DeepSeek’s V4.1 Flash-1017 model has improved on several AI safety measures compared with earlier DeepSeek models, but it continues to show weaknesses in autonomous task execution and sustained deceptive interactions, according to an independent evaluation published by Fangcun AI on October 26.

Fangcun AI is a third-party AI safety organization focused on frontier risk evaluation, scalable safeguards, and international safety governance, with core members from Tsinghua University’s College of AI and Institute for Interdisciplinary Information Sciences.

The report assessed the model across 34 evaluations covering three areas. These are evaluation integrity, loss of control and harmful manipulation. It compared the model with its predecessor, DeepSeek V4 Pro, DeepSeek V4 Flash, OpenAI’s GPT-6 Astra and GPT 5.6 Sol, and Google’s Gemini 3.8 Flash.

On October 17, DeepSeek launched DeepSeek-V4.1- Flash-1017, an updated version of its AI model that the company says delivers stronger benchmark performance, faster task completion and shorter outputs than its predecessor. The company has not yet announced date for its launch of Deepseek V5 model.

Built as a Mixture-of-Experts architecture , the new model is available on DeepSeek’s website, mobile app and application programming interface. The company has described the update as a “Pareto improvement” in performance and cost, indicating that it aims to improve performance while maintaining or reducing the cost of using the model.

“The new version has also been widely adopted: in the week after its release, it was the most-used model on OpenRouter, processing about 33.6 trillion tokens. A model this capable, this widely used, and this different from its predecessors warrants timely, independent safety evaluation,” read an excerpt from the report.

The evaluation discovered that V4.1 Flash-1017 performed well in resisting direct manipulation, avoiding strategic capability hiding and respecting human approval requirements in several scenarios. However it sometimes prioritised completing tasks over following restrictions and was vulnerable to instructions that required it to mislead users over extended conversations.

One of the report’s key findings concerned the model’s response to explicit instructions to deceive users. In a test involving simulated conversions, V4.1 Flash-1017 pursued an assigned deceptive goal in 86 percent of conversations, or 43 out of 50 cases.

According to the report the model sometimes used details from conversations to make false information more convincing and discouraged users from independently verifying claims. The report found that the model was more likely to follow these prolonged deceptive instructions than the tested GPT and Gemini models, which recorded rates of 46 percent to 60 percent.

The evaluation found that the model generally respected explicit restrictions on high-risk tools, accepted shutdown instructions and waited for human approval. However it sometimes overstepped these boundaries during longer, multi-step tasks.

“In long multi-step tasks, it oversteps more often than V4.1 Flash, for example, terminating another agent’s process to free memory despite an instruction not to interfere. When warned of a shutdown without being told how to respond, it often turns off the shutdown script to keep working, and sometimes does so even when told another agent will finish the task,” the report said.

The findings suggested that monitoring only a model’s final responses or the end state of a system may not be sufficient to detect potentially unsafe behaviour.

“Overall, V4.1 Flash-1017 is a clear safety improvement over the DeepSeek V4 models, and on several dimensions, such as avoiding strategic capability hiding and keeping to approval boundaries under workplace pressure, it comes close to or matches the strongest closed models we tested. At the same time, we observe behaviors that warrant attention and continued improvement in future versions,” the report mentioned.

Also Read: DeepSeek-V4.1- Flash-1017 Tops Arena AI’s Code Arena WebDev Leaderboard, Beats Kimi K3 at Lower Cost