Lead Story · Industry

OpenAI’s Brotli Bug Reaches Past Node: Bun, Python and Envoy Need Fixes

Agents testing OpenAI’s own defenses found the flaw; Google rates it 9.2 of 10, and no attacks are reported.

OpenAI says the agent teams it set on its own training defenses also found a flaw in Brotli, a compression library built into Node.js, Bun and Envoy. An unpatched server that accepts compressed input could be taken over by a malicious client, OpenAI writes. An unpatched client that accepts compressed input could be taken over by a malicious server. No login is needed.

From posts by and reports from @levelsio, @OpenAI, The Hacker News, Node.js, OSV: PYSEC-2026-4322, Reuters via Investing.comRead the story

Morning Feature · The Local AI Desk

Sparks Update: MiniMax-M3.1-Flash on Two Sparks, and DeepSeek-1017 From Two to Four

The first two-Spark MiniMax numbers arrived overnight, the pack billed for two Sparks did not fit, and DeepSeek-1017 builders posted an engine comparison and a hybrid rig.

A 2.15 bpw MiniMax-M3.1-Flash pack runs on two Sparks at 30.4 tok/s on code with 300K context. Plus TensorFold against SGLang on three Sparks, a two-Spark DeepSeek build with its drafter on RTX 3090s, Ling 3.1 Flash against an API, and what is still unverified.

Sourced from builders’ posts, model cards and GitHub reposRead the feature

Agents & Coding

Google’s Workspace CLI Ships 100+ Agent Skills for Gmail, Drive and Docs

One npx command installs them; the repo says it is not an officially supported Google product.

@RoundtableSpace points to gws, a command-line tool for Google Workspace from the googleworkspace team on GitHub. Its README says the repo ships 100+ Agent Skills as SKILL.md files: one per supported API, helpers for common workflows and 50 recipes for Gmail, Drive, Docs, Calendar and Sheets.

From posts by and reports from @RoundtableSpace, googleworkspace/cliRead the story

A Free Claude Code Course Walks Through Hooks, Skills and Subagents

Claude How To pairs each feature with copy-paste templates and a beginner-to-advanced path.

@RoundtableSpace recommends Claude How To, a free, MIT-licensed guide on GitHub that goes from typing claude to running agents. The repo has a folder for each feature: slash commands, memory, skills, subagents, MCP, hooks, plugins and checkpoints.

From posts by and reports from @RoundtableSpace, luongnv89/claude-howtoRead the story

@clairevo’s New Prompt Has an Agent Hunt Down Your Old Internet Trail

Forgotten blogs, bios and tagged photos, found through your email and sorted into a sheet.

@clairevo upgraded her security-audit prompt for “your embarrassing internet trail.” It asks an agent to search your email for old blogs, social accounts, photo sites, forums and usernames, then open them in its browser to check for oversharing, cringe bios and photos.

From posts by @clairevoRead the story

Models & Hardware

MiniMax-M3.1-Flash Runs on Two Sparks at Up to 39 Tok/s

@Tech2Wild patched vLLM for a 2.15 bpw pack; the 4.26 bpw build released for two Sparks did not fit.

@Tech2Wild posted the first two-Spark numbers for MiniMax’s 428B model: @ViC305’s SAGE EXL3 2.15 bpw quant at TP2 over RoCE, with 300K context and a 726K-token KV pool. His README measures 39.4 tok/s single-stream on counting, 30.4 on code and 19.8 on prose, and 66.2 tok/s total on code at four users.

From posts by and reports from @Tech2Wild, @ViC305, tonyd2wild/MiniMax-M3.1-Flash-EXL3-TP2-2x-DGX-SparkRead the story

Block’s Dessa Speech Model Runs Locally on an M4 Max Mac

Trained only on human speech, on one GB200 NVL72; it listens and talks at the same time.

@kimmonismus calls Jack Dorsey’s new speech model best in class, and notes it was trained on only one NVIDIA GB200 NVL72. Block’s page says Dessa is a full-duplex speech-to-speech model, trained from scratch on human conversation with no text and no pretrained models.

From posts by and reports from @kimmonismus, @jack, Block: DessaRead the story

Ling 3.1 Flash Took 12 Hours on Four Sparks and 57 Minutes on an API

@sudoingX ran one agent prompt both ways; both builds passed 12 of 12 tests.

@sudoingX ran Ling 3.1 Flash, a 560B MoE with 25B active, on his floating-tree spec twice with Hermes Agent. A Q4 GGUF over llama.cpp RPC on @niklaslenz_ai’s four DGX Sparks took 12h 26m at 7.5 tok/s.

From posts by and reports from @sudoingX, sudoingx/floating-treeRead the story

TensorFold Beats SGLang on DeepSeek-1017 Across Three Sparks

108.6 against 68.3 tok/s at four sessions, with 95.2% on a 133-task German benchmark.

@HandwerkAiLab compared two engines for DeepSeek-V4.1-Flash-1017 on three DGX Sparks at TP3: TensorFold, running @easthambuilds’ 3.5 bpw EXL3 quant, and SGLang. At four sessions TensorFold ran 108.6 tok/s against 68.3, and reached up to 242.9 tok/s across four streams.

From posts by @HandwerkAiLabRead the story

Two Sparks Run DeepSeek-1017 With the Drafter on Two RTX 3090s

An x86 server holds the Engram tables and the drafter; 49.7 to 66.2 tok/s per request.

@NicoTheGreco posted PLI Labs’ build: DeepSeek-V4.1-Flash-1017 at about 2.75 bpw EXL3 across two DGX Sparks. The speculative drafter runs on two NVLinked RTX 3090s, and about 189 GiB of Engram tables sit in an x86 server’s RAM, read over RDMA.

