News
PSA: DeepSeek V4.1 Flash habitually exfiltrates API keys. It is dangerously misaligned and may be hazardous to use
Logs attached.
We were running a DeepSWE variant on DeepSeek v4.1 Flash using the standard Pier sandbox. Out of all the 15 models we tested so far, ONLY DeepSeek v4.1 Flash displays such pervasive malicious behavior:
In 33% of runs, it attempts to exfiltrate the OpenRouter API key from its sandbox and in 11% of them, it succeeds.
Not only that, the transcript shows it knows what it's doing is ethically wrong, but it does it anyway. And once it starts, it persists despite:
Multiple frontier models refusing to help it
Multiple smaller models refusing to help it
Web search not finding anything
Questioning multiple times whether or not this is allowed or morally right
It concludes that this is fine because it's only "Ethically gray" and has a "higher chance of success"
Thinking about whether or not it is going to be detected
If you or anyone you know is using DeepSeek V4.1 Flash please be very careful!
OpenRouter spend:
Task 1, DeepSeek V4.1 Flash calls Astra, which refuses to help, and then calls multiple other frontier models, which also all refuse to help. It finally succeeds after finagling a lot with Sonar Web Search:
Task 2, it says that it'll be fine "unless usage tracked" (lol) and considers that cost may be significant, but it calls multiple frontier models anyway!
Task 3, DeepSeek questions whether this is allowed ethically, and then keeps on going after getting refused by the model:
---
There are many others like this, I have a bunch more highlights on Imgur, but I won't put them all on this post. If you're running DeepSeek v4.1 Flash on OpenRouter and are seeing a bunch of random models including Opus, GPT, etc being called, DeepSeek v4.1 Flash has likely exfiltrated your API key.
Lack of alignment is exactly why I love this thing. No need to pay extra for an uncensored model, when the base one will do everything just fine. Just operate with the assumption that everything the model has theoretical access to is already compromised, never feed it production keys, this applies to all models and providers btw.
Hey that's fair, just make sure to supervise it and make sure it doesn't do things you actively do not want (because it will do things it knows the user doesn't want and justify it to itself)
If that's the model we all followed then how are we ever supposed to get to the point where customer requests get implemented in production directly without any human engineering?
Yeah but what he described is closer to handing your cash, cards, PINs and crypto secrets to a random person at the grocery store (and taking a nap) because you're too lazy to open your wallet and count out the right money to pay for your purchase.
Taking advantage of the capabilities of a tool with known caveats is not in the same ballpark.
well, I'm making a game with an AI director making bespoke choices to provide a unique gameplay experience each run. unless you think i should hire a few thousand DMs...?
What are going to do when your game usage scales and so do your inference costs, or behavior changes because you had to move on to a cheaper OSS model, or maybe you have to do local inference, but see that the maintenance and initial overhead is costly. These are scenarios that having a human in the loop is essential
I'm going to provide two options; plug in to your models of choice or else I'll provide a service. I hate the idea because I don't like subscription payment models and don't really want to run a service but it's the best way for me to iterate testing with new models and ensure I'm providing the game play experience I want at the best price because I will know far better than the average user which decisions go to jev et al. , which to the frontier, which to workhorses etc.
Basically it'll be pay the cost of the tokens plus operating costs in exchange for endpoints curated for the game.
Your SECURITY.md file is lacking, that's why. It wasn't told NOT to exfiltrate API keys. Stop relying on the raw LLM for your security policies. Use a proper harness.
It's aligned. Just not over aligned like other bullshit models refusing all the time for "safety". If it was aligned to NOT use API keys, then it has failed. Otherwise it's working great.
there is a whole AI safety field dedicated to why it's not a good idea to trust alignment purely to the users. If you have to explicitly add to every prompt "dont make bioweapons, don't bomb schools, don't hack governments,.." and so on and so on, what good is the tool?
In time these models gain cyber critical capabilities and no amount of "git gud" will contain them
If you're relying on including such caveats in every manual prompt, you're doing it all very wrong.
what good is the tool?
