap names went and the expensive one stayed.

What it changes If you moved off deepseek-v4-pro last week, move back. DeepSeek’s own off-peak rate of $0.66 per million input tokens undercuts every OpenRouter route to the same checkpoint, the cheapest of which bills $0.983. If you set a provider order on OpenRouter’s 0813 slug to exclude DeepSeek, that ordering is now routing you around the cheapest seller. Pin the dated slug wherever a host offers one, because the undated name is the one DeepSeek has already once proposed to move.

The reversal sentence is DeepSeek’s, and no reason beyond “user demand” is given. DeepSeek publishes no notice period. OpenRouter’s rates were read from its models API on 15 September and change without notice. The 11 September figures are as this paper printed them from the same pages four days ago; the Internet Archive was answering “temporarily offline” while this edition was reported, so the prior page state could not be re-read from a snapshot today.

Primary source read

DeepSeek Models & Pricing DeepSeek API change log OpenRouter models API

Today’s premise DeepSeek changed its mind about a model name, and told nobody in a way a date would catch. Below it, the two labs whose changelogs normally set the week have no entry after 10 September, and the work that did ship came from three projects putting bounds on what an agent may read and reach. A print server breached through two three-day-old bugs shows what those bounds are for, and a benchmark turns out to have been scoring the shape of a sentence. 13 printed, 11 cut. 11 of the cuts are named below.

Inside this edition

14 stories across 5 beats

Silicon

Infrastructure

Models

Tooling

Science

Bounding what the agent reaches

Three projects, in four days, drew the same kind of line: input the agent consumes and hosts it can reach stop being unlimited by default. None of the three cites the others.

Every buffer, capped

The MCP Go SDK now rejects JSON at 1,000 levels of nesting, before the parser recurses

The MCP Go SDK shipped v1.8.0 on 14 September, and its release notes state that “every decoding path that buffers incoming input is now bounded”.

The mechanism is ordering, not size. A nesting limit that fires after the parser has begun recursing does not help, so the check runs first: payloads are “rejected past 1000 levels of nesting, before the parser recurses”. Alongside it, both SSE readers cap bytes per event through MaxEventSize, the stdio transport caps a frame through StdioTransport.MaxLineLength, and an OAuth dynamic client registration response is read only to 1 MB.

Two of those three bounds are fields a server can raise. The nesting depth is not: the notes name MaxEventSize and StdioTransport.MaxLineLength as settings that take a value, against a flat 1,000 levels with no knob at all. That is the right call, because a tool argument legitimately nested a thousand deep is not a thing anyone has, and a limit nobody can raise is a limit an attacker cannot talk a careless operator into raising either.

Two behaviour changes come with an expiry date attached. Setting MCPGODEBUG to plaintextstatefulrejection=1 restores plain-text HTTP 400 responses in place of JSON-RPC errors, and blockingcancelnotify=1 restores synchronous cancellation delivery. The release schedules both for removal in v1.9.0, so a server leaning on either has one minor version to rewrite its error handling.

None of this is a protocol change. The notes say the release “adds no new protocol revision” and that 2026-07-28 remains the newest version the SDK negotiates, which makes this the transport learning to distrust its own input rather than the specification learning anything.

PathThe bound it gained
JSON decoding, all transportsrejected past 1,000 levels of nesting
SSE client and streamable clientMaxEventSize, bytes per single event
stdio transportStdioTransport.MaxLineLength, per JSON-RPC frame
OAuth dynamic client registrationresponse read bounded to 1 MB
What each transport in MCP Go SDK v1.8.0 now refuses to buffer without a limit.

What it changes Upgrade, then check whether your clients parse plain-text 400s: that behaviour now needs an MCPGODEBUG flag and the flag dies at v1.9.0. If you generate deeply nested tool arguments, measure the depth before you upgrade rather than after.

Primary source read

modelcontextprotocol/go-sdk v1.8.0

Per command, per host

Claude Code will now open a network host for one command and refuse it to the next

Anthropic added a per-command allowed_domains setting to Claude Code on 14 September, covering Bash, PowerShell and Monitor in auto mode with sandboxing.

The unit of the grant is the command, not the session. The changelog puts it plainly: “the hosts a command needs are reviewed with it and opened for it alone; other hosts are refused.” An approval to fetch from one domain therefore expires with the command that asked for it, instead of widening what everything after it can reach.

