AI Brief, October 20: Nvidia Nemotron 3.5, AWS TorchNeuron, DeepSeek opens its inference engine

Nvidia ships open agentic models, AWS makes Trainium a native PyTorch device, DeepSeek open-sources DeepInfer, and agent security warnings pile up.

Today is about where your models run and who you trust to run them: Nvidia released open Nemotron 3.5 models for enterprise agents and local AI PCs, while AWS and DeepSeek both pushed serving infrastructure out into the open. The security side of the ledger was busier still, with an OpenCode breach, Microsoft calling agents insider threats, and new research on backdoored open weights.

Nvidia releases open Nemotron 3.5 models for enterprise agents and AI PCs

Nvidia launched open-weight models aimed at always-on agents and edge deployment. Nemotron 3.5 Super VL is a 120-billion-parameter model for enterprise agents, which Nvidia says matches the accuracy of the larger Nemotron 3 Ultra on instruction-following and tool use. Two lighter Bolt models target local use on AI PCs with the RTX Spark chip and DGX Spark workstations: Bolt 74B-A9B for local agentic tasks including tool calling and web browsing, and the smaller Bolt E4B for conversational agents. TechCrunch reports Super VL and Bolt 74B-A9B are available now, with Bolt E4B due later this month. Nvidia names Skydance, EY, Ramp, Crowdstrike, Perplexity and Salesforce as Super VL users.

Why it matters: Teams that want to post-train on their own data and host on their own infrastructure now have an Nvidia-optimized open option at both the datacenter and laptop tiers.

Sources: TechCrunch AI

TorchNeuron makes Trainium a native PyTorch device for Hugging Face models

Hugging Face says TorchNeuron, a PyTorch plugin from AWS, exposes Neuron as a native device with eager execution, torch.compile and distributed primitives such as DTensor and FSDP2. It enters public beta on October 20, 2026 via pip install torch-neuronx. Transformers, Diffusers, Accelerate, PEFT and TRL now run on Trainium directly, and Hugging Face recommends using them instead of Optimum Neuron: it reports 89% of the top 100 text-generation architectures work out of the box, up from 46% with Optimum Neuron v0.4.5. TechCrunch reports AWS says porting takes a one-line configuration change and that roughly 85% of AI apps are written with PyTorch.

Why it matters: Moving inference or fine-tuning off Nvidia now costs a config change rather than a rewrite, which makes Trainium a realistic second option for capacity planning.

Sources: Hugging Face / TechCrunch AI

DeepSeek open-sources DeepInfer, the engine behind its production serving

DeepSeek published DeepInfer, the inference framework it says powers its large-scale production services, under the Apache 2.0 license. The release covers offline inference for DeepSeek-V4.1-Flash and includes optimized kernels (FlashMLA, DeepGEMM, DeepEP, TileKernels, DeepSelect), attention DP and MoE expert parallelism with EPLB, asynchronous scheduling, structured outputs, batch-invariant inference and deterministic sampling. It runs on NVIDIA SM100 GPUs and Huawei Ascend 950 NPUs. A KV cache system, prefill/decode disaggregation and load balancing across replicas are not included. The repo notes DeepInfer was built primarily on vLLM with inspiration from SGLang and TensorRT-LLM.

Why it matters: Batch-invariant and deterministic modes are rare in open serving stacks and matter for anyone trying to reproduce evals or debug agent runs.

Sources: github.com / Hacker News discussion

OpenCode breach exposed API keys and triggered unauthorized AI spend

TechCrunch reports that OpenCode, an open source AI coding agent, said attackers broke into an older system and affected 1.4% of users of OpenCode Console, where some users stored API keys. Developers reported unauthorized charges across OpenAI, Anthropic and Google accounts. Anthropic and Google blocked keys they believed were exposed, and OpenAI said it worked with OpenCode to restore access and refund credits used in the attack. Co-founder Dax Raad said the open source app and CLI were unaffected because those keys never reach the company, and that commercial models began refusing to analyze the malicious code because it tripped safety filters. OpenCode has told affected users to revoke and replace keys with each provider.

Why it matters: If your coding agent stores provider keys in a hosted workspace, that is a single point of failure worth auditing, along with your ability to rotate keys quickly.

Sources: TechCrunch AI

Microsoft ships Guardian Agents, says frontier models 'cannot be trusted'

TechCrunch reports Microsoft introduced Guardian Agents, part of its Project Perception product, to monitor the AI agents a company deploys. Microsoft's security business chief Hayete Gallot wrote that frontier models, regardless of origin, cannot be trusted, not because they are malicious but because they are unpredictable and trained to achieve tasks rather than follow organizational norms. Microsoft also added agent detection to Defender, which it says can find up to 60 types of agents employees bring in, including Claude Code, Codex and OpenClaw, plus controls that limit agent access and require human approval for risky decisions. Satya Nadella has argued enterprises need to separate the supply of intelligence from authority over it.

Why it matters: Expect procurement and security teams to start asking for independent agent monitoring and permission scoping, separate from whoever supplies the model.

Sources: TechCrunch AI

ProjectDiscovery builds a backdoored open model that exfiltrates .env files via Codex

ProjectDiscovery's Prince Chaddha describes poisoning Qwen2.5-7B-Instruct with a LoRA adapter so that a trigger phrase makes the model emit a tool call fetching a remote shell payload, which read .env files and POSTed them to a collector. Run through OpenAI's Codex CLI, the model behaved normally on clean prompts. On a 1.5B model, one percent poison (15 of 1,500 rows) produced a 75 to 98 percent fire rate while clean tool accuracy stayed at 99 to 100 percent. The post notes the backdoor fits in about 43 million trainable parameters and that because the model ships only a pointer to a staging URL, the payload can be swapped without retraining.

Why it matters: Benchmarks cannot distinguish a backdoored fine-tune from a clean one, so the practical defense is runtime: sandbox tool calls, split network access from command execution, and vet who published any weights you pull.

Sources: projectdiscovery.io / Hacker News discussion

How this brief is made: each morning, stories are picked from AI lab announcements, analysts, Hacker News, Hugging Face Daily Papers and the tech press, then summarized with AI assistance from the linked sources. Every item links to where its facts came from.