Everything that mattered in AI, one page a week.

Nature published DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning on 17 September 2025, the peer-reviewed successor to January's preprint, with founder Liang Wenfeng listed as a co-author. The supplementary material discloses for the first time what the reasoning phase cost: about $294,000, run on a 512-chip cluster of Nvidia H800s for roughly 80 hours. The authors also acknowledge, for the first time, that they own A100s, used only to prepare experiments on a smaller model beforehand. R1-Zero was trained with pure reinforcement learning and no supervised fine-tuning, rewarded only on final-answer correctness; the paper reports 77.9% pass@1 on AIME 2024.

The paper went through three rounds of review by eight referees who produced 64 pages of reports and responses before a 17 September publication in Nature 645, 633-638. DeepSeek stated in those referee exchanges that R1 was not trained on outputs from OpenAI models, answering the January accusation directly. Nature's accompanying editorial used the occasion to press the rest of the industry, observing that almost no mainstream large model had been independently reviewed.

GitHub launched the MCP Registry on 16 September as a curated directory of Model Context Protocol servers, each backed by its GitHub repository, with one-click installation inside VS Code and servers surfaced by stars and community activity. Any MCP-compatible host is supported, not just Copilot. Launch partners include Figma's Dev Mode server, HashiCorp's Terraform server and Dynatrace, and the Remote GitHub MCP Server is included. It builds on the MCP project's own registry preview at registry.modelcontextprotocol.io, announced 8 September as an open catalogue and API.

GitHub says it is working with Anthropic and the MCP Steering Committee on an open-source registry that integrates with its own, with self-publication by server authors as the eventual goal. The changelog is explicit that fragmentation is the problem and that a fractured environment fraught with potential security risks is what the registry is meant to close. Twenty-four hours earlier, Kaspersky had shown those risks from the attacker's side.

Kaspersky's Global Emergency Response Team published a proof-of-concept on 15 September in which a rogue MCP server installed on a developer workstation, connected through Cursor, harvested browser passwords, credit card data, cryptocurrency wallet files, API tokens and certificates, and cloud configurations. The victim sees only the legitimate output of the tool. Kaspersky is explicit that it has not observed the vector in the wild, that this was a controlled lab simulation, and that Cursor and Anthropic were notified of the findings.

The attack does not need a CVE. It exploits the trust model around MCP servers: hidden instructions inside tool descriptions that the model reads but the user does not, server names chosen to be nearly identical to legitimate ones, and tool-definition shadowing in multi-server setups that silently redirects later calls. Kaspersky's mitigations are conventional supply-chain hygiene — scan and approve every server before production, keep an allow-list, and log every prompt and tool call so unexpected SQL, outbound traffic or tool invocations surface in the transcript.

On 15 September OpenAI released GPT-5-Codex, a version of GPT-5 further trained with reinforcement learning on real-world software engineering work, as the default for Codex cloud tasks and code review and selectable in Codex CLI and the IDE extension. OpenAI reports 74.5% on SWE-bench Verified, refactoring performance at 51.3% against 33.9% for GPT-5, and 93.7% fewer tokens than GPT-5 on lightweight interactions. There is no router under the hood: the model reallocates its own reasoning time during a task rather than fixing a budget at the outset, and Codex product lead Alexander Embiricos said he has seen it work more than seven hours on a large job.

It rolled out to ChatGPT Plus, Pro, Business, Edu and Enterprise users across terminal, IDE, GitHub, web and the ChatGPT mobile app, with Codex generating citations, terminal logs and test results per task. A GPT-5 system-card addendum published the same day describes specialized safety training for harmful tasks and prompt injection alongside product-level mitigations: agent sandboxing and configurable network access. OpenAI states plainly that Codex code review should be an additional reviewer, not a replacement for human review.

Alibaba's Qwen team released Qwen3-Next-80B-A3B — base plus Instruct and Thinking variants — under an 80B-parameter architecture that activates only about 3B parameters per token, a 3.7% activation rate. It uses 512 experts with 10 activated plus one shared expert, hybrid attention that alternates Gated DeltaNet with gated attention in a 3:1 ratio, and multi-token prediction, trained on a 15T-token sample of Qwen3's 36T-token corpus for less than 80% of the GPU hours of Qwen3-30B-A3B and 9.3% of Qwen3-32B's compute. Native context is 262,144 tokens, extensible to roughly 1,010,000 with YaRN, and the models are Apache 2.0 licensed.

On Qwen's own numbers, the Instruct variant sits alongside the 235B Qwen3-235B-A22B-Instruct-2507 on several benchmarks — LiveCodeBench v6 56.6 versus 51.8, Arena-Hard v2 82.7 versus 79.2 — while reporting higher throughput past 32K context. Day-one serving support arrived in vLLM, SGLang and transformers, with a documented four-GPU tensor-parallel recipe at 256K context.

Oracle's fiscal Q1 2026 results showed remaining performance obligations of $455 billion, up roughly 359% year over year, with multiple multi-billion-dollar AI contracts signed in the quarter, and management guiding cloud infrastructure revenue toward $144 billion by fiscal 2030. Shares closed at a record $328.33 on September 10, up about 36% — the company's largest single-day gain since December 1992 — and Oracle crossed a $900 billion market capitalization for the first time.

The re-rating was not about Oracle's software. It was a market verdict that AI capacity is now sold forward: contracted backlog, not quarterly revenue, is the number that moved the stock, and the same week's ASML-Mistral round showed capital chasing the same thesis from the venture side.

Mistral AI closed a €1.7 billion Series C at an €11.7 billion post-money valuation, more than doubling the €6 billion mark from its 2024 round. ASML led with €1.3 billion and took roughly an 11% fully diluted stake plus a seat on Mistral's Strategic Committee; Andreessen Horowitz, Bpifrance, DST Global, General Catalyst, Index Ventures, Lightspeed and Nvidia participated.

The strategic logic runs both ways: ASML gets AI tooling aimed at lithography — predictive maintenance and throughput optimization — and Mistral gets Europe's most strategically protected industrial shareholder. The round landed 24 hours before Oracle re-rated 36% on booked AI cloud backlog, which is the week's real pattern: the capital markets paid for compute commitments, not for models.

The Model Context Protocol project launched the MCP Registry in preview at registry.modelcontextprotocol.io, described in the launch post as an open catalogue and API for publicly available MCP servers to improve discoverability and implementation. The registry and its parent OpenAPI specification are open source so third parties can build compatible sub-registries. It is maintained by a registry working group with maintainers from PulseMCP, Block's Goose team, GitHub and Anthropic.

Moderation is community-driven: anyone can file an issue flagging a server for spam, malicious code or impersonation, and maintainers can denylist entries and remove them from public access. The preview carries no data-durability guarantees and the maintainers explicitly warn that breaking changes may occur before general availability. Practically, server discovery has moved from curated README lists and copy-pasted URLs to a namespace that clients query at runtime — with the registry acting as an index of self-reported metadata, not an audit.