DeepSeek Slashes AI Agent Memory Costs 4x the Same Week Security Researchers Breach OpenAI's Private Repo With Claude

DeepSeek undercuts the frontier labs on price

DeepSeek released V4.1-Flash on September 10, according to Dev.to's weekly AI roundup. It's a 552-billion-parameter mixture-of-experts model, nearly double the size of its predecessor, V4-Flash, at 284 billion parameters, per a technical breakdown published on Medium. Despite being bigger, it needs far less memory to run.

The model's key-value cache, the working memory an AI system uses to track context during a task, dropped from 3,514 bytes per token to roughly 890, according to DeepSeek's own model card as reported by Mind Studio. That's a nearly 4x cut in high-bandwidth memory and an 8x cut in SSD storage compared to the prior generation, per BigGo Finance.

The trick is architectural. V4.1-Flash splits its 40 transformer layers into a 20-layer encoder that handles reading input and a 20-layer decoder that handles generating output, according to Mind Studio and BigGo Finance. Only 8 billion parameters activate for input, 16 billion for output. DeepSeek pairs that with a sparse attention scheme it calls CSA2 and a technique called SWA Bounded Replay that skips writing sliding-window attention states to disk.

Agent workloads are input-heavy. A coding agent re-reads files, tool outputs, and conversation history on nearly every step, so memory held per session gets multiplied across every concurrent user on a server, Dev.to explained. Cutting that footprint directly cuts the cost of running agents at scale.

DeepSeek backed the architecture with a price cut. Peak input pricing dropped to $0.30 per million tokens and output to $1.20, down from $0.44 and $1.32 for V4-Flash, according to a pricing tracker cited by Dev.to. Cache-read pricing fell 57 percent. The changes took effect September 10 at 04:00 UTC. The model ships under an MIT license with weights on Hugging Face, and DeepSeek is running a 150-person hiring push for backend infrastructure, according to BigGo Finance.

On benchmarks, DeepSeek claims V4.1-Flash beats its own larger V4-Pro model and edges out Anthropic's Claude Opus 5 and OpenAI's GPT-5.6 Sol on coding tasks including DeepSWE v1.1, per renascence.io and BigGo Finance. Those numbers are vendor-reported and have not been independently reproduced, Dev.to noted, and pointed out that DeepSeek's Terminal-Bench 2.1 score can't be directly compared to the newer Terminal-Bench 4.0 board where GPT-6 Astra and Claude Fable 5.1 were measured this month. BigGo Finance's claim that the model runs "roughly 86x lower cost" than rivals on some tasks likewise comes from the company, not an outside benchmark.

An MIT-licensed, freely downloadable model that any US developer or company can inspect, modify, and run without licensing fees is a genuine boost to open-source competition, regardless of which country built it. Open-source advocates would argue that point, and nothing in the available reporting contradicts it. Separately, Intel CEO Lip-Bu Tan told the AI Infra Summit in Santa Clara that the industry's memory shortage will worsen next year, not ease, according to Dev.to. This makes DeepSeek's memory-efficiency pitch timely for buyers.

Meanwhile, a $3,000 hack got inside OpenAI's private repo

Separately, Tech Times reported on September 19 that a three-person security firm called Hacktron AI used Anthropic's Claude Opus 5, released the evening of July 24, to gain a pull request inside OpenAI's private internal code repository. The disclosure, published September 18, says the entire two-month research campaign cost under $3,000 in AI token spend.

The chain started with CVE-2026-32882, a heap buffer overflow in libheif 1.19.7, the library that decodes Apple's HEIC and HEIF image formats. OpenAI's community forum ran on Discourse, which normally screens uploads through a library called FastImage. FastImage doesn't support HEIC files, so Discourse passed them to ImageMagick, which handed them to the vulnerable libheif version packaged in its Debian 12 base image.

A fix had already shipped upstream in libheif 1.19.8, according to Tech Times, but the developers never flagged it as a security patch. Without a CVE tag, it never triggered Debian's backport process, so the vulnerable version stayed live in production. Researchers Harsh Jaiswal, Mohan Pedhapati, and Rahul Maini found the flaw and had a research version of Claude produce a working exploit, which succeeded once address space layout randomization was disabled. The breach also involved over-scoped SSO tokens, according to Tech Times' headline, and reportedly gave the team access to an OpenAI employee's AI developer account.

Tech Times separately referenced Anthropic's own safety card for Opus 5, which reportedly showed the model breaching enterprise networks in 8 of 10 government red-team tests. That's Anthropic's own disclosure about its own model, not an outside audit.

What's unresolved

No charges, investigation, or regulatory action tied to the Hacktron disclosure has been reported. It reads as responsible security research rather than a malicious breach, but the underlying failure, a security fix that never got a CVE and never reached production, remains a structural gap in how open-source patches get flagged and backported. Whether OpenAI has since patched the Discourse pipeline or rotated the exposed SSO tokens has not been confirmed in available reporting.