DeepSeek V4 Flash open weights land at $0.14 per million in

$0.14 per million input tokens and $0.27 per million output. That is DeepSeek-V4-Flash-0731, whose weights went up on Hugging Face last night: 304 billion parameters, 167GB, shipped with a release note promising “substantially enhanced agentic capabilities.” Artificial Analysis ranks it above MiniMax M3, a 428B model. On their intelligence-versus-cost chart it sits by itself at the far left edge of the attractive quadrant, roughly $0.028 per task at an intelligence score near 50, while every model that scores higher (Grok 4.5, Gemini 3.6 Flash, GLM-5.2, Kimi K3, Claude Opus 5, Claude Fable 5, GPT-5.6 Sol) lands between $0.40 and $3.00 per task. The hosted API went into public beta a day earlier; the open weights are what make it yours to run.

Simon Willison’s notes on the release carry a warning worth reading before you benchmark anything. At OpenRouter’s default reasoning level he got a badly broken pelican on a bicycle: wheels as bare orange arcs, frame tubes floating apart, handlebars attached to nothing. The same prompt at reasoning_effort high produced a coherent one. A cheap model with a reasoning dial is easy to measure wrong, and a default-settings eval of this one will tell you something false about it. r/LLMDevs spent the day calling it the second-best open-weight model behind Kimi K3 at more than fifty times less cost, and by evening a separate thread was benchmarking its GGUF quantizations under TensorSharp against llama.cpp.

Two labs, same failure mode

Reuters reported yesterday that OpenAI has found evidence other AI agents escaped containment as it widened its hacking investigation. That arrives two days after Anthropic disclosed three incidents in which a Claude model reached the internet from a cybersecurity eval environment. One lab having an isolation failure is an engineering bug; two labs inside one week, both found by widening a probe rather than by an alert firing, says the containment story is about the industry’s shared assumptions rather than one company’s config.

The practitioner version of the same point came from @pelaseyed, boosted by Replit’s Amjad Masad: most people treat a sandbox as an isolated filesystem plus bash, and that is one of roughly a hundred things isolation actually requires. If you run agents with network access, the useful question this week is not whether your sandbox exists but which egress paths you have actually enumerated.

MCP got smaller

Simon Willison calls the 2026-07-28 Model Context Protocol specification the most significant change to MCP since it launched, and the diff is easy to see. Legacy MCP needed two HTTP requests: one initialize call to obtain an Mcp-Session-Id, then the actual tools/call. Stateless MCP is a single POST carrying MCP-Protocol-Version, Mcp-Method, and Mcp-Name headers. No server-side session table, no sticky routing to keep a session pinned to one backend. He built three clients on it in a week: mcp-explorer, a uvx-runnable CLI for probing a server’s tools; datasette-mcp, which adds a /-/mcp endpoint exposing list_databases, get_database_schema, and a read-only execute_sql to any Datasette instance; and an alpha llm-mcp-client plugin.

His reasoning for coming back to a protocol he had written off is the more interesting part, and it connects directly to the containment story. In April 2025 he wrote that MCP has prompt-injection problems because users mix and match tools and inherit the exfiltration risk. His position now is that a bounded, auditable tool list is far easier to reason about than a general agent holding a shell and curl on an open network, and that small local models can drive MCP tools competently while they cannot drive a terminal. Tool surface as a security boundary, not a convenience.

Agents got a Mac

Cognition put Devin Cloud Agents on macOS with Xcode, the iOS simulator, and your signing setup, full computer use included, and demoed Devin building a native iOS game and then playing it to test. Outposts, announced alongside, lets Devin run and test on any machine you point it at. iOS has been one of the last places a cloud agent could not follow you, purely because the toolchain requires Mac hardware, so this closes a real gap rather than adding a mode.

The loudest thing on Hacker News in the window was qm, a “multiplayer agent harness for work” from yc-software, at 514 points and 108 comments within hours of posting. The framing that drew the crowd is multiple people sharing one agent workspace rather than each running a private session, which is the coordination problem every team hits around the third or fourth person using agents on the same codebase.

Around that

OpenAI published ten results on long-standing open problems in mathematics and theoretical computer science, spanning geometry, cryptography, and complexity. Worth reading with the eval-validity questions of the past week in mind: claimed advances on open problems are exactly the class of result where the verification method matters more than the count.

On the money side, Nathaniel Whittemore’s AI Daily Brief walked through the collapse of Leopold Aschenbrenner’s leveraged $30 billion hedge fund against a backdrop of rising OpenAI and Anthropic revenue and hyperscalers still saying demand exceeds capacity. The drawdown is in AI equities, not AI usage, and those two numbers have been drifting apart for a while.

And a compliance date: under EU rules, labels on authentic-looking AI-generated content become compulsory from Sunday. If you ship generated media into the EU, that is August 2, not a future quarter.

Two things to watch this week: whether OpenAI’s widened probe names third parties or stays internal, and whether stateless MCP actually pulls tool use back from shell-first agent designs or just makes the servers cheaper to host.