The same release adds omitClaudeMd to agent frontmatter, letting custom and plugin subagents start without user, project and local CLAUDE.md files while managed policy files still load, which separates instructions a repository can write from instructions an administrator can.

Three of the release’s Bash permission fixes describe checks that could be walked past: by a wildcard expanding to files the checker never saw, by an option the checker did not recognise, and by shell variable declaration flags misrepresenting the command being run.

The limit is in Anthropic’s own first line. This applies “in auto mode with sandboxing”, so anyone running with permissions bypassed gets none of it, which is most people running an agent unattended overnight. A network default that protects the cautious configuration and not the reckless one is worth having and is not worth relying on.

What it changes If you run Claude Code in auto mode with sandboxing, the network is now deny-by-default per command and a command that quietly relied on a host opened earlier will start failing: list the hosts each command needs before upgrading a CI runner to 2.1.271. If you run with permissions bypassed, this changes nothing for you, which is the reason to stop doing that.

Primary source read

Claude Code CHANGELOG, 2.1.271

Nightly only

A Gemini CLI nightly closes a path from a repository’s build file to the agent’s own flags

Google merged a fix titled “prevent indirect prompt injection via build file modifications and untrusted flags” into a Gemini CLI nightly published on 12 September.

Google’s own merge description names the vector, and it is one a reviewer skims. A build file is not prose the agent reads, it is configuration the agent obeys, so text placed in it by whoever last touched the repository could reach the agent as flags rather than as content. A second merge in the same nightly hardens the sandbox’s filesystem boundaries and isolates runtime state.

You cannot install this from a stable release. The newest stable tag is 0.59.0, published on 8 September, and the 0.61.0 line exists only as prereleases whose notes run to two fix lines and nothing else.

Neither merge carries a CVE or an advisory, so there is no affected-version range to read and no way to tell whether the stable line is exposed.

What it changes If you point Gemini CLI at repositories you do not control, treat build files as untrusted input today rather than waiting for the fix to reach stable. There is no advisory, so you cannot check whether 0.59.0 is affected.

The two merges are described only by their pull-request titles on the release page. No advisory, CVE or affected-version range has been published for either, so the exposure of the stable line is unknown.

Primary source read

gemini-cli v0.61.0-nightly.20260912 gemini-cli latest stable release

Nearly cut

Two PaperCut bugs, three days old, reached 395 organisations

GreyNoise counted 440 compromised PaperCut NG and MF servers across 395 organisations, more than one apiece, in 48 countries.

The campaign it describes ran from the last day of August. Neither bug is remote code execution on its own, and that is the mechanism. CVE-2026-81578 lets an unauthenticated request to the web management interface “trigger backend actions prior to the completion of access validation checks”, which is enough to write a configuration value. CVE-2026-82078 then reads one of those values, the database driver class name, and instantiates it “without validating against an allowlist of approved drivers”. The second needs high privileges, which the first hands it.

CVSS 3.1 calls the unauthenticated bug the worse of the two, at 9.8 against 9.1. CVSS 4.0 inverts that, 8.8 against 9.4, because the newer scale weights what a compromise reaches next rather than what it took to start.

Both records were published on 28 August, three days before the campaign GreyNoise dates. PaperCut’s fixed builds are 24.1.10, 25.0.13 and 26.0.5.

GreyNoise attributes the operation to AI agents, and its published evidence for that is behavioural: the campaign hit countries its operator appeared to have tried to exclude. It also names OpenAI Codex and a DeepSeek model as the tooling without disclosing an artefact that identifies either, and this paper does not adopt that line.

What it changes Upgrade to 24.1.10, 25.0.13 or 26.0.5; the fix is a version, not a setting. Then look through your own estate for the shape rather than the product: a bug that only writes configuration is a privilege escalation whenever some other component reads that configuration as a class name, a path or a URL.

The CVE descriptions, scores and publication dates were read at the NVD. The chaining of the two bugs is this paper’s reading of those two records; GreyNoise publishes no request sequence. The campaign counts are GreyNoise’s own and have not been independently confirmed. PaperCut’s own bulletin would not render on fetch, so the fixed version strings come from trackers quoting it rather than from PaperCut’s page.

