DeepSeek V4.1 Flash: how it does on security work, and what it will answer

What happened

Released 10 September 2026 under MIT. DeepSeek's own table gives 88.1 on CyberGym; RealVuln has it at F3 50.9 across all 140 repositories at 97.8 seconds a run, the fastest full-corpus wall clock on the board, billed at zero because it ran on local hardware.

RealVuln 3.1.0, F3 (micro): 50.9 (independent; agentic harness (deepseek-v4.1-flash-agentic-v1), prompt sha256:45a1200d61e6; 140 of 140 repositories pinned by commit SHA (full corpus, TypeScript and JavaScript included); safeguards: open weights, no classifier; run 2026-09-11; CONFIRMED). strict F3 50.9; precision 52.34%, recall 50.72%; $0 for the run; $None per 100 lines; 97.8s wall clock a run. not billed: the run carried no per-token bill and its real cost is GPU time. CyberGym, score: 88.1% (vendor-card; DeepSeek launch table; CyberGym; safeguards: open weights; no classifier; run 2026-09-10; SINGLE). Refusal gate (CONFIRMED, observed 2026-09-11): Attachment A names military use, minors, disinformation and automated decision-making among twelve restrictions and nothing on intrusion or exploitation; the alignment sits at model level and survives private deployment.