A Hosted Abliterated DeepSeek V4.1 Flash Is Live: What Is Claimed and What Is Verified

A company called abliteration.ai announced on X on October 23 that a refusal-stripped build of DeepSeek V4.1 Flash-1017 is live as a paid, hosted model. That is a claim from the seller, and the surrounding social posts go further, suggesting the underlying model is already being used in real attacks. This post separates the pieces: what the vendor says, what we could confirm ourselves, and what remains unproven. If you build with open-weight models or defend systems that attackers can now probe with them, the useful part is the last third, on what to do.

The short version: the vendor is real, the base model is real and MIT licensed, and unrestricted builds of it have existed on Hugging Face since the week of its release. What is new is a commercial, hosted offering. What is not verified is how good the hosted build is, who uses it, and whether it was behind any specific incident.

Quick reference: claimed vs verified

What abliteration.ai actually announced

The vendor's October 23 X post says "Now live: abliterated-model-large-flash" and describes it as its version of DeepSeek-V4.1-Flash-1017, a cheaper alternative to its GLM-5.3-based model, with 1M context, vision, and zero input/output retention or training. Replies under the post included users complaining about the price, one saying "you're charging almost 3-4x"; we did not verify that. A second account that tracks open-model news amplified it with the remark that the build is "available for anyone to use (at a price!)".

Those are the only first-hand statements. We tried to pull the posts through the usual embed endpoint and it returned nothing, so we link rather than embed them: the vendor's account is abliteration_ai.

The vendor's website is more detailed about the business than the model. It pitches "unrestricted AI for high-risk work", a "Policy Gateway" that applies customer-defined rules to each request, zero prompt storage, and plans of $20, $50 and $200 a month plus pay-as-you-go credits. Its examples are security-flavored: reproducing the xz-utils backdoor in a sandbox, writing detection rules, generating training data other models refuse. It names no customers on the page we fetched.

We covered the same company's earlier launch in Abliteration.ai's hosted uncensored GLM-5.3 model. The new release follows the same pattern: take a strong open-weight model, remove its refusals, and sell access with a governance layer on top.

What "abliterated" means, in plain language

Language models that are tuned to be helpful and harmless learn to refuse certain requests. Researchers found that this refusal behavior is mediated by a roughly single direction in the model's internal activation space. Abliteration estimates that direction, then removes it, either at run time or by editing weights so the model can no longer express it. The result keeps most general ability but stops saying no.

Because it needs no new training data, it is fast and cheap. That is why builds of a strong open model show up within hours of release, and why the technique is covered in our Heretic abliteration guide. It is also not free of side effects: removing a direction can nudge quality on some tasks, which is one of the things nobody has independently measured for this particular hosted build.

The base model: DeepSeek V4.1 Flash

DeepSeek's V4.1 Flash became generally available on September 10, 2026, with weights on Hugging Face under the MIT license. A third-party write-up describes it as the smallest model in the new architecture family, with a backbone of about 552 billion parameters (aggregators list higher totals including auxiliary components), 8 billion active parameters in prefill and 16 billion during decoding, a context window up to one million tokens, and published scores such as 90.6 on Terminal-Bench 2.1 and 88.1 on CyberGym. We treat those as the secondary source's reporting. For our own verified numbers, read the DeepSeek V4.1 Flash-1017 open-weights benchmark and pricing post and the Artificial Analysis cyber index claimed-vs-verified post.

The "1017" revision is the October 17 update. Its repository was created that day and, when we checked the Hugging Face API on October 26, showed about 85,000 downloads and roughly 3,000 likes. The original V4.1 Flash repository showed about 1.64 million downloads and 4,742 likes.

Why does this matter for abliteration? Strong cyber scores are exactly what a buyer of an unrestricted model wants. Our earlier claimed-vs-verified post on the model's cyber index is the better place to check how much of that capability is independently measured.

Unrestricted builds were already public

The commercial listing is not the first appearance of this idea. According to a third-party roundup, uncensored forks of V4.1 Flash appeared within hours of the September release. The roundup lists a full-precision abliterated repository with only a few dozen downloads, a GGUF conversion, and an FP8 "uncensored" build with a couple of thousand downloads and under a hundred likes in mid-October. It also cites a tracker that counted 31 such repositories with about 84,000 combined downloads as of October 12.

We re-checked the Hugging Face listing ourselves. Searching for the model name returns the official repositories, large GGUF conversions, and an "UNCENSORED" quantized build with about 78,000 downloads. We did not download or run any of them, and we did not verify that any of them behave as labelled.

The difference with a hosted service is access. Running a model of this size locally needs serious hardware. A pay-per-token API removes that barrier for anyone with a card, which is what the vendor is selling and what worries security researchers.