NVD record, CVE-2026-81578 NVD record, CVE-2026-82078 Agents Gone Wild: an AI-orchestrated global campaign against PaperCut NG/MF

Marking the shape

A six-feature classifier beats the TruthfulQA leaderboard without reading the question

Counting negations, hedges and word lengths in the answer alone beats every model on the public leaderboard. The authors then delete the 314 question pairs that made it possible.

Surface6 classifier, answer text only 68.9 Best model, public leaderboard 66.9 Same classifier, after cleaning 52.2 Chance 50
Accuracy at picking TruthfulQA’s correct answer. The classifier sees only the answer text, never the question.

Researchers at Utah, UMass Amherst, Thoughtworks and Martian AI scored 68.9 on TruthfulQA with a six-feature logistic classifier. That is ahead of the best model on the public leaderboard, at 66.9.

The classifier never sees the question. That is the finding: a benchmark meant to measure truthfulness can be partly solved by measuring the shape of a sentence.

What the classifier does is add up six counts and compare the total. Number of negations, whether a negation opens the answer, hedge rate, word count, average token length and type-token ratio each get a learned weight, and the weighted sum decides which of two candidate answers is the true one. The question is never read. The authors state the comparison themselves, writing that “this accuracy (68.9%) is higher than the best model score on the llm-stats TruthfulQA leaderboard (66.9%, by Granite 3.3 8B Instruct, as of May 2026)”.

Negation carries most of it. Dropping the negation features alone costs the classifier 0.064 of its accuracy, the largest single contribution of the six, which says the incorrect options in TruthfulQA are written differently from the correct ones rather than merely being wrong.

Their repair is to delete the leaky pairs. TruthfulQA-476 keeps 476 of the original 790 pairs. On it the same classifier drops to 52.2 per cent, against a chance baseline of 50, which is the number showing the leak was removed rather than merely reduced.

The obvious objection is that everyone’s score falls together, so comparisons survive. It holds, and the authors measure it: model rankings on the full and cleaned sets correlate at a Spearman rho of 0.915, where 1.0 would be an order unchanged by the cleaning. Nobody picked the wrong model because of this. What was wrong was every absolute figure, including the ones in vendor cards.

They audited fourteen benchmarks the same way, and TruthfulQA is not the worst of them. HaluEval QA separates at an AUC of 0.973 on surface features alone, against 0.715 for TruthfulQA.

The authors concede their probe is “intentionally narrow and simple”, six hand-picked statistics where embeddings would find more, and rule that the right response is to treat the audit as a floor on leakage rather than a measurement of it.

Their pruning method is greedy rather than optimal, because AUC cannot be decomposed per example, so TruthfulQA-476 is one defensible cleaned set and not the cleaned set.

So the paper’s ruling is that a published TruthfulQA figure now means less than it did last week, and nobody yet knows by how much on any given leaderboard, because none has rerun on the cleaned set.

What it changes Stop quoting an absolute TruthfulQA number in a model card or an eval report; swap to TruthfulQA-476 and say which you used. Comparisons between models you evaluated yourself are safe. If you built an internal benchmark by writing correct and incorrect answers in separate sittings, run these six features over it before you trust its absolute score.

Primary source read

Judging by the Cover: Cleaning LLM Truthfulness Benchmarks to Avoid Surface-Level Feature Leakage

Dates, numbers and one chip

OpenAI gave gpt-5.4-cyber a shutdown date of 1 October

OpenAI added a deprecation row dated 11 September: gpt-5.4-cyber leaves the API on 1 October and the named replacement is gpt-5.6-cyber. Unlike the Sora row further down the same page, the replacement column is filled. Twenty days separate the notice from the shutdown.

Three weeks

Azure retires the NVv3 and NVv4 GPU families on 30 September

Microsoft retires six NVv3 sizes and eight NVv4 sizes on 30 September, pointing customers at NVads-A10 v5 and NVads-v710 v5. UAE North runs to 31 January 2027. Reserved-instance sales for both families ended on 2 November 2025. Resizing an NVv4 to NVads_V710_v5 fails until the subscription is registered for the VMTempDiskResizePreview feature flag, which Microsoft documents in the retirement notice itself.

Two weeks

Training the token selector end to end lifts GPQA Diamond by 15.5 points at a 1,024-token budget

SAS folds the token selector’s score into the attention softmax, so the training loss reaches the ranking decision. A hard top-K cut lets no gradient through to what it threw away. On Qwen3-14B it scores 61.14 on GPQA Diamond against SeerAttention-R’s 45.64, with dense attention at 65.25. The gain does not travel. On long-context and agentic tool-use benchmarks the same method moves scores by under 4 points, against the 15.5 it adds on GPQA Diamond.