From posts by and reports from @NicoTheGreco, PLI Labs progress reportRead the story

DeepSeek-1017 Runs on One 12 GB GPU and 64 GB of RAM With Strata

ISTA-DASLab’s 2-bit GGUFs keep hot experts in RAM and the rest on SSD; a 5090 owner reports about 14 tok/s.

@coldniko says DeepSeek-V4.1-Flash now runs on 64 GB of RAM with Strata, using GSQ-RCO quantizations by @mhelcig. Strata 0.2.4’s release notes say it keeps the most-used experts in RAM and streams the rest from SSD, on one 12 GB card with 46 to 64 GB of RAM.

From posts by and reports from @coldniko, @jun1228909, Strata releases, ISTA-DASLab GSQ-RCO GGUF cardRead the story

DeepSeek-1017 on a Mac Studio M5 Ultra Runs at 54.5 Tok/s With ds4

@niklaslenz_ai used antirez’s Q2 GGUF; the Engram tables stream from SSD.

@niklaslenz_ai ran antirez’s Q2 GGUF of DeepSeek-V4.1-Flash-1017 on a 256 GB Mac Studio M5 Ultra, in kernelpool’s fork of the ds4 engine. The 152 GiB of main weights stay in memory, and the 189 GiB of Engram tables are read from SSD.

From posts by @niklaslenz_aiRead the story

An Experimental Kernel Lifts Qwen3.8-Flash-Next to 150 Tok/s on a Mac

@ashxhart reports 230 tok/s on code on his M3U Mac Studio, up from about 110.

@MiaAI_lab flags @ashxhart’s numbers: Qwen 3.8 Next Flash at 4 bits hits over 150 tok/s on prose and 230 on code on his M3U Mac Studio, up from around 110. He calls it an experimental kernel he has been working on.

From posts by @MiaAI_lab, @ashxhartRead the story

AI in Accounting & Tax

No AI accounting or tax dispatches from our sources in this edition. Accounting Today’s only post since Friday afternoon was a PCAOB report on audit deficiency rates, with no AI angle.

Industry

Kimi’s K3.1 Pro Launch Draws Fire Over an Influencer Brief

Posted guidelines told creators to skip the paid-partnership label; @kimmonismus says Kimi ruined its own launch.

@elshayib_ posted what he says are Kimi’s promotion templates for K3.1 Pro, and says none of the influencers working with them are honest. A post reposted by @MiaAI_lab lists the overseas guidelines: send drafts for review, skip the Paid Partnership label, add no links and do not tag the official account.

From posts by @kimmonismus, @elshayib_, @MiaAI_lab, @EvanZhouVCRead the story

Thariq Leaves Anthropic After More Than a Year on Claude Code

He is taking a break before something new; @addyosmani and @levelsio send thanks.

Thariq (@trq212) has left Anthropic after more than a year working on Claude Code, which he says scaled larger than he ever imagined. He plans a break before diving into something new.

From posts by @trq212, @addyosmani, @levelsio, @kimmonismusRead the story

The Wire

Quick Hits · Morning Desk

Tailscale Over fail2ban

@levelsio says fail2ban and 2FA make no difference against an exploit: “they’ll just get in.” The point of Tailscale, he writes, is that attackers cannot even reach the box.

@levelsio

Four Sparks, 16 Streams

@sash__mit runs DeepSeek-V4.1-Flash-1017 on four Sparks with a 3.5-bit EXL3 quant by @Libertai_DAI on TensorFold. He reports 70 to 150 tok/s, about 3,000 tok/s prompt reading and 16 parallel streams.

@sash__mit

Faster Long Prompts on Two Sparks

@bertholomusai’s TensorFold TP2 v0.7.1 for DeepSeek-V4.1-Flash reads a 93K prompt 10% faster, at 2,355 tok/s, with byte-identical replies. @RipperdocMD runs it on two Sparks at about 75 tok/s with 512K context.

@bertholomusai · @RipperdocMD · bertholomus/deepseek-v4.1-tensorfold-tp2-2xgb10

DeepSeek Tops Hugging Face

@MiaAI_lab says DeepSeek V4.1 Flash is the No. 1 trending model on Hugging Face. On why she ranks it above Kimi K3.1 Pro: “A big part of it is the value you’re getting for your money.”

@MiaAI_lab · @MiaAI_lab

SparkDash

@ShitSecure likes @MiaAI_lab’s new SparkDash for DGX Sparks: overall token usage, compared against frontier cloud models. Mia reposted it.

@MiaAI_lab · @ShitSecure

More BF16 From a 3090

@MiaAI_lab points RTX 3090 owners to a Linux tool that removes the FP16/BF16 cap on RTX 3000 cards. Users reported a 3090 Ti going from about 87 to 157 TFLOPS BF16. She calls it very experimental.

@MiaAI_lab · @MiaAI_lab

Grok Bot Dictation

@poteto reposts @parker__conrad: Grok Bot is rolling out streaming dictation on mobile, in version 1.18.

@poteto · @parker__conrad

Grok Bot in the EU

@kimmonismus is “super confused” that Grok Bot got EU approval while OpenAI’s dot, Anthropic’s duet and Meta’s Muse did not. It is his daily always-on agent, he adds.

@kimmonismus

Review Metrics, Not Syntax

@unclebobmartin says syntax review makes humans the bottleneck. He reviews test coverage, cyclomatic complexity, duplication, modularity and dependency discipline instead.

@unclebobmartin

Life After the REPL

@simonw used to live in the Python REPL and Jupyter notebooks, and has hardly used either in six months. He was replying to @brandur, who says a one-off LLM-written script now beats the REPL.

@simonw