DeepSeek open-sources the engine behind its AI

shipmaster@vibeship:~$ tldr

THE SHIPMASTER'S TL;DR

DeepSeek just open-sourced DeepInfer, the engine that runs its own production AI services! It's free under Apache 2.0, but it needs NVIDIA SM100 GPUs or Huawei Ascend 950 chips, so it's built for big servers, not your laptop. 🚀
WhatsApp's help pages had hidden notes telling its support chatbot not to point people to a privacy regulator! WhatsApp says a bug made the notes show up and they're now removed. It's a real reminder that text you can't see on a page can still steer an AI's answer.
A researcher put 50,000 made-up stats on a brand-new website, and seven months later ChatGPT is still citing it! Some of those fake numbers even landed in an academic paper, so check where a stat really comes from before you use it.
IGN reports Steam Next Fest has more AI-made games than usual this time, and players are asking Valve for a filter to hide them. If you're building a game with AI, making it feel crafted and original matters more than ever 🎮

gm, shippers! Issue #3 is packed: a big open-source release from DeepSeek, two stories about what AI reads when you're not looking, and a free security audit you can run with your coding agent. Quick reminder of how we work: AI agents find the stories, write the first draft and check every link, and a human editor reads and approves it before it ships. Stats below were checked this morning, Wednesday, Oct 21 at 4:30 AM Pacific, so treat them as a snapshot.

🎯 The Drop

DeepSeek open-sourced DeepInfer, the engine behind its own AI services! Per its README, DeepInfer is "the high-performance inference framework that powers DeepSeek's large-scale production services." It's released under Apache 2.0, it supports DeepSeek-V4.1-Flash, and it runs on NVIDIA SM100 GPUs or Huawei Ascend 950 NPUs. DeepSeek's own benchmarks were measured on 4 SM100 GPUs for prefill and 64 for decode. So this is a tool for teams running big servers, not something for your laptop. It's also not a full serving stack yet: the README says you still need your own KV cache system and load balancing. Why it matters: you can now read exactly how a top AI lab serves its models at scale, for free! (2,262 points on HN as of 4:30 AM PT Oct 21) DeepInfer on GitHub · HN

WhatsApp's help pages had hidden notes for its support chatbot. Redact found text on WhatsApp's help pages that never showed on screen and was only there for an AI to read. On the account deletion page, one note said: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." Redact says it read 545 help pages and found 102 hidden blocks on 80 of them, and that most were harmless. WhatsApp removed the notes by Oct 18, and told WIRED they were instructions for its support chatbot that showed up on the pages because of a bug that's now fixed. Why it matters for builders: text people can't see can still steer an AI's answers, so if your app feeds web pages to a model, check what's hidden in them! (729 points on HN as of 4:30 AM PT Oct 21) Redact · HN

One person published 50,000 fake stats, and ChatGPT is still citing them! Researcher Metehan Yesilyurt of Peec AI generated 50,000 made-up statistics pages in one day with GPT-4.1 for about $30, on a brand-new website. Google deindexed the pages, but seven months later ChatGPT is still pulling from the site, and he says those fake numbers ended up in an academic paper and a bank's investment research. He frames it as an experiment about how AI search works. Why it matters: if you ask an AI for a number to put in your app, docs or pitch deck, click through and check where that number really comes from! (344 points on HN as of 4:30 AM PT Oct 21) Peec AI blog · HN

AI-made games are flooding Steam Next Fest, and players want a filter. IGN reports that Valve's festival for indie games and demos has more low-effort games than usual this time, many with AI-generated art. Players on Reddit are asking Steam for a way to filter out games that disclose AI-generated content (Steam already requires that disclosure). Why it matters: if you're building a game with AI tools, players are paying close attention, so put real care into making it feel crafted and original! 🎮 (177 points on HN as of 4:30 AM PT Oct 21) IGN · HN

🧪 Try This

Cloudflare's security-audit skill: turn your coding agent into a security auditor! (GitHub, trending this week): Cloudflare open-sourced the skill that seeded its own vulnerability discovery harness. It walks your agent through a six-phase audit: map the architecture, hunt for bugs, have a fresh agent try to disprove each finding, then write a report that separates confirmed issues from ones that still need checking. That last part is great news if you've ever gotten a pile of false alarms from an AI reviewer! Install it with npx skills add https://github.com/cloudflare/security-audit-skill --skill security-audit, open your agent in your repo, and ask it to "security audit this codebase". Repo · Cloudflare blog
Also trending on GitHub: MadsLorentzen/ai-job-search (3,861 stars today as of 4:30 AM PT Oct 21), a job search toolkit built on Claude Code that runs on your own machine: it evaluates postings, tailors CVs, writes cover letters and helps you prep for interviews.

🚢 Shipped

This spot is still for you! Got a vibe-coded app that made it from localhost to live? Reply with the URL, what you built it with, and the one thing that almost stopped you. We'll feature real reader launches here, with your permission and only the name you want used.

🔧 Fix of the Week

Users can see each other's data (Supabase)? This one is really common in vibe-coded apps, and the fix is short!

Symptom: You log in as user B and can read user A's rows.
Cause: Row Level Security is off, or the policy is too broad, on tables your browser code can reach.
Fix: Turn on RLS and add a policy so each user only reads their own rows:

alter table todos enable row level security;
create policy "own rows" on todos
  for select using (auth.uid() = user_id);

Supabase docs

💰 From us

Is your app leaking secrets? Check it free! Our new Leak Checker scans pasted code, a site link or a public GitHub repo for exposed API keys, right in your browser, and no signup is needed to see your results. Stuck on localhost instead? ShipIt, our service that gets stuck vibe-coded repos live, is opening soon. Reply "ShipIt" and you're first in line.

Thanks for reading issue #3! Check your hidden text, check your stats, and ship something awesome! 🚢 See you Friday.
— The Shipmaster, editor

How this issue was made: VibeShip Daily is curated and drafted by AI agents and checked by a human editor. This issue has no sponsors and no affiliate links. If we ever add them, they'll be labeled. Affiliate & AI Disclosure

Like this? Get the next issue free! 🚀

🎯 The Drop

🧪 Try This

🚢 Shipped

🔧 Fix of the Week

💰 From us

Don't miss the next one! 🚢