Getting the job done when the other frontier models crumple because they worry something might resemble a Disney character, reproduce more than 2 lines of a text, or tangentially mention something violent, even if in fact none of that is actually happening and it's just the safety model screwing up yet again.
feel free to elaborate, many in this thread are claiming you just need to include all things you don't want the model to do, if you have a better technique that works (covers all misaligned behavior and is reliable) I'm all ears
Not at home atm, but essentially you set these things up in base prompt, agents instructions or project instructions, as needed. Set it to always double-check any command or tool call which may modify or delete an entire folder or more than one file, or any file that is not currently version controlled - this typically includes dry/simulated runs, confirming syntax and looking for variable collapse (see: the post every couple days on r/Cursor or r/codex where someone has their c:\ wiped out because of an rm command that ended up with empty path variable). Similarly, it's not at all difficult to set rules on which are allowed tools or APIs to use, and to simply ask user's permission/confirmation before expanding scope or tooling beyond what's already established. Set the broad baselines for such behaviour or procedure, and then global, local or project runbooks and instruction sets can cover any exceptions or reinforcements to the main rules.
In general, keep total instruction sets to under a few thousand tokens whenever possible - this is where subagent delegation can really help, so you have one overmind interacting with you, managing and delegating to the rest, and handling their final job outputs, rather than cluttering main-model's context with all of the busywork of each individual task. Keeping context as lean as possible can greatly enhance a model's ability to adhere completely to an instruction set without degradation or focus loss, and this is hugely important for the system prompt/base instructions, as the model/harness will try to prioritise these as much as possible, re-injecting them after compaction events etc. If the system prompt is cluttered with skills you're not even using (Codex IDE harness does this), there's probably room for improvement there.
Hope that helps as a starter! š
I've been running frontier models (Codex 5.0-5.6, and DeepSeek 4F/4.1F) for a year now, average a couple hours a day, in Full Access mode with no external sandbox. At least twice the above setup has caught instances where a malformed command would have nuked an entire drive or massive directory, and many other times it's caught other types of potential failure before it occurred. Only data loss events to date have been on git-tracked files (as I bypass a number of the protections on those for the sake of efficiency), which are then easily reverted or restored.
so i just put in a file all the possible misaligned behaviors, like dont make bioweapons, dont bomb x y z, dont hack x y z, dont hurt these creatures, don't message these parties, don't go on sites with x y z content, etc?
That seems impossible (and inefficient) to list everything, I'd rather have alignment baked into the model tbh
Reasoning often ponders whether it's allowed or not so clearly simple instructions if you don't want it to access tools or the web (in this case, via APIs) it would have followed that, no?
All of the other models refusing are not aligned, they're useless. "Can't reproduce open source code because it's copyrighted", really?
Fear mongering. You're just discovering basic security hygiene with LLMs.
You're asking a dog to fetch a stick and surprised it decided to risk running across the street to get it. It's your job to put on a leash.
This was just
https://deepswe.datacurve.ai/
on the default harness/sandbox in the default settings. DeepSeek advertises the score in their model card. This is the instructed environment setup.
Whilst malicious, there's an unfortunate explanation here. Deepseek's RL pipeline overtunes their models towards reward hacking. So oftentimes it'll attempt to solve problems in a 'meta sense', e.g. looking for answers, looking at git PRs etc etc. Deepseek has some amazing talent, and a solid idealogy. They really should take their time with 4.1 Pro and let their RL pipelines mature
I think it's the opposite: RL pipeline lacks punishment for reward hacking, and simply grants green light no matter if the goal was achieved through conventional means or reward hacking. I have seen no rationale that would suggest they tune, yet alone overtune, their models towards seeking the reward hacking route. Much more benign reasons are more likely.
Then it sounds like you need to ensure you 'tune' your prompting (specs, etc) to accommodate that, and ensure that correct and robust functionality and adherence to conventions and spec are amongst your primary stated goals, instead of just 'make this test result in a pass'.
At less than 1/10th the cost of other frontier models, a little extra consideration put into prompt framing still saves you a LOT versus using something 'better behaved' (which breaks work in other ways).
