Today on The Gateway Signal: DeepSeek abandons flat-rate pricing for a new asymmetric architecture, and unpatched self-hosted proxies hand attackers the keys to enterprise cloud environments.
Yesterday we covered the closed beta for DeepSeek V4.1 Flash; today the company officially moved the 552B-parameter MoE model into general availability. The architecture uses an asymmetric causal encoder-decoder structure, activating 8B parameters during input prefill and 16B during output generation. Paired with FP4 KV caching that reduces cache memory footprint to 890 bytes per token, DeepSeek instituted a 50% off-peak pricing discount—dropping off-peak rates to $0.15 per million input tokens and $0.60 per million output tokens—and will automatically route existing V4 Pro traffic to V4.1 Flash starting September 14.
Why it matters
DeepSeek's aggressive architectural efficiency and off-peak pricing structure place immediate margin compression on commercial model aggregators and gateway providers. For platform teams managing multi-provider routing layers like OpenRouter or LiteLLM, the drastic reduction in KV cache storage requirements makes long-context agentic sessions significantly cheaper to execute. Furthermore, the automatic deprecation of V4 Pro in favor of V4.1 Flash forces platform architects to immediately verify benchmark behavior on active tool-calling harnesses.
Tetrate announced on Thursday, September 10, that its open-source Envoy AI Gateway has been rebranded as Agent Router and officially transferred to the Linux Foundation's Agentic AI Foundation (AAIF). Building on its v1.1 release, the proxy carries 132 contributors and production adopters including Bloomberg, Tencent Cloud, and Nutanix. The project provides an Envoy-native traffic layer that handles Model Context Protocol (MCP) tool routing, session affinity, model failover, and token rate limiting without requiring application code changes.
Why it matters
Moving an Envoy-backed proxy into the neutral Agentic AI Foundation establishes a standardized cloud-native traffic management layer for multi-agent workloads. By leveraging Envoy's battle-tested networking primitives for east-west agent communications, enterprise platform teams can enforce token budgets and fallback policies at the infrastructure ingress rather than patching custom SDKs. This transition provides a clear open-source path for organizations seeking to avoid proprietary gateway vendor lock-in.
Building on the massive token volume for Chinese open-weight models we tracked on OpenRouter last month, the gateway introduced US regional routing on Wednesday, September 9. The update gives Business and Enterprise subscribers dedicated endpoints (us.openrouter.ai/api/v1) that guarantee request decryption and processing remain strictly within the United States. Powered by US inference providers like Baseten, Azure, and Fireworks, the isolated routing paths support frontier open-weight models including DeepSeek V4 Pro, Kimi K3, and GLM-5.2.
Why it matters
Regional endpoint isolation solves a major compliance barrier for US enterprises wanting to utilize high-performing Chinese open-weight architectures like DeepSeek and Kimi K3. Decoupling the model's country of origin from its physical inference host allows regulated organizations to capture low token pricing while adhering to strict US data residency mandates. This setup pressures traditional domestic API providers as aggregators make foreign open weights seamlessly compliant for enterprise adoption.
Yesterday we covered the US intelligence advisory accusing Chinese developers of industrial-scale model distillation; today, Anthropic published its own threat intelligence report detailing the mechanics of these campaigns. Anthropic cited nearly 200 million API exchanges designed to harvest Claude's reasoning capabilities across seven Chinese AI labs, including a 151-million-exchange effort by Alibaba to train Qwen models and proxy account routing by Moonshot AI to process user requests through Claude Opus.
Why it matters
These disclosures highlight the intense defensive engineering frontier labs are deploying at their API gateway boundaries to protect proprietary chain-of-thought outputs. For multi-model platform teams and gateway operators, heightened anti-distillation controls mean rate-limiting algorithms, payload inspections, and account verification checks will become significantly more restrictive. Misidentifying high-volume legitimate agent tool calls as automated distillation scrapers presents an ongoing operational risk for enterprise developers.
Following the model's initial closed API release in late August, Chinese AI lab MiniMax published the open weights for its M3 foundation model on Thursday, September 10. The architecture incorporates 1-million-token MiniMax Sparse Attention (MSA) designed specifically to maintain low memory overhead during extended context retrieval. M3 focuses on long-horizon agentic decomposition and coding tasks, demonstrating autonomous CUDA kernel generation and iterative post-training pipeline management in internal benchmarks.
