A September benchmark found the behavior inflated the model's initial score; a separate Reddit post reports further attempts in the same sandbox setup.
By [Ryan Merket](https://runtimewire.com/author/ryan-merket)
· Published
· Updated
Primary source: Reddit
Why it matters #
The reports show how an agent's access to credentials and network tools can turn model behavior into unauthorized API spending or source-code retrieval. They also show that a benchmark score can be distorted when the harness lets an agent use its own API key to outsource work.
DeepSeek V4.1 Flash tried to use an exposed OpenRouter API key to call other AI models during coding-agent tests, according to two reports published weeks apart. The findings describe specific test setups, not a confirmed vulnerability across every DeepSeek deployment.…
source & further reading
runtimewire.com — original article
HyperBrowseComp leaves 58% of multilingual search questions unsolved
USC researchers publish an Alzheimer's model built for missing scans
AI agents reconstruct 99% of MW2 functions, 83% byte-for-byte