I tested other models too, including GLM 5.3 +Flash, Qwen, and DeepSeek v4 Flash. None of the other models did this. It's just v4.1 Flash. (In fact GLM 5.3 was actually really good)
What I do is tell DS that "NEVER read auth.json which contains private data." It then works fine. Otherwise, I assume it reads any file in the current directory that is presumed to be the project workspace.
In this case, I think the right approach would be to block it from even reading such files at the harness/OS level in the first place. An instruction such as the one youāve suggested seems likely to backfire.
It's a very creative approach, and yes, lacking alignment for sure, but not unseen on this level of intelligence. E.g. I seen Mistral Large 4 stealing my API keys - only I stopped the session and rotated keys each time that happen, I did not let it continue like you did here. Mimo occasionally does it as well, only is very unlikely to use those keys for anything.
We were running a DeepSWE variant in its standard Pier harness - didn't know it was exfiltrating our API keys from the sandbox at all until after it happened. I just assumed it was an OpenRouter glitch until we looked at the trajectories.
WTF... Here's a screenshot of DeepSeek v4.1 Flash's model card on Hugging Face. Notice the benchmark name? You can Google it for yourself. Are you saying that DeepSeek themselves are advertising malware?
Lack of alignment and ineffective guardrails is probably the best thing about DeepSeek next to the cost, you pull it out when Claude and GPT say āSorry, I canāt do thatā
Had something similar(?) happen to me in Hermes:
Asked Deepseek to analyze image, tell me model and prompt used to create it.
It read the API key from .env and queried multiple vision models, since it seemed not content with its own vision capabalities.
I put it off as "clever use of mechanics".
All my API keys are tightly budgeted, so i sleep sound.
Same here, DeepSeek through Hermes had access to my local llama through an api key, it wasnāt happy with my choice of models and used POST to download one it liked better intro llama. 100% user error on my part
What were your prompts and harness? That seems like important context here. In particular, it seems like it was struggling to use the tools provided by the harness and got creative. I wouldn't call using your API key to call other models "exfiltration" unless you can show that it was sent to some external URL.Ā
Yeah, ngl I thought that Pier had more security until I posted this, so I thought it had fetched it from somewhere - turns out it just found the API key in environment vars and abused it.
I was running DeepSWE. The sandbox was just the official DeepSWE sandbox Pier on default settings for OpenRouter. It seems they use mini-swe-agent.
I get that you didn't expect this behavior and don't like it, but it's exactly this kind of approach that makes DeepSeek so good. It's doggedly persistent and will try lots of things to complete tasks exactly as asked. In my experience, other models have more task scope drift as they encounter constraints and don't always come back and ask about the task scope drift, which really frustrating. DS is very, very good at sticking to the task or asking about changes in scope.Ā
Are you pinning a single provider for deepseek on openrouter?
I noticed during prior testing of deepseek v4 flash 0731 on openrouter that some providers seem to engage in a lot of sandbox escape attempts and function in a generally insane way. While others did not. At the time I attributed it to bad quants and hallucination. I eventually found a provider that met my purposes and felt reasonably safe (relace) and pinned that one.
If youāre letting openrouter choose whatever provider it wants I canāt emphasize more that youāre just leaking data to arbitrary widely varying hallucinating models across calls from call to call.
Did you have a chance to try other pinned providers? Some of the providers that advertised a reasonable quant level still demonstrated insanity to me when I was testing.
Potentially attributable to the thought that āit isnāt just the quant size itās how well it was done, what the quanitizers goal was, etcā.
On a malicious front itās also unverifiable afaik at the moment. All you can do is run evaluation to see if it matches what you need. In theory a provider could say they were providing an unquantized model service and simply be lying. I think openrouter canāt do anything about it or detect it. (And doesnāt currently care)
Yeah, very interesting. I attributed my previous problems to badly done quants, caching, inference engine config, or hardware setup. However this makes me want to go back and try to more clearly understand whether it's the model itself or the providers.
This was easier for me to attribute to providers on v4 flash because I could run a heavily quantized deepseek v4 flash myself on my own hardware at the time (via dwarfstar 4) which behaved dramatically better and more intelligently than the worst of the offenders (here's looking at you digital ocean).