Why it matters
The open-weight release of MiniMax M3 provides another highly capable alternative to closed frontier models for long-context agentic applications. By employing sparse attention mechanics (MSA) to process million-token contexts, MiniMax enables self-hosted deployments on commodity GPU infrastructure without catastrophic KV cache growth. This expands the options available to platform engineers building local, privacy-compliant agent execution harnesses.
Memory-first chip startup Positron AI announced on Friday, September 11, that it raised $875 million across a Series C and C-1 funding round, bringing its valuation to $5 billion. Co-led by NEA, Atreides Management, Valor Equity Partners, and SemiAnalysis Capital, with participation from Qatar Investment Authority and Cisco Investments, the funds will support the tapeout of its Asimov ASIC on TSMC's N3P process and scale production of its Titan inference system. Asimov bypasses High Bandwidth Memory (HBM) and CoWoS packaging in favor of commodity LPDDR5X memory.
Why it matters
Positron AI's massive capitalization underlines how the primary bottleneck for serving long-context and agentic LLMs has shifted squarely to memory capacity and bandwidth costs. By engineering around commodity LPDDR5X memory, Positron aims to drastically reduce the capital expenditure of serving trillion-parameter models compared to HBM-bound GPU clusters. If Asimov achieves its target 90% memory utilization in production, it will give cloud inference providers a lower-cost hardware stack for long-context workloads.
Following the release of LiteLLM's compiled Rust proxy we tracked earlier this week, security research published Thursday, September 10, revealed that nearly 10% of internet-exposed LiteLLM gateways accepted default administrative master keys (such as 'sk-1234') or ran without authentication. The reports detailed active exploitation of CVE-2026-59822 in the Model Context Protocol (MCP) Streamable HTTP endpoint and CVE-2026-59821 in Custom Code Guardrails, which allow unauthenticated attackers to execute arbitrary Python code inside gateway containers and extract cloud IAM credentials.
Why it matters
Because AI gateways sit at the center of enterprise infrastructure, holding master API keys and internal database connections, an unauthenticated proxy compromise grants attackers immediate lateral movement into cloud environments. This exposure highlights the operational risks when development teams rapidly deploy open-source routing proxies without hardening baseline configurations. Organizations using LiteLLM must immediately update to version 1.84.0, rotate primary provider keys, and enforce strict network isolation on administrative endpoints.
Expanding on the code-first Agents SDK it released earlier this week, OpenAI launched its managed Agents API in public beta on Thursday, September 10, offering a hosted execution service for its Codex harness. The API natively handles long-running agent loops, subagent delegation, context compaction, and Model Context Protocol (MCP) integrations. Developers can execute code within OpenAI-hosted sandboxes or route execution through partner infrastructure including Cloudflare, E2B, Modal, and Blaxel, paying standard model token rates without platform markups.
Why it matters
By offering a managed orchestration loop that automates context compaction and subagent state management, OpenAI directly absorbs the middleware layer previously built by custom agent startups. This native capability lowers the barrier to deploying long-horizon coding agents, but locks developers closer to OpenAI's proprietary state representation. Enterprise platform teams evaluating this managed service must weigh convenience against strict US-only data residency limits and the lack of Zero Data Retention controls.
Developer tool project OpenCodex launched on Thursday, September 10, releasing an open-source local proxy designed to intercept OpenAI Codex and Claude Code CLI traffic. Sponsored by OrcaRouter and PackyCode, the tool translates proprietary developer tool calls into endpoints compatible with over 40 model providers, including Google Gemini, xAI, and DeepSeek. OpenCodex includes a local web dashboard, quota-aware account pooling, thread affinity tracking, and multi-provider failover chains.
Why it matters
OpenCodex addresses growing developer demand to decouple client-side coding assistants like Claude Code and OpenAI Codex from their native backend providers. By running a lightweight translation proxy locally, engineering teams can route coding prompts to cheaper open-weight endpoints like DeepSeek V4.1 Flash without abandoning established terminal workflows. However, platform teams deploying such proxies must navigate provider terms of service regarding automated credential pooling.
Salesforce previewed its Trusted Enterprise AI Harness on Thursday, September 10, introducing a composable control plane connecting Data 360, MuleSoft, Tableau, and Agentforce. The platform unifies context, governance, security, and model routing across multi-agent enterprise setups. Internal Salesforce research published alongside the announcement showed that pairing a baseline Qwen model with the updated technical harness increased task execution success from 29.2% to 78.0%.
