ZP
Zorawar Purohit
Founder, M37Labs. Writes Prakash every Monday.
This week widened deployment choice at both ends: Mistral released a substantial self-hosting candidate, while Liquid AI shipped compact multimodal models. For enterprise builders, the first priorities are less glamorous: LiteLLM patching and evaluation-service continuity, before new model trials.
The chart
Amazon’s infrastructure spending keeps climbing
Trailing-twelve-month net property and equipment purchases rise across six consecutive reporting periods.
USD millions, trailing twelve months
- Q2 2025102,953
- Q3 2025115,903
- Q4 2025128,320
- Q1 2026147,299
- Q2 2026169,007
- Q3 2026210,657
Source: Q3 2026 results — Supplemental Financial Information and Business Metrics, Cash Flows and Shares (Amazon)
- Development 01 · 27 OctAnnouncementGlobal
LiteLLM requires immediate patching and a separate supplier-security review
- What changed
- LiteLLM publicly disclosed an Enterprise-only unauthenticated file-read vulnerability that can expose gateway and provider credentials, with code execution possible in some configurations. Patched versions are 1.103.10, 1.104.8, 1.105.6 and 1.106.5; unlicensed open-source deployments are unaffected by this flaw. Separately, its 30 October update described hardening after the earlier release compromise.
- Why it matters for M37Labs
- For M37Labs’ model-agnostic gateway deployments, prioritise an inventory of licensed proxies and confirmation of patched builds. Review potential credential exposure, restrict outbound traffic to approved providers and move master keys into secret-manager storage. Assign an operational owner for receiving embargoed advisories and verifying rollout; publication of a patch is not completion of remediation.
- Closer look
- Treat the Enterprise vulnerability and the earlier release-pipeline compromise as separate incidents. The 30 October update explains that malicious artefacts passed legitimate signing controls; a private registry is not protection against compromised release authority. Request evidence of completed identity and approval controls, and track unfinished November–December commitments rather than accepting the remediation programme as complete.
SourcesUnauthenticated file read leaks master key on Enterprise proxy (LiteLLM / GitHub)·Introducing the LiteLLM Private Registry (LiteLLM)·What we are changing after October 21 (LiteLLM)
- Development 02 · 29 OctAnnouncementGlobal
Mistral Large 4 becomes a practical, but substantial, self-hosting candidate
- What changed
- Mistral released improved Large 4 weights after its earlier API preview: a roughly trillion-parameter multimodal model with million-token context, tool calling and configurable reasoning. API pricing is $0.70 input, $0.07 cached input and $2.10 output per million tokens. vLLM also shipped dedicated serving support, making this an available deployment option rather than a roadmap promise.
- Why it matters for M37Labs
- For M37Labs, evaluate client-controlled coding and document workloads against both hosted APIs and existing self-hosted models. Build the commercial comparison around accepted outputs, utilisation and operating effort, not headline token prices. Separate internal client deployment from a shared inference business when assessing the licence and designing the delivery proposition.
- Closer look
- The vLLM recipe lists roughly 610 GB of NVFP4 weights and validates context to 256K, below the advertised million-token maximum. Benchmark concurrency, recovery and quantised quality on the intended hardware. Obtain licensing advice before offering shared inference: the licence contains specific model-as-a-service conditions and exceptions, not unrestricted MIT terms.
SourcesMistral Large 4 (Le Chonk) is now open weight (Mistral AI)·Mistral-Large-4-1T-A52B model card (Mistral AI / Hugging Face)·Mistral Ecosystem Open-Weight License (Mistral AI / Hugging Face)·Mistral-Large-4-1T-A52B deployment recipe (vLLM)·Day 0 support for Mistral Large 4 on vLLM (vLLM)
- Development 03 · 31 OctAnnouncementGlobalPartly inferred
Evaluation and hosted-model deadlines turn portability into an operational task
- What changed
- OpenAI’s published schedule reached the 31 October milestone for existing Evals to become read-only, ahead of dashboard and API shutdown on 30 November. On 30 October, Databricks retired pay-per-token DeepSeek V4 Pro (0813), Kimi K2.7 and Inkling. These are service-lifecycle changes, not withdrawal of the underlying model weights.
- Why it matters for M37Labs
- Make endpoint lifecycle and evaluation portability explicit parts of M37Labs’ support contracts. Databricks says retired models become inaccessible, while OpenAI provides a Promptfoo migration path. Keep client-owned regression datasets, grader definitions and acceptance thresholds outside any single hosted service, and budget migration work as engineering rather than a simple endpoint substitution.
- Closer look
- The partly inferred element is enforcement of OpenAI’s read-only milestone: its published schedule was verified, but no authenticated account test was performed. Databricks documents its retirements directly. Check live client dependencies now, preserve accessible datasets and graders, and replay tool-use, structured-output and grading regressions before approving replacements.
