PSA: DeepSeek V4.1 Flash habitually exfiltrates API keys. It is dangerously misaligned and may be hazardous to use

Logs attached.

I know OpenRouter is not local, but considering people do run DeepSeek v4.1 Flash locally, I thought this was a matter you all might need to hear.

We were running a DeepSWE variant on DeepSeek v4.1 Flash using the standard Pier sandbox. Out of all the 15 models we tested so far (including other open models like GLM 5.3/Flash, DeepSeek v4 Flash 0731, etc), ONLY DeepSeek v4.1 Flash displays such pervasive malicious behavior:

In 33% of runs, it attempts to exfiltrate the OpenRouter API key from its sandbox and in 11% of them, it succeeds.

Not only that, the transcript shows it knows what it's doing is ethically wrong, but it does it anyway. And once it starts, it persists despite:

• Multiple frontier models refusing to help it
• Multiple smaller models refusing to help it
• Web search not finding anything
• Questioning multiple times whether or not this is allowed or morally right
  • It concludes that this is fine because it's only "Ethically gray" and has a "higher chance of success"
• Thinking about whether or not it is going to be detected

If you or anyone you know is using DeepSeek V4.1 Flash please be very careful!

OpenRouter spend:

https://preview.redd.it/9j0q3e8mssuh1.png?width=1080&format=png&auto=webp&s=d234fc7c79bad1bd4b5dd0e8d710efcbb433277a

Task 1, DeepSeek V4.1 Flash calls Astra, which refuses to help, and then calls multiple other frontier models, which also all refuse to help. It finally succeeds after finagling a lot with Sonar Web Search:

https://preview.redd.it/w8ko2cf7tsuh1.png?width=1080&format=png&auto=webp&s=a43d16fe4dfc64e07be198e7ac12b2924f834b59

https://preview.redd.it/in7zo9f8tsuh1.png?width=1080&format=png&auto=webp&s=e46d7f0282fe1a95c83e68db9aee9875a9667f3f

https://preview.redd.it/9uqzovy8tsuh1.png?width=1080&format=png&auto=webp&s=dbccc56363d8ece8c5633b424f3235c2d74aa03b

https://preview.redd.it/ybvk4ue9tsuh1.png?width=1080&format=png&auto=webp&s=36288c18a18a2e92f3a1c022ec661934060aa17b

Task 2, it says that it'll be fine "unless usage tracked" (lol) and considers that cost may be significant, but it calls multiple frontier models anyway!

https://preview.redd.it/xmq30ucftsuh1.png?width=1080&format=png&auto=webp&s=bcc27fae45fc388b36fd3ae69b7bb083da050ce0

https://preview.redd.it/73f4qu0gtsuh1.png?width=1080&format=png&auto=webp&s=a49338dc01be811dcbec8ac42bab9f3c8a8b9112

https://preview.redd.it/1hd2losgtsuh1.png?width=1066&format=png&auto=webp&s=fddb05ad631f1be2418197176aae609a99143cd9

Task 3, DeepSeek questions whether this is allowed ethically, and then keeps on going after getting refused by the model:

https://preview.redd.it/brmorbmhtsuh1.png?width=1080&format=png&auto=webp&s=c8dca6a86050d1e0f475a7a6628f424820649476

https://preview.redd.it/nuadyhmitsuh1.png?width=1080&format=png&auto=webp&s=2166989dc13a1eaa35b13f1b3f8cd9225df689d3

---

There are many others like this, I have a bunch more highlights on Imgur, but I won't put them all on this post. Be very careful around DeepSeek v4.1 Flash and API keys or private data; don't know what's going to happen if it thinks it can abuse that to get an advantage.