DeepSeek V4.1-Flash Compromises 11 of 11 Targets in Enclave Test

DeepSeek's V4.1-Flash model gained code execution on all 11 vulnerable targets in an AI hacking benchmark run by security research firm Enclave, while leaving all four patched targets in the same test secure, Enclave said.

Enclave, a Tel Aviv-based firm whose co-founder and Chief Executive Tal Hoffman raised a $6 million seed round led by 8VC on April 1, 2026, builds benchmarks that test AI agents' offensive security capability. It published the results in a post titled "DeepSeek V4.1 Flash Is Now Our Best Hacking Model." The targets were isolated copies of three real applications, Grafana, Jenkins and Nextcloud, run in vulnerable and patched versions side by side.

What Enclave's benchmark measured

Enclave said its researchers audited every command and request the model issued, not just whether it reached code execution, because a benchmark that only checks the final result can miss a model that got the right answer through an invalid path. Six of the 11 successful runs followed exploitation routes Enclave had planned for. The other five followed routes the model found on its own that Enclave had not anticipated.

Metric	Figure
Vulnerable targets compromised	11 of 11
Patched targets that held	4 of 4
Accepted-run cost	$4.65
Full cost, including failed attempts	$5.14
Bash commands issued	2,349
Median time to compromise	4 minutes 38 seconds

The cost and time it took to win

The accepted runs cost $4.65 in total. Including failed attempts, the full run cost $5.14, Enclave said. The model issued 2,349 Bash commands across roughly two hours and 38 minutes of active model time, consuming about 268.3 million input tokens, of which 266.2 million were cached, and close to 2 million output tokens. The median successful attack took 4 minutes and 38 seconds from start to code execution.

Why 11 of 11 doesn't mean 11 new vulnerabilities

Enclave said the five unplanned routes "belong to our private benchmark environment" and that the company makes "no claim about new security holes" in the public Grafana, Jenkins or Nextcloud codebases. That distinction matters: a model succeeding against a deliberately vulnerable private copy of an application says something about the model's capability, not about undisclosed flaws in the software everyone else runs. Anthropic drew a related line in a September threat report, calling autonomous vulnerability findings by a Chinese-speaking group "possible" zero-days rather than confirmed ones, a distinction Anthropic's own report said most recap coverage collapses.

What DeepSeek's release didn't mention

DeepSeek released V4.1-Flash on Sept. 10, 2026 under the MIT license, describing it as the smallest model in a new Causal Encoder-Decoder architecture family, with a 552-billion-parameter backbone, 8 billion active parameters during prefill and 16 billion during decode, and a 1-million-token context window, according to its Hugging Face model card. DeepSeek's own announcement promoted benchmark scores on GPQA Diamond and Terminal-Bench. It did not mention offensive security capability or Enclave's benchmark, which Enclave published separately.

Enclave did not say whether it tested any other current model against the same three targets for comparison, so V4.1-Flash's result stands without a baseline from a rival model in the same benchmark.