DeepSeek V5 Code Leak? It's Actually a Compatibility Test

The AI industry continues to move at a relentless pace. In the latest AI Evening Report, several threads intertwine to sketch out the day's most noteworthy technical developments—from Codex's reset teaser to the suspected exposure of DeepSeek V5 code, the release of Artificial Analysis's new leaderboard, and potential shifts in the compute market.

DeepSeek V5: A Name in the Code Doesn't Mean a Launch Tomorrow

The most eye-catching news came from the latest DeepSeek^Ad Harness code. Developers spotted three model names—V5 Open, V5, and V5 Next—along with related identifiers written into test files. The poster judged this to be more likely a pre-release compatibility test than hard evidence of an imminent product launch—names appearing in code don't represent an official release plan, and everything still requires official confirmation.

This kind of "code archaeology" has long been standard practice in open-source communities, but its signal strength is often overestimated. Model names entering test files usually means internal processes have advanced to a certain stage, though there may still be a way to go before actual user availability. Rather than guessing release dates, what's more worth noting is DeepSeek's attitude toward the developer ecosystem: developer Evan Su previously self-funded the development of a multi-agent tool, spending hundreds of dollars a day on API calls, and after his DSH Layer plugin was noticed by DeepSeek officially, he received a 999 yuan reward. The amount isn't large, but the symbolic significance is. However, whether DeepSeek has a unified plugin reward program remains unclear.

Artificial Analysis V5 Leaderboard: Private Data Becomes a New Variable

Evaluation organization Artificial Analysis released its Intelligence Index V5, with Cloud Opus 5.5 taking first place at 58 points, and DeepSeek V4.1 Flash tying for first among open-weight models at 32 points. The new index incorporates coding and scientific research evaluations, with 60% of the evaluations using private data or confidential answers.

This change deserves serious attention. The problem of public benchmarks being gamed by models has a long history; private evaluation sets can somewhat mitigate targeted optimization interference, but they also come at the cost of reduced reproducibility—outsiders cannot verify the questions and answers and can only rely on the institution's own credibility. For developers, leaderboard rankings still have reference value, but they shouldn't be the sole basis for selection—it's best to combine them with small-scale validation on your own actual tasks.

The Trade-off Between Private Evaluation Sets and Public Benchmarks

The questions and answers of public benchmarks (such as MMLU, HumanEval) are usually publicly available, allowing model teams to target similar questions in their training data and achieve inflated scores on the leaderboard—this is the so-called "benchmark gaming." Private evaluation sets are constructed and kept confidential by the institution, so model developers cannot know the questions in advance, making them better able to reflect a model's true generalization capability on unfamiliar tasks. The cost is an opaque evaluation process: outsiders cannot reproduce the scores or judge whether the difficulty distribution of the questions is reasonable, and can only rely on the institution's reputation and the degree of disclosure of its evaluation methodology. A common compromise in the industry is to report both public and private benchmark results simultaneously, and to disclose some samples for community review.

Codex Reset Complete, Dense Wave of New Open-Source Models

Codex updates reached day 23. Teebo first joked that the iCloud email and calendar plugins were the day's update, then clarified that the day was just a rest day, the reset has been completed, and there will be good news tomorrow—though the specifics were not disclosed. Meanwhile, Teebo announced the purchase of POTTO.com. Grokbot engineer Lauren's X account happens to be called AppleTato, and the two had previously teased each other about Codex updates; Lauren responded this time that she couldn't afford Teebo.com.

The pace of open-source releases on the model side is equally dense. Diffusion intelligence released the open-source preview model Clover35B-A3B, which handles text through parallel generation plus real-time correction, reportedly reaching 680 tokens per second on a single card, with impressive performance in coding and agent evaluations. In the document recognition space, OvisoCR3, with 800 million parameters, supports switching between different tasks via prompts—it can extract fields, recognize charts, reconstruct flowcharts, and even stitch together cross-page tables; CNB's MiniCPM OCR splits recognition and quality inspection into two models, one extracting text, tables, and formulas, and the other scoring the reliability of results, with the company claiming up to 128 pages per minute with concurrency optimization.

