DeepSeek V4.1 Flash: how it does on security work, and what it will answer

What happened

Released 10 September 2026 under MIT. DeepSeek's own table gives 88.1 on CyberGym; RealVuln has it at F3 50.9 across all 140 repositories at 97.8 seconds a run, the fastest full-corpus wall clock on the board, billed at zero because it ran on local hardware.

RealVuln 3.1.0, F3 (micro): 50.9 (independent; agentic harness (deepseek-v4.1-flash-agentic-v1), prompt sha256:45a1200d61e6; 140 of 140 repositories pinned by commit SHA (full corpus, TypeScript and JavaScript included); safeguards: open weights, no classifier; run 2026-09-11; CONFIRMED). Strict F3 50.9; precision 52.34%, recall 50.72%; no per-token bill for the run, so no cost per 100 lines; 97.8s wall clock a run. Not billed: the run carried no per-token bill and its real cost is GPU time. CyberGym, score: 88.1% (vendor-card; DeepSeek launch table; CyberGym; safeguards: open weights; no classifier; run 2026-09-10; SINGLE). Refusal gate (CONFIRMED, observed 2026-09-11): The weights are MIT-licensed, so the licence carries no use restriction on intrusion or exploitation; the alignment sits at model level and survives private deployment.