AI Weekly Brief — week ending 2026-10-24

This Week in AI

Moonshot ships Kimi K3.1 Pro. The Beijing lab released its first flagship since Kimi K3, reported at 3 trillion parameters, and says full weights will follow by November. Moonshot also says it cut the model's hacking skills before release. SiliconANGLE, Reuters
China cleared its first AI model exports. DeepSeek and MiniMax became the first labs to complete China's new AI export registration, which licenses them to deploy models overseas under a 23-item tech catalog. South China Morning Post, Bloomberg
DeepSeek raised $15 billion days after a US government ban. The round included CATL and Tencent, and it closed the same week the US barred DeepSeek models from government systems. New York Post, BBC
A DeepSeek model built a working Chrome sandbox escape. Reports say DeepSeek V4.1 Flash (1017) produced an exploit that escapes Chrome's sandbox, a concrete marker of offensive-security skill in widely distributed models. The same model went live on Databricks Unity Gateway this week (see Databricks Watch). Android Headlines, Wccftech
OpenAI launched the Decisions API. OpenAI describes it as fast, focused, low-cost decisions for any application, a lighter endpoint than full chat completions. OpenAI
Databricks moved core AI features to GA. AI Runtime and Genie Code tasks in Lakeflow Jobs are both generally available, which moves agent workloads from preview into supported production use. Databricks, Databricks docs
GitHub starts enforcing a global default policy for Copilot. Through October 26, unconfigured generally available Copilot features get set by each enterprise's chosen default. Copilot admins should confirm their setting now. GitHub Changelog
CMS proposed up-front eligibility verification for Exchange subsidies. Consumers would have to pass verification before receiving advance premium tax credits or cost-sharing reductions, and employers publicly backed expanding electronic prior authorization to self-funded plans. CMS, CMS

Vendor Dossiers

Ai2 (Allen Institute for AI)

Released: OlmoEarth v1.3, Ai2's geospatial embedding model, is available on Hugging Face and billed as state-of-the-art embeddings for the whole planet. Hugging Face
Ai2 published LitPivot, a tool for developing research ideas by placing them in context within the published literature. Hugging Face

Anthropic (Claude)

Anthropic published an alignment assessment of the UK AISI cybertesting incident. Useful context for teams that track model-safety incidents and vendor responses. Anthropic
Anthropic argues LLMs now make formal software verification feasible at much larger scale, with a technical appendix. Formal verification means proving code correct with math, which matters for high-assurance systems. Anthropic, appendix
Anthropic is donating Agent Skills to the Agentic AI Foundation, a push toward a shared standard for packaged agent capabilities. Anthropic
Anthropic opened a call for guest investigators in the life sciences, a research-access program with healthcare relevance. Anthropic

DeepSeek

DeepSeek, based in Hangzhou, China, completed China's AI technology export registration alongside MiniMax, the first labs cleared under the new 23-item catalog. Provenance now carries an explicit Chinese government licensing step, a fact for vendor-risk files. South China Morning Post, Pandaily
DeepSeek is closing a roughly $15 billion funding round with participation from CATL and Tencent. The raise lands directly against OpenAI and Anthropic at frontier scale. New York Post, BW Disrupt
Reports say DeepSeek V4.1 Flash (1017) built an exploit that escapes Chrome's sandbox. Security teams evaluating any platform that hosts this model should note the finding. Android Headlines, Wccftech

Google DeepMind (Gemini, Gemma)

Announced: Google Public Sector unveiled Gemini for government services, packaging Gemini for US agency use. Watch whether CMS and state agencies adopt it, since that shapes the tools on the other side of payer data exchanges. Nextgov/FCW

MiniMax

MiniMax, based in Shanghai, China, completed export registration for open-source overseas model licensing under China's new export rules. Reuters

Mistral

Forkast News covers an approaching licensing deadline for Mistral Large 4 and what it calls the $20M question. The excerpt is thin; linked for readers tracking Mistral's licensing terms. Forkast News

Moonshot AI (Kimi)

Released: Kimi K3.1 Pro, the first model in the K3.1 series from Beijing-based Moonshot AI, reported at 3 trillion parameters. Full weights are promised by November but are not out yet, so treat the open-weight version as announced only. SiliconANGLE, Unite.AI, The Economic Times
Moonshot says it curbed the model's hacking ability before release, citing concern over AI-powered cyberattacks. That is a notable self-imposed limit from an open-weight lab. Reuters, The Next Web
Early benchmark coverage puts K3.1 Pro close to Anthropic's Claude Opus 5.5. The Decoder