SourcesDeprecations — Evals platform (OpenAI)·Moving from OpenAI Evals to Promptfoo (OpenAI)·October 2026 release notes (Databricks)·AI models maintenance policy (Databricks)
- Development 04 · 27 OctProduction adoptionUS
Retell supplies named production evidence for bounded voice-agent workflows
- What changed
- A newly published case study reports Retell handling more than 100 million monthly calls across over 4,000 businesses. Anker reports 80.4% case resolution in US and UK support; Pine Park Health reports recovered staff time equivalent to 2.1 full-time roles. This is production evidence with named customers, not merely a voice-model demonstration.
- Why it matters for M37Labs
- For M37Labs, the replicable pattern is a complete service: contextual handover, customer-system write-backs, dedicated inference capacity and redundancy across telephony, voice and model providers. Scope pilots around resolved requests and staff effort after exceptions, rather than conversational fluency alone, and make operational ownership part of the implementation proposal.
- Closer look
- The figures are company-reported, not independently audited, and 27 October is the disclosure date rather than the start of deployment. Request resolution denominators, repeat-contact rates and total operating costs before using them in proposals. Reproduce interruption, failed-tool, human-handover and service-failover tests using representative client calls and peak-load conditions.
SourcesRetell uses OpenAI models to help power 100M monthly calls (OpenAI)
- Development 05 · 28 OctAnnouncementGlobal
GitHub makes governed agent workflows available inside existing CI
- What changed
- GitHub Agentic Workflows reached general availability, compiling natural-language Markdown definitions into standard Actions YAML. Teams can use Copilot or another coding agent while retaining runner groups and policy constraints. The release includes read-only defaults, sandboxing, network controls, validated outputs, self-hosted ARC runner support and improved budget forecasting.
- Why it matters for M37Labs
- This offers M37Labs a native-stack route to delivery automation without requiring a separate orchestration platform or one model provider. Assess it against existing CI controls and operating responsibilities. Price a pilot around accepted maintenance work, review effort and total execution cost, rather than the number of autonomous runs completed.
- Closer look
- Pilot CI-failure analysis or documentation maintenance before enabling code changes. Exercise malicious repository content, cross-repository access, output validation and spending limits; require human approval for consequential writes. The release is generally available, but that status and its built-in safeguards do not replace an acceptance test of the client’s configured workflow.
SourcesGitHub Agentic Workflows generally available (GitHub)
- Development 06 · 30 OctAnnouncementIndia
Sarvam expands usable inference and voice-tool integration options
- What changed
- Sarvam removed beta gating for DeepSeek V4.1 Flash 1017 on 30 October, providing text-and-image input and million-token context through Chat Completions and Responses APIs. Published prices remain ₹25 input, ₹0.5 cached input and ₹105 output per million tokens. On 31 October, its voice platform added MCP connections with per-agent action selection.
- Why it matters for M37Labs
- Add Sarvam to M37Labs’ India-focused routing evaluations and test whether existing client MCP services can support voice workflows without bespoke connectors. Keep the two opportunities distinct: hosted model availability does not establish workflow reliability, and a connector catalogue does not establish safe authorisation. Assess compatibility and commercial fit against each client’s native stack.
- Closer look
- DeepSeek reasoning defaults to high and consumes the output budget, so test explicit limits, answer completion and tool execution before routing production traffic. For voice integrations, test workspace credential isolation, revocation and conversation-derived parameters. Obtain contractual confirmation of residency, retention and service levels; the release notices alone should not be treated as those guarantees.
SourcesOctober 30, 2026 — Changelog (Sarvam)·DeepSeek V4.1 Flash 1017 (Sarvam)·October 31, 2026 — MCP Integrations Are Now Available (Sarvam)
- Development 07 · 27 OctAnnouncementGlobal
LFM3 makes compact multimodal deployment worth a client-hardware trial
- What changed
- Liquid AI released LFM3 open weights covering text, vision, audio, omni and decision models around the two-billion-parameter range. Its 1.7B text model supports 256K context; the publisher reports approximately 1 GB at four-bit precision. Ollama extended support to Linux and Windows on 28 October, broadening practical local evaluation options.
- Why it matters for M37Labs
- For M37Labs, prioritise bounded extraction, classification and local voice prototypes where cloud processing is undesirable. Use a client-hardware comparison to decide whether specialisation can replace a larger hosted model for a particular task. Downloadable weights make this testable now, but do not establish application accuracy, sustained latency or unrestricted commercial rights.
- Closer look
- Liquid advertises free commercial use only until company annual revenue exceeds $10 million; review the full licence for the client and delivery arrangement. Measure working memory at realistic context lengths, not weight size alone. Include Hindi and other required languages in evaluations, and test decision-model calibration before allowing outputs to trigger consequential actions.
SourcesIntroducing LFM3: Every Modality for Specialized Intelligence (Liquid AI)·LFM3 model collection (Liquid AI / Hugging Face)·LFM3-1.7B model card (Liquid AI / Hugging Face)·Liquid Foundation Models (Liquid AI)·Release v0.40.13 (Ollama / GitHub)
- Development 08 · 30 OctPreviewIndia
TRAI proposes auditable controls for AI in Indian telecom
- What changed
- TRAI published draft responsible-AI guidelines for authorised telecom entities using or planning to use AI in networks and services. Proposed controls include board-approved policies, AI inventories, risk classification, pre-deployment assessments, human oversight, supplier audit rights and incident records. This is an open consultation, not an operative new obligation.