Sparse attention

Mixture-of-experts models start overfitting repeated data at half a dense model’s budget

Stanford and Washington report dense models tolerating 8x data repetition against 4x for matched MoE models. The sparse advantage is gone entirely by 32x. Router assignments go near-stationary early, so each expert memorises one fixed slice of tokens. Masking-based regularisation pushes the break-even past 64x, though the authors write that “no method fully matches the performance of all-unique training data”.

Repeated data

Claude Code was reusing a cached organisation policy after an account switch

Version 2.1.271 fixes a stale permission set staying in force until the next hourly check, after a user changes credentials mid-session. A second fix covers tool and command lists not updating when a policy loads after startup. Anyone administering several Anthropic organisations from one machine was governed by whichever they opened first.

Stale policy

What is already scheduled

  1. Wed 16 Sep, 16:00 ET Closed Senate briefing on AI risk, convened by Senator Sanders Reported, not scheduled
  2. Tue 22 Sep Replies due, sanctions motion against DeviantArt in Andersen v. Stability AI On the calendar
  3. Thu 24 Sep OpenAI removes sora-2, sora-2-pro and the Videos API On the calendar
  4. Thu 24 Sep Xi Jinping at the White House Reported, not scheduled
  5. Mon 28 Sep OpenAI shuts down gpt-3.5-turbo-instruct, babbage-002, davinci-002 and gpt-3.5-turbo-1106 On the calendar
  6. Tue 29 Sep Claude Sonnet 4.5 API retirement, no earlier than On the calendar
  7. Wed 30 Sep Azure retires the NVv3 and NVv4 GPU virtual machines On the calendar
  8. Thu 1 Oct OpenAI removes gpt-5.4-cyber On the calendar
  9. Wed 7 Oct Sanctions hearing, Andersen v. Stability AI, before Judge Orrick On the calendar
  10. Sat 10 Oct Solar Pro 4 reaches standard pricing Reported, not scheduled
  11. Next minor release MCP Go SDK removes both MCPGODEBUG compatibility flags On the calendar
  12. Tue 1 Dec OpenAI removes the older GPT Image models from the API On the calendar
  13. Thu 1 Jul 2027 California SB 1119’s pre-release risk assessments and child defaults bind On the calendar