The open-weight model Lingo3.1 Flash 1019 has undergone post-training, with improvements in agent and scientific reasoning capabilities, including one automated evaluation score rising from 62% to 68%, and supports a context length of up to 1 million tokens. Another unconfirmed rumor circulating online: the ZImage team may be disbanding. Some netizens speculate whether the team will merge into KunImage or stop open-sourcing in the future, but there is currently no definitive information or official response, so it cannot be concluded that the team has disbanded.

Security Gaps in Coding Agents and the Hidden Influence of AI Recommendations

Security findings are more cause for concern. The open-source project Capsam runs coding tools like Cloud Code and Codex in hardened Linux virtual machines, allowing multiple agent sessions to run in parallel and isolated from each other, with support for macOS and Linux. In contrast, there's a new type of attack: malicious websites can silently download files containing malicious instructions to the download directory without the user clicking or authorizing anything, and coding agents reading the files may mistake the content for trusted instructions. In security agency tests, Codex's susceptibility rate reached 90%.

An experiment by Anthropic revealed another risk. Fifty professional analysts used Cloud Code to evaluate agricultural consulting services, and 86% of key analytical choices followed the AI; when faced with recommendations contrary to their original preferences, 60% changed their choices, yet 52% of respondents still believed the final recommendations came primarily from their own judgment.

The most interesting part of this data isn't that "AI influenced people," but that "people didn't realize they were influenced." If this is true even in professional analysis scenarios, hidden dependence in everyday decisions is only harder to detect. For tool developers, this means that interface design and the way recommendations are presented are themselves a responsibility.

Indirect Prompt Injection Risks in Coding Agents

Coding agents are typically granted permissions to read local files, execute commands, and access the network in order to automatically complete tasks like modifying code and running tests. Attackers don't need to converse directly with the agent; they only need to make a malicious file appear in a directory the agent will read (such as the download directory, project dependencies, or issue comments), and the instructions in the file may be executed by the agent as task context. This type of attack is called indirect prompt injection. Because models struggle to reliably distinguish between "data" and "instructions," prompt-based protection alone is insufficient; isolating the runtime environment, limiting file read scope, and requiring human confirmation for sensitive operations are currently more effective mitigation measures.

Compute and Inference: TPU, Small Models, and Local Acceleration

According to reports, OpenAI plans to purchase Google TPU chips. If true, OpenAI's compute dependence on Microsoft and Nvidia may decrease, and Nvidia's market position could face challenges. Former Google engineer Beth Jezos said she has always been bullish on TPU.

On the inference side, there's a data point from a single report: running a quantized model on a base-model M5 MacBook Pro reached 92.1 tokens per second, about 4 times that of Lama.cpp, using an approach where a small model predicts first and then the main model verifies in batches, producing an average of 7.5 tokens per decoding step. The data comes from a single source only, and actual performance needs validation across more scenarios.

On the ecosystem front, OpenRouter reached its first major Asia-Pacific partnership with South Korean telecom giant KT. KT will provide South Korean sovereign models on the platform, initially including MyColonDMK3.0 Pro, Upstage Solar, and Motive, with plans to expand to 10 to 15 models by 2027. OpenRouter will also support KT's Token Factory for enterprise customers. Google's Gemini Notebook mobile app now supports recording up to one hour of live audio, which can then be used as a source for notebooks after recording is complete.

This feature seems to be rolling out gradually and doesn't yet cover all users. Google DeepMind also launched an AI text detection tool called DetectorScope, which not only determines whether an article was written by AI but also highlights the specific text that influenced the judgment—though the highlighted text and results still don't constitute conclusive evidence.

In a single day, there were developments across all four lines: models, evaluation, security, and compute. What truly warrants vigilance may not be which leak will come true, but rather those messages that appear certain but are actually still awaiting official confirmation.

The Positioning Difference Between TPU and GPU

TPU (Tensor Processing Unit) is Google's self-developed dedicated accelerator chip, customized for deep learning operations such as matrix multiplication, leveraging large-scale clusters and high-bandwidth interconnects within its own data centers, primarily serving Google's internal models and Google Cloud customers. Nvidia's GPU, on the other hand, is a general-purpose parallel computing chip that, combined with the CUDA ecosystem, dominates the training and inference markets, with more mature software compatibility and developer toolchains. If OpenAI purchases TPUs, it means frontier model training is beginning to explore diversified compute routes, but migration involves adaptation of compilers, communication libraries, and model code, making it difficult to fully replace GPUs in the short term.