- The NSA, CISA and FBI jointly named DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI, alleging distillation campaigns against US models running since at least late 2024.
- The agencies argue DeepSeek's famous $5.6 million training figure is misleading, because it leaves out the data they say was taken this way.
- A day after being named, DeepSeek opened a limited beta of V4.1 Flash, its first V4-series model with multimodal support built into the architecture instead of bolted on top.
- OpenAI says an unreleased internal system proved a Millennium Prize problem. An NYU mathematician says the method was not OpenAI's idea first.
- Where a model runs, and who owns the hardware it runs on, is turning into a procurement question. Our plain-English starting point is what hosted AI agents really are.
Two arguments broke out this week, and underneath they're the same argument. One is about a million-dollar math problem and who thought of the method first. The other is about billions of API calls and whose model taught whose. Both land on provenance: when a machine produces the work, how do you prove where it came from?
Provenance used to be a word for lawyers and art dealers. It's now a line item in your vendor questionnaire.
The Front Page: Three US Agencies Name Six Chinese AI Labs
The NSA, CISA and the FBI published a joint advisory on September 8, catalogued as AA26-251A, naming DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI. The agencies allege "aggressive, malicious, and targeted" distillation campaigns dating back to at least late 2024. The advisory is posted on CISA's site, and Unite.AI walked through the specifics.
Distillation is a normal training technique. You feed a smaller model the outputs of a larger one so it inherits some of the big model's behavior for a fraction of the compute. Labs do this to their own models constantly. The accusation here isn't about the method, it's about scale and consent: the agencies say the six companies pulled billions of tokens out of American APIs, and they list the models allegedly on the receiving end, including Claude, Gemini, GPT and Grok releases.
The sharpest line is financial. The agencies argue DeepSeek's widely repeated $5.6 million training cost is misleading because it excludes the value of data obtained this way. That figure has done enormous work in AI discourse for eighteen months. It's the number people reach for when they want to say frontier training costs are collapsing.
Keep the skepticism pointed both ways, though. Three agencies with an obvious national interest published this without the underlying evidence attached, in a week when chip export bills are moving in Washington. Nothing here has been through a court. Read it as a serious, sourced accusation, not a finding of fact.
What it means: If you run an AI API, enforcing your terms of service just became a security job. The trouble is that a scraping fleet and a legitimate agent fleet look identical from the server side: high volume, repetitive, structured, running at three in the morning. Expect tighter rate limits and more identity checks for people doing perfectly ordinary automation. If you buy models rather than train them, add one question to the evaluation you already run when you wire an agent into a workflow: where did this training data come from, and can you show me?
Releases & Features
DeepSeek V4.1 Flash. The timing is almost too good. A day after being named in the advisory, DeepSeek opened a limited beta of V4.1 Flash, which it calls the biggest architecture change to the V4 line since April. August's release bolted a vision pack onto the text model; this one handles text, images and speech natively inside one architecture, according to TechNode. Beta pricing matches V4 Flash, accounts are capped at 20 concurrent requests, and the endpoint expires around September 10. DeepSeek hasn't called it a formal launch.
OUI-1 from Thesys. Easy to miss, worth a look: Thesys published what it describes as the first open-weights model for generative UI, meaning a model that outputs interface components rather than paragraphs. Details here. Weights are downloadable under Gemma terms rather than a fully permissive license, so read those first.
What it means: Two very different bets in the same week. A large lab shipping quietly into a political storm on an endpoint that self-destructs in days, and a small team giving away a category nobody has locked down yet. The second kind is where builders get leverage: an open model in a narrow lane usually beats a general model you rent by the token.
In the Lab
OpenAI says an internal model, described as significantly more capable than GPT-6 Astra and unavailable to anyone outside the company, produced a proof that the three-dimensional Navier-Stokes equations can develop a singularity in finite time. Roughly 10,000 agents coordinated for about 88 hours to get there, per the company. Navier-Stokes describes how fluids move, and whether its solutions can blow up is one of the seven Millennium Prize Problems. OpenAI says it won't claim the $1 million. Quanta covered the result; Scientific American covered the storm around it.
