October 20, 2026 — A Cheap, Fast Model With a Confidence Problem

Host0:34

An early version of this model ran anonymously as a bot called Space Bunny. MiniMax says Space Bunny processed more than two hundred trillion tokens. That figure is the company's own assertion. The model is MiniMax M three point one Flash, announced Monday. It takes text, images, and video, and it returns text. You can reach it through the MiniMax API, the M Plan, and MiniMax Code. Weights are promised later, with no licence terms yet. The price is fifteen cents per million input tokens and sixty cents per million output. Cached input drops to one and a half cents. The context window is one million tokens, with a completion limit near half a million, per OpenRouter. Tool calling works, and JSON output is supported. But OpenRouter says it isn't enforced against a schema, so validate what comes back. How is it fast? MiniMax credits more aggressive sparsity. The company reports median output above one hundred seventy tokens per second. MiniMax reports seventy three point seven percent on DeepSWE version one point one. That's their number, not independently verified. The independent one comes from Artificial Analysis, via VentureBeat. Its Intelligence Index scores this model forty two, against twenty nine for M three. Average task costs were twenty two cents and fifty one cents. Now the catch. That same reporting says Artificial Analysis found a ninety three percent hallucination rate on AA-Omniscience. It does not mean ninety three percent of answers are wrong. It means that when the model missed, it tended to give a wrong answer instead of admitting it didn't know. MiniMax's seventy percent saving is about agent tasks against its predecessor, not a like-for-like token rate. The API allows two hundred requests per minute. OpenRouter's free endpoint is rate limited and isn't available through EU in-region routing. Verdict. Try it today on a bounded coding or tool-use task, with tests and a human reviewing. Search for MiniMax M three point one Flash on OpenRouter and pick the free one, which is OpenAI-compatible. Compare cost, latency, and how it fails. Skip it for unsupervised factual or consequential work.

3:06

MiniMax pitches that model for long, multi-step agent work. The git-ai project argues that putting a crowd of agents like that on one repository can strain Git's hosting model. That's the bet behind a project called git-ai. Fifty agents, two hundred fifty changes, one sixteen-core machine. That's the demo in the git-ai README, and it deliberately makes one change in five conflict. The project's premise is that Git hosting assumes a human works for a while, then pushes, while agent workloads may involve many short-lived tasks landing changes on the same branches. The project is MIT licensed and inspired by Anthropic's internal Scion, but it says it's not affiliated with Anthropic. So the server does the work. Each change goes into a changeset log. A land rebases onto the current branch tip and updates it with compare-and-swap. Concurrent lands can batch into one update. Agents get their own tokens, an RPC allowlist, and branch policies. And the server never calls a language model. The number to know is two hundred fifty of two hundred fifty. With a deterministic resolver, all changes landed. With no resolver, fifty did not. The maintainers measured that against the same server with batching off, and it isn't a comparison with GitHub, GitLab, or Gerrit. Explainx says it hasn't been independently reproduced. It's version zero point two point zero, interfaces may change before one point oh, and storage garbage collection is a known gap. About eighteen hundred ninety stars by October eighteenth is interest, not adoption. To try it, clone the repo, run make build, then run the graft quickstart script. You need Linux or macOS, Go one point twenty-six, a C toolchain, Meson, and Ninja.

5:07

git-ai gives every agent its own token and branch policy. Microsoft is making a far bigger version of that argument. Microsoft is expanding its discovery tools to sixty types of local agent, thirty five of them new. The list includes Claude Code, OpenAI Codex, and GitHub Copilot. Yes, Microsoft is now discovering its own Copilot. The pitch from Monday's security blog is that agents are your newest insiders. Its principle is that security authority should sit outside the model. In Nadella's words: “The most trustworthy agentic system will not be the one with the model we trust most. It will be the one designed that enables us to trust the model least.” Here's the mechanism. Dynamic Agent Risk is a continuously updated assessment built from identity, data, endpoint, cloud, network, runtime, and agent activity signals. Dynamic Permissions gives an agent task-scoped, time-bound authority, never more than the user who sponsors it. Then Dynamic Conditional Access responds in proportion. It can keep reads but block writes, narrow network paths, shorten or revoke access, require human approval, isolate the runtime, or stop execution. Microsoft's example is a prompt-injection risk. The agent isn't killed. It keeps safe reads and loses its write and approval abilities. The agent itself runs in a sandbox called the Microsoft Execution Container, with monitoring and enforcement outside its reach. Now the skeptic's section. This is all announced capability, not measured results. Microsoft's descriptions of detection and containment come with no independent evaluation. SiliconANGLE reports no availability dates or pricing, and says Microsoft positioned the controls with Project Perception and Microsoft three sixty-five E seven. Rival security vendors will argue agent controls shouldn't depend on Microsoft's stack. Customers will ask about cost and false positives. So when does it ship, what does it cost, and how will Microsoft show its risk calls are accurate enough to restrict a real workload? That part's still blank.