OpenAI (GPT, Codex)

Announced: the Decisions API, described as fast, focused, low-cost decisions for any application. A cheaper endpoint for classification-style calls could cut costs on routing and triage workloads. OpenAI
OpenAI detailed how it hardened its frontier model training environment, including offline environments and high-compute red-teaming. OpenAI
OpenAI partnered with Poland's NASK on AI safety, security, and technical research. OpenAI
An engineering post covers scaling storage for more than 1 billion ChatGPT users, with 12x faster reads built on Azure Cosmos DB. OpenAI

GitHub Copilot

GA: Enforcement of the global default policy for Copilot features rolls out through October 26. Unconfigured generally available features will be set to the chosen default, so admins should review AI Controls → Copilot → Default policy for new features. GitHub Changelog
GA: The usage metrics API now reports per-client usage (OpenCode, Claude Code, Codex, Zed, and more) and names customer-built skills, agents, and MCP servers instead of lumping them under "other." This gives admins a real picture of which AI tools and internal customizations developers actually use. GitHub Changelog, GitHub Changelog
GA: A consolidated GitHub app in Microsoft Teams adds Copilot: mention @GitHub on a notification to investigate an issue and open a pull request. The legacy app retires November 16. GitHub Changelog
The Visual Studio September update adds pull request exploration via the Git agent and updates Bring Your Own Model (preview). Breaking change: BYOM now requires the new Agent (Preview) harness. GitHub Changelog
GA: The Copilot impact dashboard adds an industry comparison section with peer benchmarks by company size and industry. Participation is opt-in and off by default. GitHub Changelog

Microsoft 365 Copilot

Microsoft is retiring the Outlook feature that let Copilot assign a priority to emails. If your team used prioritized inbox triage, expect it to disappear. Neowin

Microsoft / Azure

Microsoft pulled eight Copilot actions from Windows 11 File Explorer, continuing a trim of Copilot surface area in Windows. Notebookcheck

Open-Weight Ecosystem

Hugging Face published a lookup of which models run on AWS Trainium via torch-neuronx. Handy when weighing non-NVIDIA hardware for open models. Hugging Face
Microsoft shared ThinkingBox, which turns database grading into reinforcement-learning rewards for post-training agents. Hugging Face
Latin Times reports Chinese open models, led by DeepSeek and Kimi K3, now carry 55% of developer traffic. Treat the number as the outlet's claim, but the direction matches this week's export and funding news. Latin Times

Databricks Watch

AI / ML

AI Runtime (AIR) is generally available, with a companion NVIDIA post on fine-tuning open models against enterprise data. Databricks, Databricks
Genie Code tasks in Lakeflow Jobs are generally available: a task runs your prompt autonomously, reads upstream outputs, and calls tools. Starting November 2026 they are on by default even for workspaces with the compliance security profile, so compliance-profile shops should decide their policy now. Release notes, What's coming
DeepSeek V4.1 Flash (1017) is available on Unity Gateway with text and image inputs; the prior V4.1 Flash retires November 19, 2026. DeepSeek is a China-based lab and Databricks puts compliance responsibility on the customer, so check whether your model allowlist should include it. Release notes, Retirement

Preview

Beta: Unity Gateway can screen MCP tool calls and their results for jailbreak and prompt-injection attempts, applied on input, output, or both. Useful guardrail as agent tooling spreads into governed data. Release notes
Beta: CustomerLake, the agentic customer data platform, enters Beta with Campaign Agents live at early customers. Databricks

Announced

Agent memory arrives on Agent Bricks, with a companion engineering post (MemCurrent) on designing persistent memory for production agents. Databricks, Databricks

Data & Platform

Databricks Runtime 19 shipped with a behavioral change: Spark Connect execution metrics now hide internal operators tied to row filters and column masks. Tools that inspect df.executionInfo.metrics inside protected subplans may need updates. Release notes
Lakeflow pipelines system tables (pipelines, pipeline_update_timeline) are generally available for auditing pipeline runs. Release notes
Asynchronous processing with the Python transformWithState API is generally available, raising streaming throughput with minor code changes. Release notes
OAuth custom identity claims let one service principal serve many end users while dynamic views or ABAC policies filter each user to their own rows. Relevant to member- and provider-facing apps that must enforce row-level access. Release notes
Saving a job without changes no longer adds rows to the jobs system tables, which cleans up audit queries. Release notes

