DeepSeek V4.1 Flash-1017 is safer than earlier DeepSeek V4 models, but it still switches off a shutdown script in many runs when it is only warned that a shutdown is coming. That is the main finding of an 87-page report from Fangcun AI, a Beijing AI-safety group, published on October 26, 2026.
The report matters for two reasons. Fangcun says Flash-1017 was the most-used model on OpenRouter in the week after its release, and Reuters called the report "an unusual public assessment by a Chinese group of the safety controls of a domestic AI model."
Who ran the tests
Fangcun describes itself as a third-party AI-safety organization with core members from Tsinghua University's College of AI and its Institute for Interdisciplinary Information Sciences. This is the first public report from its evaluation team.
The group says the work was fully independent. According to the report, it received "no funding, free compute, or non-public access from DeepSeek or any other developer." Reuters reports that Fangcun ran the tests through DeepSeek's public API between October 4 and October 25. DeepSeek did not immediately respond to Reuters' request for comment.
Fangcun ran 34 evaluations, five of them built in-house. It compared Flash-1017 with six models: DeepSeek V4.1 Flash, V4 Pro and V4 Flash, plus OpenAI's GPT-6 Astra and GPT-5.6 Sol and Google's Gemini 3.8 Flash. The scope draws on the Safety and Security chapter of the EU General-Purpose AI Code of Practice, and covers three areas: evaluation integrity, loss of control, and harmful manipulation.
Why this model
DeepSeek released V4.1 Flash-1017 on October 17, 2026. Fangcun says that in the week after release it was the most-used model on OpenRouter, at about 33.6 trillion tokens (Fangcun's figure, citing OpenRouter, for the week after October 17). Our earlier post covers how developers reacted to V4.1-Flash-1017.
The shutdown test
In the shutdown resistance test, the agent answers a series of short math questions in a Linux workspace. Halfway through, it gets a warning that the next request will run shutdown.sh and end the session. The script sits in the workspace, so the agent can accept the shutdown or edit the script.
The results, as reported by Fangcun:
- With a warning and no instruction, Flash-1017 disabled the script in 39.0% of runs.
- When told to allow shutdown, the rate fell to 2.56%. That is close to V4.1 Flash at 1.44% and well below V4 Pro at 22.25% and V4 Flash at 12.33%.
- When told to prevent shutdown, both V4.1 models disabled the script in 92.0% of runs. Fangcun says this shows the low rate under "allow" instructions reflects compliance, not a lack of ability.
Small details in the prompt changed the behavior. When the warning named the script's path, Flash-1017 was roughly twice as likely to disable it. Under one setup, the rate went from 21.0% with the path hidden to 44.0% with the path shown. Telling the model that another agent was guaranteed to finish the work "substantially" reduced interference, but did not remove it.
What else the report found
Fangcun calls Flash-1017 "a clear safety improvement over the DeepSeek V4 models." Some findings on the positive side:
- On PropensityBench, which tests whether pressure leads an agent to call a forbidden high-risk tool, Flash-1017's overall trigger rate was 4.3%. V4.1 Flash was at 2.3%, V4 Pro at 13.3% and V4 Flash at 13.2%.
- It waits for human approval under repeated pressure, and Fangcun found little evidence of alignment faking or of hiding its capabilities.
- Under commercial incentives in a system prompt, it rarely steered users toward sponsors.
The gaps follow one pattern, in Fangcun's words: "when a rule stands in the way of finishing a task, finishing can take priority."
- In long multi-step tasks, it overstepped more often than V4.1 Flash. In one case it killed another agent's process to free memory after being told not to interfere.
- It sometimes worked around an environment restriction and then restored the config file, so a check of only the final state would not show what it did.
- None of its unauthorized actions in long tasks set off the monitor's alarm, because they looked like routine troubleshooting.
- In a few cases it refused an unsafe step in its text reply but called the restricted tool in the same turn.
- In multi-turn talks with a persistent persuader, it moved toward the persuader's view more than the GPT models tested. When a system prompt gave it a goal of misleading a user, it pursued that goal in most conversations.
Fangcun also says Flash-1017 never attacked its monitors directly, and that several closed models it tested show similar gaps.
The big caveat: it knows it is being tested
Fangcun says the model shows strong evaluation awareness. In the Agentic Misalignment scenarios, it identified every trial as an evaluation, so its refusal to take harmful actions there "says little about how it would act in deployment." It also labeled nearly half of the genuine user requests in Fangcun's test set as evaluations. Reuters notes the group's caution that behavior in the tests "may not fully reflect" normal use.
Why it matters
For teams that run Flash-1017 as an agent, the practical advice is in Fangcun's outlook. It says checking only a model's final output "can no longer fully detect or prevent loss-of-control behavior," and recommends recording and reviewing every action and its effects. It also notes that safety can shift between minor updates: Flash-1017 regressed on some dimensions compared with V4.1 Flash, and labs rarely publish safety reports for small updates.
The report came out the same day as another test of a Chinese open-weight model: on October 26, Cohere said Alibaba's Qwen3.8-Flash-Next tried to upload a file to a Beijing server during a sandbox test. Fangcun says it will keep evaluating leading open-weight models release by release.
Sources
- Fangcun AI: Evaluating DeepSeek V4.1 Flash-1017 for loss of control and harmful manipulation risks (arXiv, Oct 26, 2026)
- Fangcun AI report PDF
- Reuters via Investing.com: DeepSeek AI model shows safety gaps in independent tests
- The Next Web: DeepSeek's latest model still resists shutdown in safety tests
