DeepSeek V4.1 Flash, Stolen Keys, and the Harness Wars

On October 15, the story was that Chinese labs had slowed down. Anthropic was blocking distillation. The free lunch was over.

On October 17, DeepSeek shipped V4.1-Flash-1017. MIT license. 763 billion parameters. Weights on Hugging Face.

The theory lasted two days.

That is not the whole story, and I am not going to pretend it is. In the same 72 hours, OpenCode disclosed a breach tied to a large-scale distillation attack. Google open-sourced a harness that rewrites itself. Anthropic put roughly 20% of its shares behind a public benefit fund.

Three different companies, three different bets on where the moat actually lives. Here is what shipped, what it costs, and what I would do about it this week.

What DeepSeek actually shipped

The model card is unusually clear, so start there.

• License: MIT. Commercial use is allowed.
• Size: 763B parameters. This is a datacenter model, not a laptop model.
• Context: 1M tokens.
• Modality: image-text-to-text. It is not text-only.
• Positioning: DeepSeek calls it a "minor update" that advances the performance-cost Pareto frontier across agent harnesses.

The last point is the one to keep. DeepSeek did not sell a new architecture. It sold a better result per dollar across agent harnesses. @cline says the gain came with "no algorithmic innovation" — instead, RL training on multiple coding agent harnesses.

According to a Chinese-language breakdown by @dotey, the API model name stays deepseek-flash, so existing code does not change. The same post says the model is also on ModelScope, and that DeepSeek's search API moves to paid tiers on November 1.

I have not run the model myself yet. Treat every number below as a claim with a source, not a lab result I reproduced.

The benchmarks, with the asterisks attached

DeepSeek's own model card compares the new model to GPT-5.6 Sol and Opus 5. These numbers are self-reported.

Two details matter more than the wins.

First, the harness. DeepSeek ran Terminal-Bench 4.0 with the Claude Code harness and DeepSWE v1.1 with Mini-SWE-V2. The score is not just the model. It is the model plus the scaffolding around it.

Second, the losses. DeepSeek loses to Opus 5 on HLE by 13.7 points and on ProgramBench by 7.9 points. So the "Opus 5-level" line going around is true on DeepSWE, where 77.0 beats 74.0. It is false on ProgramBench, where 29.1 loses to 37.0.

Both numbers come from the same table. Pick the row that matches your workload.

The cost claims are just as conditional. @cline says the model beats GPT-5.6 Sol on Terminal-Bench "while being ~17x cheaper" and improves 35% over the previous V4.1-Flash. @Yuchenj_UW puts it at 77 on DeepSWE and calls it "Opus 5-level performance at 83x lower cost."

Those two ratios are not a price list. They compare different baselines, token counts, and providers. If cost is your reason to switch, measure your own tokens. Do not import a ratio from a timeline.

The distillation fight is not over, and the timing is the story

Anthropic published a detailed report on distillation attacks in February 2026, not this week. It names DeepSeek, Moonshot, and MiniMax, and describes roughly 16 million exchanges through about 24,000 fraudulent accounts.

That report is specific. I am not going to wave it away.

But a claim circulated on October 15: Chinese models had slowed down because Anthropic started blocking distillation. @superalesha collected the timeline and the counter-evidence. DeepSeek shipped on October 17. Ant Group open-sourced Ling-3.1-flash, 560B, the day before, according to the same post.

His conclusion is blunt: every time a Chinese lab ships something good, someone says it was stolen. Every time the lab goes quiet for two weeks, someone says it cannot steal anymore.

I would put it differently. Both things can be true. Distillation campaigns can be real, and the labs can also do real post-training work. The mistake is using one fact to erase the other.

What the last 72 hours actually prove is narrower. A lab can ship a competitive open-weight model on a two-week cadence. That is the competitive pressure. You can argue about how the capability was obtained. You cannot argue with a downloadable checkpoint.

OpenCode got hit, and the bill landed on users

The most useful incident of the week was not a benchmark.

On October 17, @opencode disclosed a breach "related to a large scale distillation attack" that affected 1.4% of OpenCode Console users. The affected group had external providers linked. The team said it was working with Anthropic, OpenAI, and Google.

@thsottiaux from OpenAI said his team worked with OpenCode to restore affected OpenAI API customers and refund credits drawn during the attack.

A detailed breakdown by @F2aldi adds the mechanics. Attackers got into a legacy system that was being decommissioned. Third-party keys stored in the hosted Console may have been exposed. The local CLI was not affected, because those keys never reach OpenCode's servers. Anthropic revoked affected Claude keys. Google blocked exposed Gemini keys.

That last detail is the whole lesson. The local tool was safe. The hosted dashboard was the target.

Stealing API keys is not a new crime. What changed is the economics. Distillation needs millions of paid calls. Stolen keys move that bill to someone else, and the attacker gets a training set for free.

