OpenAI just handed you the harness behind Codex, and DeepSeek shipped a million-token model with an MIT license
Friday, September 11, 2026·8 min read·4 stories
Yesterday was infrastructure day and nobody called it that. OpenAI stopped selling you an agent and started selling you the harness it runs Codex on — sessions, sandboxes, subagents, compaction, all of it behind one API call, with no fee on top of the tokens. The same day it put a full-duplex voice model in the API at five cents a minute. DeepSeek answered with a million-token model under MIT whose KV cache is small enough to change what fits on your GPU. And Google quietly open-sourced the part of security work everyone hand-rolls: the loop that reproduces a bug, patches it, then attacks the patch.
No sponsored or affiliate links in this digest — the links below are sources only.
Story I
The Agents API is the Codex harness, rented out — and the beta's limits matter more than its features
OpenAI put the Agents API into public beta on September 10. What you get is the managed Codex harness with four objects: an agent (model, instructions, tools, MCP servers), an environment (an optional sandbox), a session (a durable instance that keeps working and takes new input), and the events and items flowing through it. Compaction, tool search, programmatic tool calling and subagents are built in rather than reimplemented by you — the docs cap concurrent subagents at four, and sessions are created with a plain POST to /v1/agents/sessions.
Pricing is the honest part: there is no separate fee. You pay for tokens, for tools, and for container time on OpenAI-hosted sandboxes. If you would rather not hand over the execution environment, you run codex exec-server yourself and it connects out over WebSocket, or you pick one of nine partner sandboxes — Blaxel, Cloudflare, Daytona, DigitalOcean, E2B, Modal, Oracle, Runloop and Vercel.
Now the two lines that decide whether you can use any of this. During the beta, data residency is US-only, and Zero Data Retention is not supported — and self-hosting the sandbox does not buy back ZDR eligibility, because the model traffic is still OpenAI's. If you sell to European or regulated customers, that is not a footnote, it is the whole evaluation. Everyone else gets a harness that took most teams a quarter to build badly.
For builders
Port one task, not your product. Pick the least valuable agent you run — a nightly repo chore, a doc-sync job — and rebuild it against the Agents API today, then compare three numbers against your own loop: total tokens per completed task, wall-clock time, and how many turns it burns before it gets to the tool call. Compaction and tool search are exactly where homegrown loops leak tokens, so that diff is the entire business case. Before you port anything customer-facing, read your own DPA first: US-only residency plus no ZDR rules this out for regulated workloads no matter how good the numbers are. And keep your task definitions in your own format with a thin adapter — a harness you rent is a harness someone else versions.
Story II
GPT-Live-1: full duplex at five cents a minute, and one benchmark you should read before you sell it
The second release is voice. GPT-Live-1 is now in the API at $0.05 per minute of audio, and it listens and talks at the same time, which is the difference between an assistant that handles an interruption and one that has to be waited out. Turn-taking latency is down to 0.8 seconds from 1.4 on the previous model, and it ships with twelve new voices across different accents, dialects and languages.
Against GPT-Realtime-2.1 the numbers OpenAI published are: full-duplex interactivity 80.1% versus 45.4%, tool-calling accuracy 87% versus 60%, and a banking voice-support benchmark at 32% versus 12.4%. Yelp is already running it for phone reservations.
That banking figure is the one to sit with. A 32% pass rate is nearly triple the old model and still a failure on two calls out of three in that suite. Voice quality has arrived; voice reliability in a transactional flow has not. The gap between those two is where support tickets live.
For builders
Run the arithmetic before the demo: $0.05 a minute is $3 an hour of conversation, so a four-minute support call costs about twenty cents in model spend — cheap enough that the build cost, not the inference, is now your constraint. Then instrument the two things the benchmarks do not cover in your domain: log every barge-in with a timestamp so you can measure whether duplex actually shortens calls, and diff every tool call against what a human would have done, because 87% accuracy means roughly one in eight goes wrong and voice gives the user no transcript to catch it. Put a hard routing rule in front of anything financial — payment, account changes, balance disclosure hands off to a person. And price the pilot per resolved call, not per minute, or you will optimize for the wrong metric.
Story III
DeepSeek-V4.1-Flash: 1M context under MIT, and a KV cache of 890 bytes per token
DeepSeek released V4.1-Flash on September 10 under an MIT license, on Hugging Face with vLLM, SGLang and Transformers support. The shape is unusual: a 552B backbone plus 196B of Engram parameters, but only 8B active per token during prefill and 16B during decode, across a 40-layer stack split into a 20-layer causal encoder and a 20-layer decoder.
The number that matters operationally is the cache. The global KV cache is 890 bytes per token using FP4 in E2M1 format — roughly a quarter of DeepSeek-V4-Flash and, by the company's own comparison, 437 times smaller than V1. With a 1M-token context window, that is about 890MB of cache for one fully loaded session instead of several gigabytes.
Published scores: Terminal-Bench 2.1 at 90.6, DeepSWE v1.1 at 74.2, a Codeforces rating of 3471, GPQA Diamond at 90.9. Training ran on 45T multimodal tokens at a 7:1 text-to-multimodal ratio, pre-trained at 64K sequence length and extended to 1M. The hosted API offers low, high and max reasoning tiers; per-token pricing was not published with the release, which is its own kind of answer.
For builders
Do the cache math for your own box before you believe any context-window claim: 890 bytes per token means a 200K-token session costs about 178MB of KV, so a 80GB card that used to hold a handful of long sessions now holds dozens — concurrency, not context length, is what actually got cheaper here. If you serve long-document workloads, stand it up on vLLM and measure two things against your current model: tokens-per-second at 200K context, and cost per resolved task rather than per million tokens, since 8B active parameters in prefill changes the shape of both. The MIT license is the other half — this is one of the few frontier-class weights you can legally ship inside a customer's VPC, which is exactly the box that US-only residency locks you out of elsewhere.
Story IV
Google open-sourced Mantis, and the interesting part is that it re-attacks its own patch
Google published Mantis under Apache 2.0 on September 9: a modular skills toolkit that lets a coding agent run a vulnerability end to end. It takes a suspected flaw, strips false positives, reproduces the bug inside a sandbox, writes a minimal patch, attacks that patch again, and scores what risk is left.
Skills ship as separate directories invoked as slash commands — /mantis-history, /mantis-researcher, /mantis-reproduce, /mantis-patch, /mantis-report — with a supervisor skill, /mantis-meta-agent, sequencing whole workflows. It runs with Gemini CLI, Antigravity CLI, Google ADK, or any comparable framework. Google reports that its hierarchical summary trees cut token overhead by more than 85%, and frames the whole thing against the sub-7% true-positive rates that AI code scanning currently produces.
Google is explicit that this is for local evaluation and not production yet, which is the correct posture for a tool whose failure mode is a confident patch on a bug it misread.
For builders
Point it at history before you point it at your backlog. Take five bugs you already fixed — ones with a known root cause and a known patch — check out the parent commit, and run the full Mantis chain on each. You get two numbers out of that: how often it reproduces the bug at all, and how close its patch is to the one you shipped. That is a far better signal than any scan count, and it costs you an afternoon. If the reproduce step works reliably on your stack, the cheapest real deployment is not scanning for new flaws but triaging your existing scanner output, where the sub-7% true-positive rate is already eating engineer hours. Keep a human between the patch and the merge button, and keep the residual-risk score in the PR body so reviewers see what the agent was unsure about.