And the storm is the story. NYU's Tristan Buckmaster, who with Anthropic researcher Levent Alpöge posted blowup preprints the night before, alleges OpenAI learned in the preceding week what method the pair were using and adopted it. OpenAI mathematician Sébastien Bubeck denies that account. MIT Technology Review has the fullest write-up.
What it means: Notice how differently the two results arrived. One side posted artifacts you can run through a proof checker. The other held a call with reporters about a model nobody outside the building can touch. Both may be correct. Only one can be checked by a stranger today, and as machines outpace human refereeing, that's the property that decides what anybody believes.
The Oversight Desk
Quieter, and on a deadline. By September 15, providers of general-purpose AI models trained above 1025 floating point operations file their first formal systemic-risk evaluations with the European AI Office. FLOPs are just a count of the arithmetic operations burned during training, used here as a rough proxy for model size, and that threshold is the EU AI Act's line for "systemic risk." The Office says it will review red-teaming methodology, energy disclosures, and compliance with the standardized copyright training-data summary template it published in July. The AI Act's guidelines overview lays out the obligations.
What it means: Two governments reached the same demand from opposite directions this week. Washington's version is an accusation about where training data came from. Brussels' is a form asking the same question in advance, in writing, with a filing date. Neither targets small builders, and neither will leave them alone for long, because the answers travel down the supply chain as vendor attestations. The practical move is unglamorous: start recording which model version produced which output.
Provenance is a paperwork problem, and paperwork problems are exactly what agents are good at. Describe the record you wish you had, and BYOBot will hand back a spec for the agent that keeps it.
On the Radar
Smaller moves worth a glance, with the sources if you want to go deeper.
- Google commits about $15.1 billion to Finland. Data centers across 2027 and 2028, backed by a 22-year Fortum power purchase agreement that keeps the Loviisa nuclear plant running past 2030. Source.
- Qualcomm and Amazon go multi-generational on custom silicon. Inference-focused data center chips, with Qualcomm issuing Amazon warrants for 25 million shares at $161.26 each, roughly $4 billion. Source.
- IFM's K2 Horizon opens the whole recipe. Six foundation models from 0.9B to 375B parameters, released with weights, code, training data and methodology rather than weights alone. Source.
- Meta wants an agent inside your inbox. Reporting points to an AI agent embedded in email, calendar and checkout flows, a very different consent conversation from a chatbot in a tab. Source.
The Bottom Line
Strip out the flags and the headline numbers and today was one question asked twice: prove where this came from. A mathematician wants credit traced. Three agencies want training data traced. Brussels wants both in writing by Monday. The labs that can answer cleanly will find that boring capability worth more than a benchmark score by year end. You can start keeping that record on your own work this afternoon, which beats watching to see who wins the argument.
Frequently Asked Questions
-
Distillation means training a smaller model on the outputs of a larger one, so the small model picks up some of the big model's behavior for a fraction of the training cost. As a technique it's ordinary, and labs use it on their own models routinely. What the September 8 advisory alleges is different in scale and consent: pulling billions of tokens out of someone else's paid API in order to skip the research bill. That's a terms-of-service question and possibly a trade-secrets question, not a math question. If you're weighing vendors on price alone, our map of the AI automation tool landscape is a better place to start comparing.
-
A proof assistant such as Lean walks an argument line by line and refuses any step that doesn't follow. Ship a result as a machine-checkable file and any stranger can rerun the check. Ship it as a press release and they're trusting the announcer. The same logic applies to everyday work: an agent that shows its inputs and intermediate steps can be audited, and one that returns a confident paragraph cannot. That's why we push people to write a workflow spec before they automate anything that matters.
-
AI Daily Newsstand is BYOBot's daily AI news brief, published every night. It covers the day's model releases, new features and capabilities, research, and oversight news, then tells you what each move means for people building with AI, in plain English and without the hype.