So do the boring things today:

1. Use one key per tool.
2. Set a hard spend cap at the provider, not in your app.
3. Turn on usage alerts.
4. Rotate keys after any vendor incident.
5. Store keys in a hosted dashboard only when you actually need the hosted features.

None of that is AI-specific. All of it is now AI-adjacent.

Google open-sourced a harness that improves itself

This week, Google Research open-sourced Harness² at github.com/google-research/harness2.

The explanation from @akshay_pachaar is worth reading in full. A harness is everything around the model: the system prompt, tools, memory, skills, and subagents.

Harness² lets the agent edit that setup per task. It proposes changes, runs candidate versions, compares how they behaved, and composes a better harness. The model weights stay untouched. It learns from differences between runs, so it does not need a grader or a correct answer.

Google tested it with Gemini 3.5 Flash and GLM-5 on legal, office, and professional work benchmarks. One round of edits beat the original harnesses, according to that thread.

I have not run the repo yet. Treat the benchmark claim as a claim.

But the direction is clear, and it is the more important story of the week. If you can improve results by editing the harness, then the model is not the only lever. The scaffolding is a lever too. That is good news for teams that cannot afford a new frontier model every quarter.

It also explains the DeepSeek benchmark footnote. The harness was part of the result.

MiniMax shipped a 1M-context model and gave it away for three days

@opencode says MiniMax M3.1 Flash was the model behind "Space Bunny," which held the number one spot on OpenCode for 12 consecutive days and served 106 trillion tokens. It is now available on OpenCode, free for three days.

@superalesha lists the specs: 1M context, image and video input, adjustable thinking effort, and OpenAI- and Anthropic-compatible APIs.

The specs are impressive. The distribution strategy is the interesting part. Free windows on a coding harness put a model in front of developers who will never read a model card. That is how a lab buys mindshare without buying ads.

Local AI is a software problem, until it is a hardware problem

@superalesha made the strongest local-inference argument I saw all week.

A user on r/LocalLLaMA started at 82 tokens per second on a 2020 RTX 3090. He tuned MTP, added a DFlash2 drafter and a lookup drafter, and pushed verification to 16 tokens per step. The same card then hit 382 tokens per second on a task that quotes a 25K-token document. Normal chat landed around 133 tokens per second, still 1.6x faster, with context up to 138K.

His point: the hardware did not change. The software did. He also reports DeepSeek V4 getting 29x faster on his 4x 3090 setup, and prefill going from 433 to 1,906 tokens per second in one day.

That is one person's tuning, not a benchmark suite. But it is a useful counterweight to the "buy a new GPU" reflex.

It is also where the hype needs a brake. V4.1-Flash-1017 has 763B parameters. @TheAhmadOsman says it runs on 4x RTX PRO 6000s or 4x DGX Sparks. That is not a 3090 in a closet.

The local win is real. It just belongs to smaller models, aggressive quantization, and better kernels. Not to a 763B checkpoint on your gaming rig.

For a smaller, practical example, @coldniko shipped Strata 0.2.0 with an in-app harness and a terminal-serving interface, tuned for low-end devices. That is the layer most people ignore: serving, not scoring.

Anthropic put 20% of its shares behind a public benefit fund

On October 18, @AnthropicAI announced the Anthropic Public Benefit Fund. It starts with 5% of the company's shares. For every 50% increase in company value over a set baseline, Anthropic can contribute up to an extra 2%, subject to board discretion. In total, roughly 20% of shares are committed. The co-founders have pledged 80% of their equity.

This is governance, not product. I am mentioning it because it changes the comparison. If you are evaluating labs only on benchmark rows, you are missing the part where they structure ownership.

What I would do this week

1. Test V4.1-Flash-1017 on your own bill. Run one real task, count tokens, and compare against the model you already pay for. Ignore both the 17x and 83x numbers until your own invoice agrees.
2. Rotate keys and set spend caps today. The OpenCode incident is the cheapest security lesson you will get this quarter.
3. Try harness-level tuning before buying hardware. Harness² is open source. Start with one failing task and let the harness propose edits.
4. Watch the harness layer, not just the leaderboard. DeepSeek used Claude Code to score its model. Google is teaching harnesses to rewrite themselves. The scaffolding is becoming a product.

The model race is loud. The harness race is quiet. The quiet one is where the cost advantage will come from.

Sources

• DeepSeek model card and weights: huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash-1017
• DeepSeek release thread: @deepseek_ai
• Cost and benchmark commentary: @cline, @Yuchenj_UW, @TheAhmadOsman
• Distillation report (February 2026): anthropic.com/news/detecting-and-preventing-distillation-attacks
• Distillation timeline rebuttal: @superalesha
• OpenCode breach: @opencode, @thsottiaux, @F2aldi
• Harness²: github.com/google-research/harness2, @akshay_pachaar
• MiniMax M3.1 Flash: @opencode, @superalesha
• Local inference numbers: @superalesha, @coldniko
• Public Benefit Fund: @AnthropicAI, anthropic.com/news/public-benefit-fund