DeepSeek's cheap Flash gets sharper, Reflection opens Beam, and Google tunes the harness instead of the model

1. DeepSeek V4.1-Flash-1017

DeepSeek pushed V4.1-Flash-1017 on October 17 to its site, app, and API, with MIT-licensed weights on Hugging Face and ModelScope. It's a minor update to V4.1-Flash, trained with reinforcement learning from self-feedback, and DeepSeek reports gains on every benchmark in its table (for example 77.0 on DeepSWE v1.1, up from 74.2, and 42.3 on Terminal-Bench 4.0, up from 31.2) while producing shorter outputs. API pricing for deepseek-flash is unchanged. DeepSeek also opened its in-house Search & Fetch APIs at $0.75 per 1,000 calls per endpoint, free through server-side tools in DeepSeek Harness, Claude Code, and Codex until billing starts October 31. It's already on Vercel AI Gateway as deepseek/deepseek-v4.1-flash-1017.

Our take: These are DeepSeek's own numbers, so wait for independent evals before betting a product on it. But at roughly 20 cents per agentic coding task in their chart, it's the obvious model to try for bulk background work.

2. Reflection releases Beam, with the Mirror CLI

New US lab Reflection released Beam on October 16 under Apache 2.0: a sparse mixture-of-experts model with 501B total and 23B active parameters, a 1M-token context, and BF16, FP8, and NVFP4 checkpoints. It's text-only and aimed at coding and long-horizon agent work, with day-zero support in Transformers, vLLM, and SGLang. Reflection also shipped Mirror, a beta terminal harness (Python front end, Rust agent core) with tool approvals, resumable sessions, parallel worktrees, MCP, and skills. Beam also runs in Pi, OpenCode, and Hermes.

Our take: The NVFP4 build still needs about 280 GB of GPU memory, so most of us will use a hosted API. The real news is a credible US open-weight option tuned for agent harnesses.

3. Harness²: improve the agent, not the model

Google Cloud AI Research open-sourced Harness² (Apache 2.0). It edits the scaffolding around a frozen model, including the system prompt, guardrails, memory, tool guidance, subagents, skills, scripts, and plugins. Each task gets a Propose–Probe–Compose step: suggest harness edits, run them on the same task, and keep only the changes backed by observed behavior. Lessons carry forward in an experience file for future tasks. The paper reports gains of up to 11.5 points on WorkBuddy-Bench with GLM-5 and Gemini 3.5 Flash. OpenCode is the default executor, and --substrate cx switches to Codex.

Our take: The setup is Vertex-centric and research-grade. Still, the idea transfers today: version your agent's prompts and skills, and A/B them on the same task before you adopt them.

4. OpenUI 1.0

Thesys shipped OpenUI 1.0 on October 15. It's an MIT-licensed framework where models emit OpenUI Lang, a compact streaming language, and your app renders it with components you allow: cards, forms, tables, and charts instead of a wall of text. Version 1.0 adds defineAction (typed actions handed to your app), defineFunction, library.extend, and a stored-message format. The project's own benchmark claims roughly half the tokens of JSON-based UI formats. One catch: the 1.0 language features are React-only for now (Vue, Svelte, and Angular stay on 0.4), and you must upgrade the client and prompt-generating server together. Start with npx @openuidev/cli@latest create --name genui-chat-app.

Our take: If your agent's answers end in "here are the options:" followed by a list, this is a cheap way to make them clickable.

5. Agent Vault keeps credentials out of the context window

Self Labs launched Agent Vault on October 15. Agents fill checkout and login forms with mock tokens that are worthless outside an authorized session. The real card number is revealed only inside a trusted execution environment, and passwords are swapped in by Self's proxy at sign-in. You set spending caps by day, week, month, and transaction, restrict cards to named merchants, and revoke at any time. It works with Claude, Codex, Hermes, OpenClaw, Grok Bot, and others, and there's a Free tier (the first 1,000 sign-ups get three months of Plus).

Our take: Prompt injection makes "the agent has my card number" a real risk. Whatever tool you use, the pattern is right: the agent should hold nothing worth stealing.

Try this today

A/B your agent's instructions before you keep them. Next time you tweak an AGENTS.md, rules file, or skill, run the same task twice: once with the old version and once with the new, ideally in separate git worktrees. Diff the results and keep the change only if the new run actually behaved better. It's a manual version of what Harness² automates, and it stops instruction files from growing into a pile of untested superstitions.