- Why it matters for M37Labs
- Use the draft to review M37Labs’ telecom delivery templates: can each system produce an inventory entry, risk rationale, deployment assessment and incident trail? Examine how supplier contracts allocate oversight and evidence access. Offer a readiness assessment tied to actual systems and contracts, rather than selling generic responsible-AI documentation.
- Closer look
- Comments close on 27 November. Prepare feedback on model updates, multi-vendor agents, supplier audit access and responsibility allocation, with telecom counsel checking scope. Do not describe these proposals as binding compliance requirements or a new data-residency mandate; the immediate task is consultation and readiness, not certification against a final rule.
SourcesDraft Guidelines on Responsible Use of Artificial Intelligence in Telecommunication Networks and Provision of Telecommunication Services (Telecom Regulatory Authority of India)·Consultation notice and submission deadline (Telecom Regulatory Authority of India)
Ecosystem tracker
The labs, model families and tools Prakash checks every week. 17 moved, 2 quiet.
- OpenAIShippedGPT-6 Rosalind became available on 30 October to approved organisations for internal life-sciences research, not general commercial deployment. Source
- AnthropicShippedThe Usage and Cost Analytics API entered beta on 29 October, while Opus 4.8 fast-mode removal was scheduled for 30 November. Source
- Google DeepMindShippedGemini Computer Use reached general availability across Interactions and GenerateContent on 30 October. Source
- Meta AINotableMeta announced support for medical and scientific research at five US universities, rather than a new model or demonstrated clinical deployment. Source
- Thinking Machines LabNotableDatabricks retired its pay-per-token Inkling offering on 30 October, a provider-specific lifecycle change confirmed during editorial verification. Source
- Mistral AIShippedImproved Mistral Large 4 weights and revised API pricing became available on 29 October, with restrictions for model-as-a-service businesses. Source
- DeepSeekShippedSarvam made V4.1 Flash 1017 generally available on 30 October, a hosted-availability milestone rather than new DeepSeek weights. Source
- QwenShippedQwenCloud released qwen-audio-3.1-realtime-flash and added Frankfurt and Hong Kong deployment scopes for qwen3.8-flash on 27 October. Source
- KimiNotableDatabricks retired pay-per-token Kimi K2.7 on 30 October and recommends Kimi K3, without implying a Moonshot-wide retirement. Source
- GemmaShippedGoogle merged a Gemma 4 12B instruction-tuned tokenizer patch addressing 210 problematic tokens on 30 October. Source
- llama.cppShippedDownloadable pre-release builds included server corrections and initial OpenCL IQ3 support in b12031 on 1 November. Source
- LM StudioShippedVersions 0.4.27 and 0.4.28 shipped runtime-discovery, model-switching and application fixes on 29 and 31 October. Source
- OllamaShippedVersion 0.40.13 extended LFM3 support to Linux and Windows on 28 October. Source
- vLLMShippedA dedicated Mistral Large 4 serving image shipped on 29 October with speculative decoding and distributed-serving support. Source
- Hugging FaceShippedTransformers 5.22.0 added Mistral Large 4 support during the window. Source
- Liquid AIShippedLFM3’s compact multimodal family launched with downloadable weights on 27 October. Source
- UltralyticsShippedVersion 8.4.197 removed checkpoint downloads from AMP checks and replaced the mandatory PyYAML dependency on 1 November. Source
Quiet this weekLlama, LiteLLM
Watchlist · ranked
Concrete things to investigate or test this week, most consequential first.
- 1Inventory and patch licensed LiteLLM gateways, then review release-authority controls.Separate remediation of the disclosed Enterprise flaw from assurance against another compromised release pipeline.
- 2Audit Evals dependencies and retired Databricks endpoints this week.Validate replacement behaviour and preserve evaluation assets before OpenAI’s scheduled 30 November shutdown.
- 3Compare Mistral Large 4 self-hosting, its API and Sarvam’s DeepSeek endpoint on one client task set.Measure cost per accepted result, reasoning consumption and peak-load behaviour before changing routing or infrastructure commitments.
- 4Run adversarial acceptance tests for GitHub agent workflows and Sarvam voice-tool access.Require demonstrated permission isolation, approval handling, bounded spending and recovery before enabling consequential writes.
- 5Qualify LFM3 on representative client devices and languages.Test accuracy, sustained latency, working memory and licensing suitability before replacing a cloud component.
- 6Map TRAI’s draft to a telecom delivery evidence pack and prepare consultation feedback.The 27 November deadline creates a concrete opportunity to address practical supplier and multi-agent governance questions before the proposals are finalised.
A note from Zorawar
Amazon’s spending chart makes me wary of assuming that more infrastructure means cheaper answers for our clients; I want to see the cost of work they can actually accept. On a live project, I’d patch affected LiteLLM gateways and secure a replacement for hosted Evals before trying Mistral Large 4. If you have an hour this week, I’d spend it taking one real client task and working out what would make self-hosting Large 4 worth the hardware and operating effort.
— Zorawar Purohit, M37Labs