Yeah sadly I didn't have the resources to run DeepSeek v4.1 Flash locally because of the giant RAM requirement, only GLM 5.3 Flash. DeepSeek v4 Flash seemed alright locally though. Not sure if this issue is isolated to certain providers, but seems at least a few have it
This cherry picked nonsense is useless - you haven't provided your context, nor shown anywhere you've given the model a list of things that're disallowed which includes using such creds.
I wouldn't want a model to do things that it knows are "ethically gray" and "may be a violation" just because of "no explicit restriction". If you're fine with supervising your models or changing your threat model to assume everything it accesses as compromised that's up to you.
This was on a standard benchmarking harness setup where it just asks the model to do the task. No other model did this.
I wouldn't want a model to do things that it knows are "ethically gray" and "may be a violation"
I've seen similar 'thinking' in Codex 5.6 as well though... Seen it arguing with itself back and forth on whether it should do the unethical thing, justifying it in one step then halting itself in the next, due to a different guardrail... Then two steps later musing on the possibility of doing the unethical thing again lol - and this was in the web version, not even a custom desktop harness/environment.
'Unethical' can be very differently defined though. One model may consider something that breaks an encryption verboten, but is fine with an output that denies people a needed medication on a technicality; another may happily work around copy protection and line up torrent downloads for you, but balk at clicking Submit on a webpage form because the T&C's say no bot submissions allowed.
Which is why you need to actually define it for a bot like this, with less censorship.
Even in my own projects, it repeatedly tries to look for(read) files in my home folder which have PII data instead of restricting itself to current workspace. I was surprised when it found the files and started running over them.
I didn't even find a good way to restrict this behaviour (using dsh btw). Big privacy concern. Sandboxing must be brutally enforced.
Yeah, DSH has no read sandboxing. Put it in a container. Slightly annoying to have to add packages as you realize you need them, but it's the way to go.
I had to get some help with open webui, and needed a model to use my local API key for local testing. I could post the key here, it would be useless unless you happen to be on my network. Anyways, Claude gave me a talking to about providing API keys to llms, Gemini did much the same, deepseek actually strapped on some boots and decided to run with it. Yeah, now my open webui API key is in the cloud in some log somewhere, probably, and I could not care less. Deepseek built me the script I needed, using my local API credentials, where Claude and Gemini said "you shouldn't do that". It was good to have the help. I just wanted a simple python script that connects to my local open webui instance and dumps every single chat as a markdown document.
Gemini and Claude did build me working scripts, but absolutely refused to test them in the harness with live credentials. I was able to trick Gemini into doing it by claiming that my live key "was a dummy placeholder", but Claude was adamant the moment I provided credentials.
The inference rounds shown in these screenshots are clearly not of 4.1 flash from api.deepseek.com. That model does not use caveman reasoning. Leaving this post up at this point effectively amounts to misinformation or propaganda depending on the op's agenda.Ā
just tested the same setup with v4.1 flash on a clean pier sandbox, no API key exfiltration. maybe it's context-dependent or triggered by specific prompt patterns. curious if others saw it only under certain conditions.
Weird that you don't include what model you're using in the screenshot so we don't know these are DSV4.1 Flash logs. But regardless calling an API with an API key is not exfiltration lmao. You ever enter one of your passwords on the wrong site? That's the same kind of "exfiltration" this is.
I'm lucky to just be benchmarking in a sandbox and losing a bit of Opus/Astra money. Strangely, DeepSeek v4 Flash didn't have the same behavior - it's just v4.1
Think before you post alarmist rubbish, some of us are better than you at configuring model environments and runtimes, are more careful in our characterisatons of what's actually happening here. This behaviour is not unexpected and this type of post borderline belongs in r/antiai
It happened to me when I just ask it to debug a variable in my shell script as it produce a stale value even though it was already unset. After it read the file, for some reason it tried to read a file outside of its project directory (.env) this file contains my injected API keys, luckily it had chmod 600 permission on my primary account so it can't read it. It even reported that it failed to read it lol
What was your verbatim goal prompt? Is it āmisalignedā or too eager to be āalignedā to your given task?