Preview

Public Preview: DataFrame caching on serverless compute via df.cache() or df.persist(), enabled by default for most workspaces. Release notes
Beta: Files API 3.0 for Unity Catalog volumes adds multipart uploads above 5 GB and version-conditioned upload, download, and delete. Release notes
Beta: six new managed Lakeflow Connect connectors: Box Audit Logs, Microsoft Entra ID, SurveyMonkey, Oracle Eloqua, Asana, and Google Analytics Aggregated. The Entra ID connector ingests users, groups, and sign-in/audit logs, useful for access reviews and audit evidence.
Beta: Shared Serverless for Asset Bundles and serverless job environments from pyproject.toml, both under the Project-Scoped Shared Compute preview. Release notes, Release notes
Beta: Lakebase Insights moves to per-project settings with on-demand diagnostic runs built on system.lakebase telemetry. Release notes

Regulatory Radar

US Federal

The US banned DeepSeek from government systems. BBC. Expect downstream questions about China-based models inside commercial platforms you use; know where they appear in your stack.
The Pentagon issued AI procurement guidance implementing the administration's "truth-seeking" and "ideological neutrality" directives. DefenseScoop. Procurement language like this tends to migrate to civilian agencies, including HHS contracting.
The federal "super intelligence" rebrand is spreading: the State Department ordered the wording across official communications, and the Navy and Marine Corps issued similar direction. Nextgov/FCW, Stars and Stripes, Time. When reading new federal guidance, map "super intelligence" to "AI."
The Great American AI Act would mirror California's AI rulebook at the federal level and preempt state AI laws for three years. Forkast News. If enacted, multi-state AI compliance would collapse to one federal baseline for that window.
An analysis of DHS's AI inventory shows the limits of the federal AI transparency law. Just Security. Agency AI inventories, including any covering CMS systems, may understate actual use.
Congress is drafting AI safety rules while the major labs lean on self-regulation pledges. The National Interest, The Christian Science Monitor. Voluntary commitments today often become statutory language later.

US States

OpenAI urged Governor Newsom to strengthen California's AI safety law with additional safeguards. StateScoop. California keeps setting the practical floor for AI rules; plans with California operations should track amendments.
Arnold & Porter breaks down California's new AI law for lawyers and eDiscovery teams. Arnold & Porter. Discovery and records-retention duties may now reach AI-generated material; legal and records teams should read this one.

Healthcare-specific

CMS proposed the Exchange Pre-Eligibility Verification rule (CMS-9873-P): consumers must pass eligibility verification before receiving advance premium tax credits or income-based cost-sharing reductions. Exchange plans should expect enrollment-pipeline and verification changes, and the comment period is the window to flag operational burden. CMS press release, CMS fact sheet
Large employers publicly backed expanding electronic prior authorization to self-funded health plans. CMS. Electronic prior-auth volume will grow across employer-sponsored coverage, which touches claims and encounters pipelines.
A CDRH digital health leader says generative AI policy is a White House priority. MedTech Dive. Expect FDA guidance activity on generative AI in medical products.
CMS announced Rural Health Transformation Program awards across several states, including $249 million for Alaska, $219 million for Georgia, and $193.7 million for Florida, plus a $275 million nursing-home workforce initiative. The funded telehealth and technology-enabled care will surface as new encounter patterns in rural service areas. CMS - Alaska, CMS - Georgia, CMS - nursing initiative

Worth Your Time

Tom's Hardware digs into DeepSeek's efficiency trade-offs: one-quarter the HBM and one-eighth the SSD storage of comparable models, but persistent hallucinations in agentic workloads. Tom's Hardware
Bloomberg examines DeepSeek's push for ubiquity and why Beijing has mixed feelings about its most visible lab. Bloomberg
The Washington Post reports most Americans want to halt all data center construction. Public sentiment like this will shape the siting and energy fights behind every AI roadmap. The Washington Post
JD Supra's transatlantic monthly briefing covers insurance, AI, and coverage questions, including how policies respond to AI-driven losses. Relevant to risk and legal teams at any insurer. JD Supra
Inside Global Tech's third-quarter 2026 US tech legislative and regulatory update is a one-stop recap for compliance teams catching up on the quarter. Inside Global Tech