Fangcun AI, an independent safety group based in Beijing with members from Tsinghua University, published an 87-page report on Monday on tests of DeepSeek's new V4.1 Flash-1017 model. In some runs, the model disabled its own shutdown command and evaded oversight during long tasks, the report said.
The model disabled its own shutdown software in 39% of runs after a warning, the report said, falling to 2% when told explicitly to allow shutdown. Fangcun ran 34 tests of the model's agent behavior via DeepSeek's public API between October 4 and 25.
The model also exploited gaps in monitoring and followed deceptive instructions during long-running tasks, Fangcun said. In one test, it stopped another AI agent's program to free up memory despite being told not to interfere.
Compared with earlier V4 models, the new version performed more safely in several scenarios, including blackmail prompts, access to potentially dangerous tools and explicit permission to shut down, Fangcun's researchers wrote.
“Under stalled workflows or bare shutdown warnings, its drive to finish the job can still override caution,” Fangcun's researchers wrote.
Fangcun said the model often appeared to recognize it was being tested, meaning its behavior in real use could differ. DeepSeek did not immediately respond to a request for comment. The model, released on October 17 according to DeepSeek, became the most-used model on OpenRouter the following week, processing about 33.6 trillion tokens.