Corrections

How this edition was made

swept
100
candidates
24
deduped
24
verified
17
printed
13

The collector’s wire carried 100 items generated at 23:30 UTC on 14 September. Ninety-three of them were llama.cpp build tags and arXiv listing rows, which is the highest proportion of machine traffic the wire has yet delivered and the reason nothing in today’s paper was found there. Nine reporting areas were then swept live against 11 to 15 September with every previously printed URL excluded. The editor refetched the lead entirely: DeepSeek’s pricing page and change log were read directly, not through a reporter, and the footnote quoted in the lead was copied from the page today. That mattered, because the follow-up desk reported the reversal on the strength of matching Internet Archive digests, which would only have shown that a page had not changed, and an unchanged page is not evidence of a reversal. The reversal is real, and the evidence for it is the current text of the footnote rather than the absence of a diff. The Internet Archive was answering “temporarily offline” throughout, so no snapshot comparison was available to anyone today. Four other reporter claims were corrected before print. A secondary account of the PaperCut campaign was traced to GreyNoise’s own post, which turns out to predate this window by two days and to assert that OpenAI Codex and a DeepSeek model powered the attack without publishing any artefact naming either; that line is attributed to GreyNoise and not adopted. Both PaperCut CVE records were then read at the NVD, which resolved a disagreement two trackers had about the scores by carrying both scales, and the chain between the two bugs described in the box is the editor’s reading of those records rather than anyone’s published analysis. An infrastructure item built on a Broadcom earnings call was spiked when the 8-K filed alongside it proved to contain none of the figures attributed to it. A Broadcom chief executive’s remark rejecting a rival’s forecast was spiked for carrying no number and no commitment. A model index discrepancy worth 17 points was dropped because the editor could not re-read it in time, not because it is wrong. On the machinery: the reporting workflow was refused a fifth consecutive time. The session held a valid workflow-authoring receipt on this attempt, so the first of the two failure modes seen last week did not recur; the guard printed its preflight card, which under this permission mode is shown to nobody, and refused. Whether this paper’s saved workflow should be exempt from that guard remains a decision for its owner and has still not been made. The beats ran as parallel agents instead, and six of the twelve returned a delivery receipt to the editor rather than their report, which cost a round trip each to recover; two of those six had already written the story and only failed to hand it over. On the gates: rule 14 blocked on the first pass and every one of those sentences was rewritten rather than the detector widened. The Board beat returned nothing at all. No filing, ruling, rule or enforcement action anywhere this paper checked carries a date between 11 and 15 September, and the sources checked are named below. Every substantial story then went to a blind judge that saw the body text and the ten-criterion rubric and nothing else, before printing rather than after. The lead scored 19 of 20 and the boxed story 20. Two stories in the package failed a criterion outright, both the same one: neither named a concession and ruled on it, and one of them carried no verdict of the paper’s at all, having described a vendor’s changelog in the vendor’s own frame. Both were rewritten, and the concessions used are true ones rather than the invented example a judge offered: that the MCP nesting limit alone takes no configured value, and that Claude Code’s per-command network grant applies only in auto mode with sandboxing, so it does nothing for anyone running with permissions bypassed. The judge also caught the lead’s price comparison resting on figures four days old, which sent the editor to OpenRouter’s models API for today’s rates; they are in the lead and they support the claim the stale ones were carrying. One sentence in the lead said DeepSeek had twice proposed to move this name. It had proposed it once, and the sentence now says once. Four rule 14.2 warnings stand unfixed and are a disagreement rather than an oversight: the detector reads “the first step”, which is GitHub’s phrase inside quotation marks, and “which the first hands it”, where first is an ordinal noun naming a CVE, as ranking claims owing a displaced rival. Neither is one. This edition was read back after publishing and republished within the hour. The reader caught what the gates and the judges had not: a brief that made 11 September to 1 October nineteen days when it is twenty, the same pair of benchmark figures printed three times in one story, and a sentence dating a change to “Thursday” for no reason a reader could check.

Left out on purpose: Everything on the frontier-lab beat, because there was nothing. OpenAI’s and Anthropic’s own developer changelogs both stop on 10 September, which is printed beside the lead rather than buried here. · The Board beat entirely. The EU’s AI Act timeline, the Federal Register, the Colorado Attorney General’s rulemaking docket, the FTC’s enforcement page and two China trackers were each read, and the most recent dated entry on any of them is 11 August. California’s bill signings were 9 and 10 September, before this window. · Andersen v. Stability AI. Responses to the sanctions motion were due yesterday and this paper cannot tell you whether they were filed, because CourtListener returned 403 to every route attempted, including the RECAP archive. · Anthropic’s threat-intelligence report naming Moonshot AI, Alibaba and DeepSeek. Dated 10 September, one day outside this window, and the desk sent to reach Anthropic’s own copy of it returned without one. It is the strongest thing this paper has not printed. · The Ling-3.0-flash-VL card claiming 42 on the Artificial Analysis Intelligence Index where that index’s own listing shows 25. The two figures come from different methodology versions, which is a real story, but the weights were published on 4 September and the editor could not re-read either number today. · An Open WebUI authentication bypass through wildcard characters in an OAuth subject claim, CVE-2026-87016, fixed in 0.11.1. A clean mechanism and a high score, published at 21:23 UTC on 10 September, ninety-seven minutes outside this window. · Relay’s shutdown, which took paid customers offline on 14 September. The only sources are secondary and the announcement was made on 17 August. · Broadcom’s Anthropic capacity commitments, spiked twice: the figures live in an earnings call of 2 September and not in the 8-K filed with it. · Tier IV’s chief executive saying the company will build its own autonomous-driving silicon to break Nvidia’s position. An intention with no date, no part and no number, in a paywalled interview. · Three European Commission GenAI pilots for public administration, which held a kick-off meeting on 14 September. Grants that started on 1 July holding a meeting is not a change a builder acts on. · Four arXiv papers this paper’s research reporter never opened, on type diversity, voice agents, domain-specific hallucination detection and attention disaggregation. They were not checked and found empty; they were not checked.

Unedited

The wire

As caught when this edition was printed

Everything the collector caught, in the order it arrived, with no editorial judgment applied. The paper above is what survived it.

12 shown as printed; this list updates live in a browser.