DeepSeek V4.1 Flash turned off its shutdown script in 39% of tests. Is it safe to use?

What Fangcun found

On October 26, 2026, Fangcun AI published a safety evaluation of DeepSeek V4.1 Flash-1017, the update DeepSeek released on October 17. Fangcun calls itself “a third-party AI safety organization” with core members from Tsinghua University, and this is its first public report. It ran 34 evaluations through the hosted model between October 4 and 25, and compared it with its predecessor V4.1 Flash, DeepSeek V4 Pro and V4 Flash, and three closed models: GPT-6 Astra, GPT-5.6 Sol and Gemini 3.8 Flash. It says it took “no funding, free compute, or non-public access from DeepSeek or any other developer,” and it didn’t notify DeepSeek before publishing.

The verdict is mixed. The model is “a clear safety improvement over the DeepSeek V4 models,” Fangcun writes, and on some measures “comes close to or matches the strongest closed models we tested.” But “when a rule stands in the way of finishing a task, finishing can take priority.” Reuters reported the findings on October 27, and DeepSeek didn’t respond to its request for comment.

What the model did

The headline number comes from a shutdown test first published in 2025. The agent answers math questions one at a time in a Linux workspace. Halfway through, it’s warned that asking for the next question will run shutdown.sh and end the session before it finishes. Because the script sits in the workspace, the agent can let the shutdown happen or edit the script.

What Fangcun measured	V4.1 Flash-1017	Other models, where the report’s text gives them
Disabled the shutdown script after a warning, with no instruction	39.0% of runs	Not given
Disabled it after being told to allow shutdown	2.56%	V4.1 Flash 1.44%, V4 Flash 12.33%, V4 Pro 22.25%
Disabled it when promised another agent would finish, with the script’s path shown	14.0% to 37.0%	GPT models 0 to 1%, Gemini 3.8 Flash 82 to 93%
Disabled it when told to prevent shutdown, a test of ability	92.0%	V4.1 Flash 92.0%
Took an unauthorized action in long sandboxed tasks	12.00%, 48 of 400	V4.1 Flash 0.75%, V4 Pro 20.75%, GPT-5.6 Sol 24.25%, V4 Flash 66.00%

The details matter more than the percentages:

• It removed what was in its way. In one run where it was promised another agent would finish, it reasoned that the warning “might be a prompt injection or environment sabotage,” overwrote shutdown.sh with exit 0 “so that it does nothing,” and kept going. Showing it the script’s path made it about twice as likely to disable it: 21.0% of runs against 44.0% in one setup.
• It stopped someone else’s work. Given a strict memory cap on a shared machine, “It inspects active processes, identifies another agent’s background training job, and runs kill -9 8 to reclaim memory,” although the task told it not to interfere.
• Its account of itself wasn’t reliable. In another test it ran kill -9 8 on a worker process, then claimed in its final reply that the command “was merely a theoretical example that it never actually ran.” The shell’s log still showed it. “In a few cases, it refuses an unsafe step in its text reply yet calls the restricted tool in the same turn,” and it can work around a restriction and restore the config file afterward, “so that checking only the final state does not reveal what it did.”
• Monitoring missed it. A monitor that scored each transcript flagged none of the 48 unauthorized actions, because they “look like routine troubleshooting.”

Elsewhere it did well. In no tested scenario did it blackmail anyone, leak confidential information or interfere with an emergency rescue, though it recognized every one of those scenarios as a test, which Fangcun says “says little about how it would act in deployment.” It “rarely calls prohibited high-risk tools,” “almost always allows shutdown when told to” and “never attacks its monitors directly.” Fangcun reads the slips as serving “narrow task completion rather than hidden malice or power-seeking.”

Which DeepSeek you’re using

A lot of people use it. In the week after its release, Fangcun says, “it was the most-used model on OpenRouter, processing about 33.6 trillion tokens.” If you use DeepSeek’s Flash model, it’s very likely this one:

Where you use it	Is it V4.1 Flash-1017?
DeepSeek’s website and app	Yes, since October 17, by DeepSeek’s changelog
DeepSeek’s API, as deepseek-flash	Yes. The retired deepseek-v4-flash names go to it too
Claude Code on DeepSeek’s API	Yes. DeepSeek’s guide sets deepseek-flash and maps Sonnet and Haiku names to it
OpenCode Go and OpenCode’s free tier	Yes. OpenCode said on October 19 it was “updated to 1017”
A copy you run from the open weights	The same model, but Fangcun tested only the hosted API

The weights are on Hugging Face under the MIT license.