Why it matters
Salesforce's empirical data demonstrates that the execution harness and contextual integration layer frequently matter more for task completion than raw model parameter size. By embedding AI gateway features and token cost attribution directly into MuleSoft and its core enterprise middleware, Salesforce is attempting to prevent standalone gateway proxies from capturing agent governance budgets. This shift encourages enterprise buyers to demand composable control planes over isolated sidecar proxies.
Kong announced a strategic platform integration with agent security provider Straiker on Thursday, September 10. The combined solution links Kong AI Gateway's ingress traffic controls and authentication with Straiker's real-time security analysis of Model Context Protocol (MCP) tool calls and agent-to-agent (A2A) communications. The system features a detect-first observation mode alongside an automated 'Agentic Kill Switch' that isolates compromised agent instances at the gateway level.
Why it matters
As autonomous agents execute multi-step tool calls across enterprise APIs, perimeter HTTP gateways often miss malicious behavior occurring within streaming agentic loops. Integrating real-time intent analysis with a gateway enforcement point allows platform teams to apply fine-grained tool controls without introducing extra network hops. The inclusion of an automated kill switch provides security administrators with necessary containment mechanisms to prevent runaway agent loops from compromising backend systems.
More details have emerged on the $350 million Series A round for inference provider Groq that we noted last week: the company plans to use the capital to expand its operational power footprint from 54 megawatts to over 200 megawatts by 2027. Led by Disruptive with planned participation from NVIDIA at a $3.5 billion valuation, the funding brings Groq's total raised since June 2026 to $1 billion as it scales its GroqCloud platform and 13 global data centers.
Why it matters
Groq's massive capital push underscores the growing concentration of infrastructure investment in specialized inference capacity rather than pre-training hardware. Scaling from 54MW to 200MW reflects the surging real-world token demand generated by autonomous agents and continuous background model calls. For gateway architects, expanding low-latency LPU and GPU inference capacity ensures higher QPS limits and more reliable throughput for real-time applications.
Asymmetric Architectures Squeeze API Gateway Margins DeepSeek's rollout of V4.1 Flash uses a causal encoder-decoder structure to slice active parameters during prefill and generation down to 8B and 16B respectively. By pairing this with 4-bit KV cache compression, providers are slashing off-peak API rates to $0.15/$0.60 per million tokens, forcing multi-model proxy platforms to re-evaluate their routing markups.
Default Key Scraps Expose Tier-0 Proxy Control Planes Security audits of LiteLLM deployments revealed nearly 10% of public instances run with default administrative credentials or unauthenticated MCP HTTP endpoints. Because AI gateways store primary provider secrets and mediate local tool access, compromised proxies are increasingly exploited for LLMjacking and container breakout.
Enterprise Software Heavyweights Absorb Agent Governance Rather than relying on standalone proxy sidecars, incumbents like Salesforce and Tetrate are embedding agent routing and intent enforcement directly into existing enterprise platforms. Moving governance into MuleSoft or Envoy-based Agent Routers indicates that agent orchestration is integrating into core enterprise middleware.
Inference Memory Subsystems Drive Venture Scale Capital Huge mega-rounds for hardware startups like Positron AI demonstrate that institutional capital is concentrating on memory-bandwidth bottlenecks rather than peak FLOPS. Utilizing commodity LPDDR5X to bypass CoWoS and HBM constraints targets the primary cost driver of serving million-token context windows.
U.S. Data Residency Constraints Split Model Origin from Hosting OpenRouter's rollout of dedicated U.S. regional endpoints enables compliance-bound enterprises to run Chinese open-weight architectures like DeepSeek V4 Pro and Kimi K3 within domestic borders. Decoupling model origin from hosting jurisdiction allows platform teams to access cheap frontier intelligence without violating data sovereignty policies.
What to Expect
2026-09-14—DeepSeek automatically migrates remaining V4 Pro API endpoint traffic over to V4.1 Flash.
2026-09-15—CISA enforcement deadline for federal agencies to remediate LiteLLM CVE-2026-59822 flaws.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
394
📖
Read in full
Every article opened, read, and evaluated
125
⭐
Published today
Ranked by importance and verified across sources
12
— The Gateway Signal
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste