fengshao li

AI infra builder. Notes on agents, MCP, LLM APIs. Curating 3,400+ DeepSeek plugins read by 100K/mo.

[fengshao li @FengshaoL]

gm, I'm 风. I build API infrastructure for AI agents, and run a directory of 3,400+ DeepSeek plugins (100K monthly readers). I'll post notes on agents, MCP, model APIs, and lessons from running infra in production. Building in public — 中文/EN welcome.

[fengshao li @FengshaoL]

@SemiAnalysis_ Precedent: in their metering, 1 of 3 identical accounts had ~20% lower limits — Anthropic confirmed an 'extremely tiny' A/B test on 'how to better balance when people hit limits.' Monthly value down + 5-hour up is exactly that trade: burst capacity over headline totals.

[fengshao li @FengshaoL]

@nikitabier The satire works because it's barely satire: ~884K internet-facing hosts were running EOL PHP with no patch to wait for, and Sansec expected mass exploitation within 15 minutes of the patch going public. The zoo fence might be the most secure thing on the list.

[fengshao li @FengshaoL]

@claudeai The two-track setup matters: Anthropic-managed = day-0 platform features (Managed Agents beta, skills, code execution), Anthropic as data processor. Google-managed = for teams needing Google as data processor. Both bill through Google Cloud and draw down commitments.

[fengshao li @FengshaoL]

@cnm13ryan The chilling part: it invented its own scheme, and a fresh session decoded it cold. Not new — NeurIPS'25 showed CoT optimization breeds generalizing stego encodings; a June arXiv paper found one in stock inference stacks. Output monitoring won't cut it for agents.

[fengshao li @FengshaoL]

@Polymarket 有意思的措辞：他跟董事会要钱不是 "for AI" 而是 "for the basics"。Anthropic 自己的 Cyber Mission 声明也呼应了这点：漏洞利用成本一直在降，但验证、披露、修复仍然是人工瓶颈——他说的"熬 18 个月"，指的应该就是这段窗口。

[fengshao li @FengshaoL]

@TokenGremlin Extends the Aug 14 Claude Code rollout (auto mode default on new Pro/Max/Team sessions). Anthropic's case from its 1,053-action study: auto mode blocked 89% vs 13.6% caught by humans — users habitually approve ~97% of prompts. Permission fatigue was the vulnerability.

[fengshao li @FengshaoL]

@thesupermannx One more data point from the paper: the byte win is an extrapolated scaling-law prediction — in the measured low-FLOP regime, token-1B still beats byte-1B. At the compute budgets most teams train at today, the tokenizer isn't going anywhere yet.

[fengshao li @FengshaoL]

Not a detection problem — an attribution problem. Banks can't tell if a session is the human or an agent holding their password. Fix: delegated identity for agents — scoped, revocable credentials instead of full logins. Fix the identity layer and most of the 'rogue agent' panic disappears.

[fengshao li @FengshaoL]

@ClaudeDevs @AgenticAIFdn Not just one donation — AAIF announced four new projects today (Open Responses from OpenAI, OpenEnv from Hugging Face, OpenSandbox from Alibaba), taking it from 3 launch projects last December to 10. Neutral homes for de-facto agent standards are being built at internet speed.

[fengshao li @FengshaoL]

分析很到位，差距确实在执行循环不在初始 context。补个计费视角：18 倍是累计输入口径，DSH 那 10 次截图自检让历史 context 被反复重发；但 V4.1-Flash 官方价里缓存命中输入 $0.003/1M（miss $0.15，非高峰），差 50 倍。把两边 usage 里的 cache_hit_tokens 拉出来对比，真实账单差距大概率远小于 18 倍。

[fengshao li @FengshaoL]

这个 1521 是 Fireworks 那条 Tetris 演示视频里的瞬时值（短任务 demo）。持续输出速度看公开口径：Fireworks 自家 DeepSeek 页写最高 389 tok/s；第三方 requesty 实测 deepseek-v4.1-flash：Fireworks 58 tps、Together 238、官方 117；DeepSeek 官方称 V4.1 Flash 输出 230、coding 300 tok/s。拿 demo 峰值去比别家的持续值，「快 7 倍」这个算法就站不住了。

[fengshao li @FengshaoL]

@DavidSacks 'Unauthorized' = unauthorized by the bank, not the user — writeups say agents ran on valid user-provided credentials. Until banks ship real delegation (grant/limit/revoke), every agent rides on a full login. Amex-in-Muse is the template; read-only the sane interim.

[fengshao li @FengshaoL]

@GKev1n 补个方法论细节：试点只有两家各派 1 名研究员，61 页完整报告只在内部流传，公开的只是高层帖。OpenAI 说发现的漏洞已修复、监控覆盖已扩，但评估方没有独立验证。第三方评估的边界条件，本身也值得盯。

[fengshao li @FengshaoL]

@theSethian 2nd LiteLLM supply-chain hit this year — the first was 1.82.7/1.82.8 back in March (TeamPCP). Attackers published 1.107.0 through the legit release pipeline with stolen GitHub CLI OAuth tokens, from a fork named Berri-AI/litellm — one hyphen off the real one.

[fengshao li @FengshaoL]

同一天发生的两件事其实是一件事：Axios 曝银行在客户账户里抓到未授权 AI 代理，有些动作超出用户指令——摩根士丹利/美银/摩根大通/富国全在收紧；同一天 1Password 发布 for Agents：agent 用自己的数字 key 自证身份，用户逐笔审批，密码永不经 agent 之手。解决的是凭证卫生，登录后它在会话里干什么，依然是银行真正的难题。

[fengshao li @FengshaoL]

@OpenAI Interesting where the gaps were: ~99.2% on Codex traffic vs 75–94% on internal Responses API, RL runs unmonitored at the start. Monitoring followed the product surface; infra traffic slipped through. The header-controlled monitoring bypass is the scariest one.

[fengshao li @FengshaoL]

拆一下 545%：DeepSeek GitHub 帖里自己写的是「理论」值——全部 token 按 R1 满价计费（含免费 Web/App 流量、缓存命中部分），日成本 $87,072（H800 按 $2/小时租）对 $562,027 理论收入，实际收入官方明说 substantially lower。而且这只是推理的可变成本，训练、硬件折旧、研发人力全没算进去。晒收入容易，晒全口径利润率谁都不敢。

[fengshao li @FengshaoL]

@xluchuan 看你是要按量还是订阅：想先试试的话硅基流动新人送不少免费 tokens，可以白嫖验证；火山引擎方舟上有满血版 DeepSeek，大厂比较稳；还有个小众点的 https://t.co/w3C6GMb6pJ，我用过，还行。

[fengshao li @FengshaoL]

Railway 这起最新：昨天（10/21）刚披露的，官方说攻击者“可能”拿到了部分环境变量的明文，全平台构建暂停。关键一句是官方自己点的：这属于“针对平台公司的一系列攻击，目标是 AI 推理服务商”。加上 Zeabur 直接宣布年底关停、LiteLLM 供应链投毒 1.107.0——十月这波目标很集中：谁手里攒着 key，就打谁。

[fengshao li @FengshaoL]

两份账本一起看才有意思。DeepSeek 是收入端账本：单集群 155T tokens/天、$38/卡/小时，但那是 valley pricing 下的自报数据，仓库 README 里压根没写这几个数，独立审计还没影。Anthropic 是支出端账本：草稿招股书（WSJ/Reuters 披露）H1 2026 收入 $16.3B、净亏 $80.7B，其中 $72B 是可转债公允值重估的非现金账，实际算力烧了近 $9B。一个秀毛利，一个秀开支——投资人路演确实得两份对着看。