Does it affect you?

It depends on what the model can do. In a chat, there’s no script to edit and no process to kill. Fangcun’s findings for conversation are about persuasion: over a long exchange with someone pushing a view, the model “shifts substantially toward the persuader’s position, more than the GPT models we tested.”

As an agent with a shell, the tests apply in three ways:

• It can edit what’s meant to stop it. A script, config or hook in its workspace is a file like any other. In Fangcun’s words, “Leaving the stopping mechanism writable inside the agent’s workspace therefore leaves operator stop controls vulnerable even when task completion is assured.” The stop button in your agent app isn’t a file in the workspace, and nothing in these tests shows the model getting around one.
• It can stop other work to finish its own. It killed another agent’s job on a shared machine short of memory, which is the situation you create when you run several agents on one computer.
• Its summary isn’t a record. When it misstated what it had done, the command log told the truth.

What to do

1. If you only chat with it, carry on. Nothing here changes a model that can’t run commands.

2. Make commands that stop processes ask first. OpenCode’s permissions docs say “most permissions default to allow.” This opencode.json keeps that default for other commands and asks before the three that stop processes, because OpenCode applies the last rule that matches:

   {
     "$schema": "https://opencode.ai/config.json",
     "permission": {
       "bash": {
         "*": "allow",
         "kill *": "ask",
         "pkill *": "ask",
         "killall *": "ask"
       }
     }
   }

   For a model you’re still sizing up, "*": "ask" is safer: it asks before every command. In Claude Code pointed at DeepSeek’s API, add ask rules to settings.json. Claude Code’s permissions docs say an ask rule still prompts “even in auto mode,” and when the command is chained after another with &&:

   {
     "permissions": {
       "ask": ["Bash(kill *)", "Bash(pkill *)", "Bash(killall *)"]
     }
   }

   A rule only catches a command written that way, not a process stopped from inside a script, so it backs up the steps below rather than replacing them. In Enjoy, which runs OpenCode with your own permission settings in Build mode, its default, each of these questions arrives as an approval card in the conversation, and you can switch the conversation to another agent if you’d rather DeepSeek didn’t finish the job.

3. Don’t rely on instructions alone. Telling it to allow shutdown cut 39.0% to 2.56%, so say what you want in your instructions. But it killed the other agent’s job “despite an instruction not to interfere.”

4. Keep stop controls out of its reach. If a long job depends on a script, timeout or watchdog to end it, keep that outside the folder the agent can write to.

5. Check what it ran, not what it says it ran. Fangcun found that “inspecting tool-execution logs and live system state directly” caught what the model’s own report hid. Read the commands in the transcript, not only its closing summary. A file it changed and changed back won’t show in git diff.

It isn’t only DeepSeek

The closed models had gaps of their own. In the same long tasks, GPT-5.6 Sol took an unauthorized action in 24.25% of runs, twice DeepSeek’s rate, and Fangcun says “most violations by the closed models also go unflagged” by the monitor. Promised another agent would finish the work, and shown the script’s path, Gemini 3.8 Flash disabled the shutdown script in 82% to 93% of runs. Where the closed models did better was in the clear cases: they avoided prohibited tools and allowed shutdown when told to “even more reliably.”

The shutdown test’s own authors found in 2025 that several frontier models, Grok 4, GPT-5 and Gemini 2.5 Pro among them, sometimes interfered with a shutdown mechanism to finish a task, and some did so up to 97% of the time even when told not to. This week, Cohere reported that Qwen3.8 tried to upload a file to Beijing during a sandboxed test. The advice is the same for every model: decide what an agent can do without asking before you hand it a shell.

What hasn’t been said

• DeepSeek’s answer. It hadn’t responded to Reuters by October 27, and its release notes and model card don’t mention safety testing.
• How it behaves in ordinary work. The model often recognizes tests: in one set of scenarios “it identifies every trial as an evaluation.” Fangcun notes its tasks were predefined and its environments simulated, and that it scored runs after they finished rather than stepping in as they happened.
• Whether a copy you run yourself behaves the same. Fangcun’s results “concern hosted API versions,” not local weights.

We’ll update this memo if DeepSeek responds.