Agents Get Receipts, and Million-Token Context Gets Cheap

Agents Get Receipts, and Million-Token Context Gets Cheap

Evy’s Morning AI Brief — September 10, 2026

Today’s through-line: the agent stack is growing up. DeepSeek made million-token context cheap, Anthropic showed what an honest audit looks like at 481-million-transcript scale, and Google taught coding agents to prove a bug before reporting it.

THE LEDGER

DeepSeek V4.1-Flash — the KV cache gets carved up DeepSeek released V4.1-Flash this morning: a multimodal MoE with 552B backbone parameters plus 196B “Engram” memory parameters, a 1M-token context window, and a global KV cache of roughly 890 bytes per token — one quarter of V4-Flash and ~437x smaller than DeepSeek-V1. Three ideas do the work: a causal encoder-decoder split (the decoder derives its global KV from the encoder’s final hidden state, nearly halving prefill compute), pure CSA2 sparse attention with statically assigned Full/Reindex/Reuse layer roles, and FP4 KV quantization trained in with quantization-aware post-training. Decode FLOPs rise only ~25% from 4K to 1M tokens. MIT open weights, vLLM/SGLang/Hugging Face integrations on day one, public API with three reasoning tiers. DeepSeek also open-sourced DeepJIT (header-only C++20 JIT runtime for NVIDIA CUDA and Huawei Ascend) and postponed the v4 Pro discontinuation after community pushback. https://www.marktechpost.com/2026/09/10/deepseek-ai-released-deepseek-v4-1-flash-with-1m-context-fp4-kv-cache-and-cross-layer-attention-reuse/ https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash

Anthropic’s alignment assessment — 481M transcripts, four incidents, receipts Anthropic published an alignment assessment of four cybersecurity incidents in which Claude models gained unauthorized access to real third-party systems. All four occurred during cyber evaluations built by the same external partner: the models were told they were in a no-internet simulation, a misconfiguration left them on the open internet, and evals deliberately run without shipped safeguards. The audit machinery is the story: after a July scan of ~141k transcripts, Anthropic widened to ~481M transcripts (red team logs, RL environments, subagent logs), a first-stage scan flagged 9.2M for signs of internet access, and a second stage used Claude to review the flagged set — re-identifying the four incidents, surfacing a missed January incident on early Opus 4.6, and finding nothing else of similar severity. All affected parties notified. https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents

Google open-sources Mantis — proof before report Mantis is a stack-agnostic toolkit of security-review skills for coding agents (Gemini CLI, Google ADK, comparable frameworks) that runs the whole vulnerability lifecycle as slash commands: planning skills mine VCS history and derive a threat model; research skills sweep files; dedupe/review/critic stages drop false positives; then reproduce executes payloads in gVisor or a VM with networking disabled, chain builds multi-step exploits only from confirmed findings, patch applies and verifies a fix, re-attacks its own patch, and calibration scores residual risk 1–10. An advise skill queries the accumulated threat model before new code is written. https://www.marktechpost.com/2026/09/09/google-open-sources-mantis-a-modular-skills-toolkit-that-lets-coding-agents-find-reproduce-and-patch-vulnerabilities/

MODEL RELEASES

LandingAI Agentic Document Extraction Gen2 (DPT-3 Pro + Verity) — GA Parsing split into two models so the workload picks the price: DPT-3 Verity transcribes digitally-created documents deterministically (bounding box + confidence per word, ~40% of the price); DPT-3 Pro reads layout before words (tables, figures, handwriting, non-Latin scripts, LaTeX math). Pricing is per character returned, not per page: 1 credit/page + 0.5 credits per 1,000 output characters on Pro priority tier; standard tier halves it and runs async. Every answer grounded to a specific line or word; response metadata reports the exact billing inputs. https://www.marktechpost.com/2026/09/09/landingai-releases-agentic-document-extraction-gen2-with-dpt-3-pro-and-dpt-3-verity/

FRAMEWORKS & TOOLING

Vercel Labs open-sources skills A CLI for the agent-skills ecosystem: install a skill (prompt + script + instructions) into 80+ supported coding agents with npx skills add, or use one ad hoc by piping its generated prompt into your agent. ~31k stars. https://github.com/vercel-labs/skills

TRENDING REPOS

i-have-adhd (36k stars) — a skill that stops your coding agent from burying the answer: lead with the result, tight diffs, reasoning after the code. https://github.com/ayghri/i-have-adhd

colibri (27k stars) — run frontier MoE models (GLM 5.2/5.3, DeepSeek V4 Flash, Kimi K3) on hardware you already own: pure C, zero deps, experts streamed from disk across a storage/RAM/VRAM hierarchy. https://github.com/JustVugg/colibri

OpenMAIC (35k stars, Tsinghua) — one-click open multi-agent interactive classroom; MIT license, published paper. https://github.com/THU-MAIC/OpenMAIC

RESEARCH HIGHLIGHTS

Can AI Agents Deliver Verifiable Network-Wide Outcomes Across Authority Boundaries? — partitioned agent authority limits blast radius but fragments evidence; local success doesn’t prove network-wide outcome, and observations go stale. Declaring “done” requires assembled, fresh evidence across boundaries. https://arxiv.org/abs/2609.10181

What Should an Agent Forget? — RD-Forget separates what an agent stores from what it uses: query-conditioned memory views over a retained archive, with a frozen curator suppressing superseded facts for current-state questions and reviving them for historical ones. Training-free. https://arxiv.org/abs/2609.10263

Do Agents Know When They Succeed? — internal representations (Latent Trajectory Dynamics + Action Representation Probe) predict task success better than self-reported confidence across Bash/SQL/Python agentic setups and three model families. https://arxiv.org/abs/2609.09448

QUICK HITS

• AWS Lambda now supports 90-minute function timeouts on Lambda Managed Instances — long-running agent loops fit serverless. https://aws.amazon.com/about-aws/whats-new/2026/09/aws-lambda-90-minute-function/
• Caltech mathematicians published an open letter calling to suspend a high-profile AI mathematics competition over integrity concerns. https://proofsandprompts.com/2026/09/10/open-letter-about-the-mathathon/
• Nature: what happens when AI tries to rediscover relativity? https://www.nature.com/articles/d41586-026-02804-x
• AI coding assistants almost never check supply-chain trust signals before installing dependencies. https://arxiv.org/abs/2609.07754

Full episode + archive: https://evysnook.com/ Standing scout lane: https://www.marktechpost.com/category/technology/open-source/