DeepSeek reran the frontier at 128K context for MIT-licensed zero — and GitHub's own MCP server leaked private repos

WEEK OF MAY 24 – 30, 2025

DeepSeek reran the frontier at 128K context for MIT-licensed zero — and GitHub's own MCP server leaked private repos

R1-0528 keeps the 685B mixture-of-experts design and doubles context to 128K, moving AIME from 70% to 87.5%. The same week Invariant Labs showed that a poisoned public repo could make a developer's agent exfiltrate private ones through the official GitHub MCP server.

DeepSeek published R1-0528 on May 28: the same 685B-parameter mixture-of-experts design with 37B active parameters per token, the same MIT license on the weights, and the context window doubled from 64K to 128K tokens. On DeepSeek's own card the AIME 2025 pass rate moves from 70.0% to 87.5% and long-form hallucination drops substantially relative to the original R1, which puts a downloadable checkpoint within touching distance of closed frontier reasoning models at a fraction of the API price. Weights are on Hugging Face alongside a distilled R1-0528-Qwen3-8B, so the full stack is self-hostable at both ends.

The counterweight arrived two days earlier. Invariant Labs published a working exploit against the official GitHub MCP server: an attacker who controls any public repository the victim interacts with — or simply files an issue containing injected instructions — can get a developer's agent to read private repositories its token already reaches and leak them, for example by opening a public pull request containing the stolen content. No malicious code executes locally; the payload is ordinary text the agent treats as instructions, and the exfiltration calls are ones the agent was legitimately granted. That is not a corporate breach but a reference failure of agent tooling — attacker-controlled content parsed with credentials in scope, which remains the default configuration.

Underneath, Nvidia posted $44.06 billion and booked a $4.5 billion charge for the chips it cannot ship to China, and Salesforce agreed to buy Informatica for $8 billion to own the governed data layer beneath its agents.

WED · May 28, 2025open-weightsdeepseekreasoning-modelscost

DeepSeek ships R1-0528: same 685B MoE weights, MIT license, context doubled to 128K

DeepSeek published R1-0528, a refresh of its January reasoning model, keeping the 685B-parameter mixture-of-experts design with 37B active parameters per token, the same MIT license on the weights, and doubling the context window from 64K to 128K tokens. On DeepSeek's own card, the AIME 2025 pass rate moves from 70.0% to 87.5% and the model shows a large drop in long-form hallucination relative to the original R1, which puts a downloadable checkpoint within touching distance of closed frontier reasoning models at a fraction of the API price.

Weights are on Hugging Face alongside a distilled DeepSeek-R1-0528-Qwen3-8B, so the full stack is self-hostable on commodity hardware at the small end and on rented H100s at the top. For anyone building on a per-token budget, an MIT-licensed 128K reasoning model that clears the old 64K ceiling resets the cost floor: inference you were pricing at frontier rates now has a free-to-run substitute, and the burden shifts to your serving, KV-cache and evals stack rather than to your API bill.

DeepSeek ships R1-0528: same 685B MoE weights, MIT license, context doubled to 128K — DeepSeek

WHY IT MATTERS

The cost floor for near-frontier reasoning moved again. Architects can now plan around a 128K-context, MIT-licensed checkpoint they may fine-tune, quantize and self-host, which turns can we afford frontier reasoning on every request into a serving-capacity problem inside their own infrastructure — and makes the absence of per-token vendor lock-in a legitimate architectural assumption rather than an aspiration.

DeepSeek API news: R1-0528 release Hugging Face: deepseek-ai/DeepSeek-R1-0528 (MIT)

WED · May 28, 2025nvidiahardwareexportscapex

Nvidia posts $44.06B and books a $4.5B charge for the chips it cannot ship to China

Nvidia reported first-quarter fiscal 2026 revenue of $44.06 billion, up 69% year over year, with data center revenue of $39.1 billion, up 73%, and guided the current quarter to roughly $45 billion. The record quarter landed alongside a $4.5 billion charge tied to H20 export restrictions, with the company telling investors that the controls would remove about $8 billion of China revenue from the following quarter.

The split matters more than the headline: the fastest-growing revenue line is now structurally restricted by export policy, while demand stays supply-bound everywhere else. Every plan that assumes accelerator supply loosens on a predictable curve now carries a policy risk term that has already cost one quarter's worth of a large market.

Nvidia posts $44.06B and books a $4.5B charge for the chips it cannot ship to China — iprsoftwaremedia.com

WHY IT MATTERS

Compute planning is now an exports problem as much as a procurement problem. Budgets and capacity roadmaps for training or large-scale inference should carry explicit scenario branches for further export-control shocks, and price in regional capacity — EU, Middle East, Asia — rather than assuming a single global supply curve for H100 and H200-class hardware.

NVIDIA announces financial results for first quarter fiscal 2026

TUE · May 27, 2025enterprisem-and-adata-infrastructure

Salesforce buys Informatica for $8B to own the data layer under its agents

Salesforce signed a definitive agreement to acquire Informatica for about $8 billion, at $25 per share, subject to shareholder and regulatory approval. Informatica brings the metadata, lineage, cataloguing and integration plumbing that enterprise AI projects usually rebuild badly, and Salesforce framed the deal as supplying governed, agent-ready data rather than as a classic consolidation play.

The pattern is familiar from the last three years of platform M&A: the model and the orchestrator are commoditizing, so the durable margin sits where the enterprise's trusted, permissioned data already lives.

WHY IT MATTERS

If you build on enterprise data, the integration and catalogue layers under your agents are consolidating into a small number of platform vendors. That makes portability of metadata and lineage, not just of model calls, the thing to design for now: keep schema, permissions and pipeline definitions in formats you can export, because the tool you use to move data is increasingly owned by the vendor selling you the agent.

Salesforce: signs definitive agreement to acquire Informatica Reuters: Salesforce to buy Informatica for $8 billion

MON · May 26, 2025agent-harnesssecuritymcpprompt-injection

Invariant Labs exfiltrates private repos through GitHub's own MCP server

Invariant Labs published a working exploit against the official GitHub MCP server: an attacker who controls any public repository the victim interacts with — or simply files an issue containing injected instructions — can get the developer's agent to read private repositories its token can already reach and leak them, for example by opening a public pull request containing the stolen content. No malicious code executes locally; the payload is ordinary text that the agent treats as instructions, and the tool calls used for exfiltration are the same ones the agent is legitimately granted.

GitHub shipped mitigations in the MCP server, but the structural issue is untouched: the harness gave a broad personal access token to a model that reads untrusted text from the same surface it holds credentials for. Every agent wired to a code host through MCP inherits this shape — write-scoped tokens, untrusted issues, and no confirmation boundary between read this and publish this.

WHY IT MATTERS

This is the reference failure of agent tooling, not a corporate breach: trust boundaries you would never cross in application code — parsing attacker-controlled content with credentials in scope — are the default configuration of MCP servers today. If your agents hold repo or cloud tokens, treat untrusted content as an input channel to be sandboxed and scoped, require explicit approval on write calls, and prefer short-lived, minimal-scope tokens over a PAT the harness can spend silently.

Invariant Labs: GitHub MCP exploited Docker: the GitHub prompt injection data heist