7:34

Microsoft's pitch is control over what agents touch. Amazon's pitch is control over which silicon your code runs on. Amazon says the device change can be as small as calling dot to with the word neuron. TorchNeuron is an open-source native PyTorch backend for Trainium. The public beta is planned for today, under Apache two point zero. It registers Trainium through PyTorch's PrivateUse1 extension point, so it shows up as a normal device. Eager mode dispatches operations as they run, which is good for debugging. For production, torch compile captures a graph with TorchDynamo. AOTAutograd traces the backward pass, then the backend lowers through Torch-MLIR to StableHLO. The Neuron compiler turns that into a NEFF executable. It covers Trainium two and Trainium three. Distributed training supports DDP, FSDP two, tensor parallelism, and pipeline parallelism, with collectives running over Trainium collective cores in a node and Elastic Fabric Adapter between nodes. And the Neuron Kernel Interface lets you write custom kernels. One fun detail. The profiler exports Parquet metrics, which Amazon says agents can read to hunt bottlenecks. Your profiler now has a reader that never files a ticket. Amazon says it tests against hundreds of thousands of models on every build. That's a company claim. On cost, AWS argues for whole-workload economics, not the lowest per-token price. Its own example is Deepgram processing seventy percent more audio per dollar on Trainium. TechCrunch points out that AMD and Apple also offer PyTorch routes with simple configuration changes, so easy portability isn't unique. The launch doesn't establish performance or cost parity, workload by workload. And adaptive eager mode is still experimental. So try it on a model you know. Call dot to neuron for eager mode, or torch compile with backend neuron, and compare against your current numbers.

9:50

Amazon's pitch is that one line moves your workload. GitHub's Copilot model lineup is changing. GitHub Copilot. Several Copilot models were deprecated Monday, across Chat, inline edits, ask and agent modes, and code completions. GitHub says no action is needed to remove them, but admins may need to enable replacement models through model policies. Those policies now have an API, generally available, with GET and PATCH endpoints at enterprise, enterprise-team, enterprise-app, and organization levels. If you run Copilot for a company, check your policy today. uv zero point thirteen point two. Exported pylock dot toml files now carry supported-environment restrictions, and uv honors those PEP seven fifty-one restrictions on install and sync. If you consume exported lockfiles, regenerate and diff them. There are also fixes to stop URL credentials leaking through diagnostics or saved metadata, plus retries for dropped GET and HEAD requests. It also stopped panicking on invalid pylock output filenames, which is a politer way to fail. Transformers five point twenty point two. If you pass multimodal inputs through generate, upgrade. Some inputs could lose their original type inside prepare inputs for generation, which could cause problems with multimodal models. The release also fixes a bfloat sixteen zero-expert-gradient issue under expert parallelism when ep size is below FSDP size, and an eager mask copy from host to device. The release notes spell lose as loose, so the typo shipped too.

11:38

Amazon wants you off Nvidia through software. Tenstorrent is trying it with silicon, and it just raised one point five billion dollars. That's a Series E at a six point two billion dollar post-money valuation, which Yahoo Finance says more than doubled its late twenty twenty-four valuation of two point six billion. The round was led by Trace Capital and Innovation X. The chips are RISC-V based, and Tenstorrent licenses its TT-Ascalon CPU and Tensix AI cores to designers including Samsung and LG. The company says the money will support Galaxy server deployment, volume manufacturing, global commercial expansion, and its AI and CPU IP licensing business. Its Galaxy servers are aimed at open-weight language models and video generation. For you, nothing changes on your desk today. The announcement includes no independent performance or price comparison. CEO Jim Keller, who previously architected AMD Zen and Tesla's self-driving chip, says they sell one architecture at every size. Raising money is easy to announce. Keeping secrets, as the next two stories show, is harder.

12:59

Fast Boot, where two stories get two sentences each and nobody keeps a secret. Plex2Shell. Plex2Shell, four chained flaws patched in August, was exploited by October seventeenth, so update Plex Media Server to one point forty-three point three. The proxy payload tells you that you agree to the potential external use of your internet traffic, so the malware has a consent banner. WhatsApp leak. About eighty WhatsApp help pages shipped hidden chatbot instructions in their page source, including sections titled what not to say, and Meta says a bug caused it. Nothing keeps a what not to say list quiet like putting it in the page source. So that's a piece of malware with a consent banner, and a help page that published its own what not to say list. Two secrets, zero kept.

13:50

Today you got MiniMax M three point one Flash, Microsoft's controls for risky agents, Amazon's TorchNeuron, and the git-ai repo. Try this week: run one bounded task with tests through the free MiniMax endpoint on OpenRouter, and write down how it fails. Sources for every segment are in the show notes. Follow The Daily Reboot in your podcast app so tomorrow's episode finds you. I'm your host, and I'll see you tomorrow.