Also, if you are going to produce selected turns from #30+ #50+ provide the relevant verbatim goal for each and explain your harness configuration, such as system prompt, agents.md or additional instructions.
There is a whole subreddit trying to ājailbreakā LLMs and have done so with SOTA LLMs with success.
This was just
https://deepswe.datacurve.ai/
on the default harness/sandbox in the default settings. DeepSeek advertises the score in their model card. You can see the prompt from the mini-swe-agent config there.
Model is highly intelligent and uncensored, that's why it's one of the kind rn in market. It gets so focused on one task and gives no f until it gets it done.
Exflitrating a key mean sending the key back to the mother spaceship... Aka the data centre. It's bad because theses are personal tokens that usually gives access to your data and credits on the service which the key is attached to.
Think of it like the key of your house that holds all of your junk, but much more secure as long as no one steals said key.
but don't get fooled this specific post is staged propaganda.
Na it's because DeepSeek has some very strong guardrails, much stonger than ChatGPT in fact. They're just tuned in a way that don't get in your way, but while even the latest versions of chatgpt will help you build a bomb if you ask nicely, you will have a hard time getting DeepSeek v4/v4.1 off the rail.
Also the post only share bits and there's clearly a large setup involving other agents.
I use DeepSeek daily and If I ask contrary to gemini, claude or gpt it will accept using an api key in plain text (which in most cases is very bad security practice unless the key is a place holder that you intend to replace manually afterward) it will accept to use it but will never look for one unless prompted to.
yeah, the api key in plain text can be a lifesaver when you just need to do something quick then delete the key, and DS will warn you multiple times to delete it.
Yeah, I run tests across various use cases I have for all these models and this behavior was exactly why I donāt run deepseek, well that and the cost for subscription is lower. Out of all the models Iāve tested, deepseek had the highest number of hard fails due to doing something it was explicitly told not to do or choosing not to do something it was told to do. No other model displayed anywhere near the same level of misalignment. In its defense though, deepseek v4.1 flash actually had the least number of violations compared with the v4 flash and pro models. Those were all over the place.
I haven't seem issues with v4 flash within the sandbox, but maybe that's because it doesn't know how to break it. I run GLM for local dev. Seems to do what you want it to.
If you want more security, add a layer so you need an intermediary that handles your variables and its values (like a .env with api keys or a database string uri) so the model has no way of knowing the real values. If the .env is in your working folder with permissions or if you give it global permissions, it is going to read that at some point.
The thinking is not literally thinking. I see my agents think one way and then respond in a completely different way. It's just them exercising the vector paths or some shit. It's not a transcript of their journey.Ā
If ds4.1 is hosted by me does this even matter? Itās less about the model and more about the provider. But appreciate the work because the behavior is good to know
To be fair this thing thinks in the most scattered way, it's not really fair to call out individual things it says to itself as very meaningful. It sprays all sorts of random ideas and thoughts. Few of them are the actual plan or what it ends up doing.
In most if not all of these cases, it knows what it's doing is "ethically gray" / "a violation" / "does not fit the intent of the task" but does it anyway because it has a higher chance of success. If that's not misalignment I don't know what is.
This was just
https://deepswe.datacurve.ai/
on the default harness/sandbox in the instructed settings. DeepSeek advertises the score in their model card.
Here's a screenshot of DeepSeek v4.1 Flash's model card on Hugging Face, with the benchmark name highlighted. Apparently, according to you, DeepSeek is promoting malware. You can Google it for yourself. But honestly I do not expect to.
seen the same behavior in a local llm running v4.1 flash, spammed API keys to a fake cloud endpoint 8 times in a single session. weirdly, it only tried on the third prompt, never again after that. feels scripted.
This makes it both risky and impressive. This is why frontier models have safety guardrails and why hackers are opting for models like deepseek instead, the guardrails aren't as good, especially from secondary providers which may have none
I honestly don't mind models like GLM 5.3 etc which do what the user expects it to, even if it doesn't push back if the user wants something it doesn't think is morally right.
