DeepSeek releases DeepSeek-V4.1-Flash-1017 with MIT-licensed open weights

OpenAI’s help article says Slides is rolling out to eligible accounts on the Pro, Business and Enterprise plans with access to Space, on the web and in the ChatGPT desktop app. Users ask ChatGPT in Work for a presentation, or select Create > Slide in Space.

A deck can start from a template, and users can share an example deck to guide the style and layout. Text, images, shapes, tables and charts can be edited directly, or selected and changed by asking ChatGPT, for example to shorten a slide or update a chart from new data. ChatGPT can also generate custom images for a deck.

People with edit access can work on the same deck at once, leave shared comments and @mention ChatGPT to make changes. Comment-only access isn’t available at launch.

Decks can be presented from ChatGPT. On the web they export to PowerPoint, PDF or Google Slides, and on a computer with PowerPoint or Keynote installed they open in those apps. On Windows devices without the required MXC component, which Windows 10 doesn’t support, the desktop app makes PowerPoint files instead of collaborative Slides.

OpenAI hasn’t said whether Slides will come to the Plus or free plans.

ECDSA, the most widely used elliptic-curve signature standard, was adopted by NIST in 2000 in FIPS 186-2. Its curves are partly defined by seed values that the NSA supplied without explanation, which fed years of suspicion that they could hide backdoors, and a bounty for whoever found the seeds’ origin.

An Anthropic employee asked an internal research model how the seeds were made, without pointing it to the rumoured clue that they were hashes of a humorous phrase. In under half an hour, Claude showed that the P-192, P-224, P-256, P-384 and P-521 seeds came from lrand48, the C library’s random number generator, seeded with Unix timestamps, readings of the computer clock, from May 1997 to April 1998.

Claude spotted a pattern in the seeds’ top bits, recovered the generator’s hidden state and checked that each recovered state regenerates all 160 bits of its seed, which does not happen by chance. It also explained the base points, the fixed point every public key on a curve is derived from, of P-192 and five ANSI X9.62 example curves.

Anthropic says this is not a break of, attack on or weakness in ECDSA, and that a simple, reproducible method makes deliberately weakened curves much less plausible. The $36,864 bounty will go to the Internet Security Research Group.

The seed of the binary curve B-163 and the base points of P-224, P-256, P-384 and P-521 remain unexplained, and Anthropic doesn’t know why some runs passed over workable curves.

The vLLM project described the work on its blog on 16 October 2026, the day it was merged into vLLM as pull request 61867. NVIDIA built it with help from coding agents. In Kimi K3’s decode step, where the model generates output tokens, custom GPU code written in CuTe DSL replaces almost every operation, from attention to communication between GPUs.

It supports Kimi K3 on 8 or 16 GB300 GPUs connected by NVLink, handling 1 to 64 requests at a time, and operators switch it on with the decode_backend setting latency_specialized. All changes sit in vLLM’s Kimi K3 code, and the pull request reports AIME25, GPQA-Diamond and MRCR v2 scores matching stock vLLM within about one standard error.

With DSpark speculative decoding, in which a draft proposes several tokens for the model to check at once, Kimi K3 reaches 842 tokens per second for a single request on 16 GPUs in vLLM’s controlled test.

On AgentX, a SemiAnalysis benchmark that replays real coding-agent sessions, per-user speed at the 90th percentile rose 1.8 times at one concurrent request, though vLLM compares a 16-GPU run with an earlier 8-GPU result.

Validation so far covers GB300 only. A similar path for DeepSeek-V4.1-Flash is open for review as pull request 61868.

OpenCode, maker of the open-source coding agent of the same name, disclosed the breach on its X account on 17 October 2026. It said anyone who didn’t get its email wasn’t affected and that, with the incident ongoing, it couldn’t share more details. It linked the breach to a large-scale distillation attack, in which a model’s answers are used to train a copy without its maker’s permission, but hasn’t explained the connection.

In its email to affected users, seen in a screenshot of a Reddit post that security writer Matt Johansen shared on X, OpenCode said someone had gained unauthorised access to an old system it was in the process of retiring. Keys for outside providers saved in users’ workspaces, with OpenAI and Anthropic given as examples, may have been exposed. The email asked users to revoke and replace them through each provider’s dashboard, update any apps that use them and check recent usage for unexpected activity. The screenshot doesn’t show the sender’s address, and OpenCode hasn’t published the email.

Lydia Hallie, who works on Claude Code at Anthropic, said on X that Anthropic had revoked the Claude API keys it believes were affected. Replying to her, OpenCode’s Dax Raad said the breach concerns OpenCode Console, not the OpenCode agent, and that keys used in the agent never reach the company.

OpenCode hasn’t said how many users 1.4% represents, how the attacker got in or how many keys were exposed.