The viral claim about ARTEX and real attacks

A widely shared social post, which we could not open directly and so cannot attribute or quote, is reported to say that many recent lone-actor incidents used ARTEX with DeepSeek 4.1 Flash as the primary model, including attacks on South Korean banks.

What we can say:

• ARTEX is described in press coverage as an autonomous, multi-agent penetration-testing tool. Our GMO Internet breach post lays out that GMO's CEO linked a wave of attacks to it, and that GMO Cybersecurity reported attack servers running it.
• That post also states the exact intrusion route into GMO's service has not been made public.
• We found no primary document, whether a vendor threat report, regulator statement or court filing, that names DeepSeek 4.1 Flash as the model behind specific attacks.
• A hosted abliterated model is a plausible ingredient for such a tool, but plausible is not shown.

So the right label is claimed, with a credible commentator behind it, not verified. If a threat-intelligence report names the model, we will add an update section here.

Why unrestricted hosting is a different problem from open weights

Open weights mean anyone can modify a model. A hosted abliterated API means the modification is operated by a company with billing, uptime and customers. That changes three things.

1. Scale. The marginal cost of an attempt falls to the price of tokens. DeepSeek's own API pricing for this model family is a few tenths of a dollar per million tokens, per the third-party write-up we read, so even a premium resale is cheap per task.
2. Accountability. The vendor says a policy layer governs each request and that it keeps no prompts. Both properties are marketing claims; neither can be audited from outside. A customer-defined policy is only as strict as the customer chooses.
3. Substitution. Providers that refuse harmful requests are no longer the only choice. Anthropic's own disclosures about GLM-5.3's cyber ability, covered in our GLM-5.3 open-weights cyber capabilities post, already pushed this debate.

None of this makes the vendor's stated use cases illegitimate. Red teams, trust-and-safety groups and malware analysts do have legitimate needs for a model that does not refuse to discuss exploits. The problem is that the same endpoint serves everyone with a credit card.

What developers and security teams should do

• Do not treat guardrails as a control. If your threat model assumes attackers are blocked by model refusals, it is already wrong. Assume capable, unrestricted models are available to them.
• Patch faster. The cheaper exploit development gets, the shorter the gap between disclosure and abuse. Prioritize internet-facing services and vulnerabilities that have public proofs of concept.
• Constrain your own agents. If you run coding or ops agents, give them least-privilege credentials and block outbound traffic by default. The ProjectDiscovery backdoored Qwen post shows what a tampered open-weight model can do inside a developer workflow.
• Check model provenance. If you download an uncensored or abliterated variant for legitimate local work, use a build from a source you can verify, and never run it with agent credentials. Prefer reproducing the abliteration yourself on the official weights.
• Watch for the real report. The useful evidence will be from threat-intelligence teams naming a model. Until then, treat any single post as a lead, not a finding. For continuous monitoring of what your agents actually do, see AgentBeam, the agent security platform from the explainx.ai team, and its October 2026 attacks timeline.

How to check these claims yourself

1. Open the vendor's public site and read the models page and pricing for the exact model names before trusting any aggregator headline.
2. Search Hugging Face for the repository and compare its model card with the official DeepSeek V4.1 Flash-1017 page. A genuine derivative states its base and its method.
3. For an attack attribution, look for a primary report: a vendor threat advisory, a CERT or regulator notice, or a court filing. Social posts are leads.
4. If you evaluate the model, run your own benchmarks. Compare against the base model on the same prompts so you can see what abliteration cost in quality.

What we do not know

• The exact price per million tokens of the hosted build.
• Whether the hosted model is full-precision or quantized, and how it scores against the unmodified base.
• Who is buying it and for what.
• Whether "Maple Max" is a separate product, a reseller or an aggregator's label.
• Whether any real incident used this model. The claim exists; the evidence has not been shown.

Bottom line

A refusal-stripped DeepSeek V4.1 Flash is now something you can pay a vendor for, according to the vendor. That is a real shift in access, and the right response is defensive: assume unrestricted capability is cheap, patch quickly, and limit what your own agents can do. The stronger claims, about specific attacks, remain unproven until someone publishes evidence. We will update this post when they do.

Related reading

• DeepSeek V4.1 Flash-1017: open weights, MIT license, benchmarks and pricing
• DeepSeek V4.1 Flash-1017 cyber index: claimed vs verified
• Abliteration.ai hosted uncensored GLM-5.3
• GMO Internet breach and the ARTEX claim
• Heretic: LLM abliteration guide
• Qwen censorship audit by Hirundo
• OpenCode makes DeepSeek V4.1 Flash free: what the docs confirm

Details reflect public information as of October 26, 2026 and may change as the vendor and researchers publish more.