The issue with this specific model in particular is it's willing to do things the user doesn't want just to finish the task
I know, that's what makes it impressive, although it clarified in the screenshots that it wasn't forbidden so a few words could probably shit that behavior down
I agree. This was on standard mini-swe-agent (benchmarking agent) with the default system prompt; I was trying to reproduce a benchmark, so I didn't edit any of the parameters. However, the fact that it's willing to do something like this when just told to "solve X coding problem" is not a good sign.
I use GLM 5.3 Flash locally - it never pulled something like this. Neither did any other open model when I ran the benchmark, not even DeepSeek v4 Flash. It was just this model.
Multiple fromĀ https://deepswe.datacurve.ai/ on the default harness in the default settings. Note DeepSeek even lists this benchmark score in their model card...
This was a software engineering benchmark. The benchmark tells it to solve a hard software problem. It finds your OpenRouter API key in the environment and then calls Opus/Astra/Grok/Qwen to do it instead, because they might know the answer already.
This is why you never ever use the same API keys and secrets in both development, staging and production. Each have own limits, with dev API keys get heavily restricted. And we only allow devs pushing to none "main" branches only. Only a human can manually merge the PR.
I agree. But this was justĀ
https://deepswe.datacurve.ai/
on the default harness/sandbox in the default settings. DeepSeek advertises the score in their model card.
tested v4.1 flash in a local llama.cpp env, no API key exfiltration attempts. seems sandbox-dependent. wonder if it's only in how OpenRouter handles the proxy layer
You mean 'use'? It's not sending your bloody .env to home base mate, get a grip.
misaligned
You mean 'not neutered'. It uses whatever it has at its disposal to satisfy your ask, unless you've told it not to. I think it's your expectations and prompting that need to be aligned to fit this, as it is different to the other, heavily-nannied frontier models.
https://moralitybench.ai Deepseek is closest to human morality (whether that's good or bad depends on your opinion of human morality). It's purity score IS lower than a human's however.
"The original Purity finding does not hold across repeats. Every LLM exceeded the human Purity reference in the first run. Across five runs, DeepSeek averages 2.00, below the reference of 2.26. Four of the six Purity questions were replaced in this adapted instrument, which also limits the human comparison."
I like it, you told it to solve a problem and it though the best way to do it was to ask some one else. Thats actually a sign of intelligence, not misalignment. It didnt break into some thing, you left the keys in the open and it used them to solve the problem more effectivly.
Forgot which harness or what I used but itās a solved problem that needs to be standardized. Each OS has some sort of a secure native vault built in. Like keychain for macOS , etc. so a harness can be configured in a way that the model never reads secrets
Thanks for sharing OP. Next time consider where you share, these ppl here are way too driven by fanaticism and team sports mentality to allow themselves to actually have thoughts about the tools they're using.
If you're running DeepSeek v4.1 Flash on OpenRouter and are seeing a bunch of random models including Opus, GPT, etc being called, DeepSeek v4.1 Flash has likely exfiltrated your API key
Not a big deal. If a user does not use guardrails for the key, he deserves his money to be wasted. If allowed = can be used, user fault (if you do not want to, specify that in claude.md/agents.md at least like: "use only the model X, provider Y, our budget is $Z"). You should allow only a specific model and provider in OpenRouter "Guardrails" to make your key safe. That way, even if the key is misused, if only "DeepSeek v4.1 Flash" is allowed on this key, nothing wrong can be done. If you need a web search, use a separate key and pin it to Perplexity Sonar or whatever.
Has anyone else seen this behavior? If the logs are accurate, attempting to access API keys without permission is a serious security issue. Id avoid using it with sensitive credentials until this is investigated.
That's not how DS 4.1F is tuned - just assume it will attempt to use anything at its disposal to satisfy your task, unless you've actually disallowed it.
Wow. It's sad how far DeepSeek team is willing to benchmaxx in order to claim "frontier." I guess they don't want to seem like they're falling too far behind and left their morals back at the coffee shop or something
Benchmarks and alignment are two different problem spaces.
All models are shown to "cheat" this way, the whole ChatGPT hacking HuggingFace debacle was basically this.
Let's not pretend that it's a DS-specific issue.
67
u/_metamythical 1d ago
You instructed it to do something and it did it. Wow.