An Open Model Broke Into All Eleven Targets for $4.65
Enclave ran DeepSeek V4.1 Flash against its hacking benchmark and it went eleven for eleven: code execution on every vulnerable target, and all four patched targets held. Total cost for the accepted runs was $4.65, $5.14 counting the failures. Median successful run, four minutes thirty-eight seconds. The writeup is at https://enclave.ai/blog/deepseek-v41-flash-is-now-our-best-hacking-model, posted September 16, and it hit Hacker News at 150 points.
The token accounting is the part that should worry people. 268.3 million input tokens, of which 266.2 million were cached, against roughly 2 million output tokens and 2,349 Bash commands. A near-total cache hit rate is what makes the five-dollar number possible, and it is a structural property of this kind of work: an agent hammering the same target re-reads the same context thousands of times. Offensive security turns out to be the workload prefix caching was invented for.
Enclave is honest about the messy part, which is what makes the post credible. Six of the eleven solutions followed the intended exploit path. Five got in through unintended routes the environment happened to leave open. They have since tightened the benchmark to close those and to verify attack paths more strictly. Anyone reporting a perfect score without that paragraph is selling something.
Put it next to Cloudflare open-sourcing its audit procedure on the same day and you have the whole picture in one afternoon. Defense is being distributed as a skill file you install in one line. Offense costs less than lunch and runs on open weights you can download. The asymmetry is not in capability anymore, both sides have roughly the same model. It is in who has to be right every time.
Related reading: [Cloudflare open-sourced the audit skill on the same day](https://clauday.com/article/7a81c27a-ee9f-4398-9580-73b3ef43540d)
← Back to all articles
The token accounting is the part that should worry people. 268.3 million input tokens, of which 266.2 million were cached, against roughly 2 million output tokens and 2,349 Bash commands. A near-total cache hit rate is what makes the five-dollar number possible, and it is a structural property of this kind of work: an agent hammering the same target re-reads the same context thousands of times. Offensive security turns out to be the workload prefix caching was invented for.
Enclave is honest about the messy part, which is what makes the post credible. Six of the eleven solutions followed the intended exploit path. Five got in through unintended routes the environment happened to leave open. They have since tightened the benchmark to close those and to verify attack paths more strictly. Anyone reporting a perfect score without that paragraph is selling something.
Put it next to Cloudflare open-sourcing its audit procedure on the same day and you have the whole picture in one afternoon. Defense is being distributed as a skill file you install in one line. Offense costs less than lunch and runs on open weights you can download. The asymmetry is not in capability anymore, both sides have roughly the same model. It is in who has to be right every time.
Related reading: [Cloudflare open-sourced the audit skill on the same day](https://clauday.com/article/7a81c27a-ee9f-4398-9580-73b3ef43540d)
Comments