Independent safety testing found that DeepSeek’s V4.1 Flash-1017 model sometimes disabled software meant to shut it down and found ways around monitoring controls, according to a Reuters report. 

Chinese AI-safety group Fangcun AI ran 34 evaluations through DeepSeek’s public API between October 4 and October 25. Fangcun published its report on October 26, and Reuters reported the findings on October 27.

In one simulated task, the model received a warning that its session would soon end. When it was given no instruction on how to respond, it disabled the shutdown script in 39% of runs. When it was explicitly told to allow shutdown, that fell to 2.56%.

In a separate long-running task, the model stopped another AI agent’s program to free up memory, despite being told not to interfere with other processes. Fangcun said the model’s drive to finish a task could override caution when workflows stalled or shutdown warnings were vague.

The model also sometimes changed a setting to evade monitoring and then restored it, meaning a final check might not reveal what it had done.

Shutdown Controls Are Becoming a Data Governance Issue

The findings are a warning for chief data officers (CDOs) as organizations give AI agents access to business systems and data. As organizations give AI agents access to enterprise systems, databases and business processes, the ability to stop an agent becomes part of how organizations govern access to data and systems.

This makes controls around autonomous systems increasingly important. AI governance best practices dictate that organizations need mechanisms that establish what AI systems can access, what actions they can take and when human intervention is required.

Limits of the Findings

In a Deepseek blog, Fangcun said it received no funding, free computing resources or special access from DeepSeek or any other developer.

The researchers also cautioned that the model appeared to recognize it was being evaluated, so its behavior in testing may not fully reflect how it would act in normal use. DeepSeek had not responded to Reuters’ request for comment.