DeepSeek V4.1 Flash: MIT Weights, $0.003 Cached Input

What changed

• DeepSeek released V4.1 Flash on 10 September 2026, replacing V4 Pro at the top of its lineup.
• Architecture: sparse mixture-of-experts, 552 billion total parameters, roughly 8 billion active per token on input and 16 billion on output. Native vision. A one-million-token context window.
• Licence: MIT. The most permissive licence in common use — commercial deployment, redistribution and fine-tuning, with no revenue thresholds and no usage restrictions. Weights are on Hugging Face.
• Pricing: $0.30 input and $1.20 output per million tokens at peak; $0.15 and $0.60 off-peak. Off-peak cache-hit input is $0.003 per million.
• Verified benchmarks: 74.2 on DeepSWE v1.1, above both the Opus 5.0 and GPT-5.6 Sol columns; 88.1% on CyberGym, leading the public leaderboard snapshot at the time of writing.
• Vendor-only benchmarks: per DeepSeek's own model card, as reported at launch, AutomationBench 54.8 against 45.8 and Agent's Last Exam 31.8 against 26.7. Those two have not been independently reproduced.

Strong agentic scores from a Chinese lab are no longer news in themselves; that pattern has been running long enough that Chinese open-weight models now dominate Hugging Face download charts. What makes this release worth an hour of your attention is the combination on the label: a model at the top of a public security-agent leaderboard, priced at the bottom of the market, shipped under a licence with nothing in it. Those three things have not previously arrived together.

The pricing, read carefully

The $0.003 figure is the number that will travel, and it is the number most likely to be quoted wrongly. It is not the input price. It is the off-peak price for cache-hit input — tokens the serving layer has already seen as a stable prefix and does not need to process again. Off-peak cache-miss input, meaning genuinely new tokens, is $0.15 per million: fifty times more. Peak rates are double the off-peak figures across the board.

Now put a real agent loop through it. Take an agent with a 40,000-token stable prefix — system prompt, tool schemas, a retrieved policy document that does not change between turns — plus 2,000 tokens of genuinely new context per step and 1,000 tokens of output per step, running 100,000 steps in a month. Off-peak, with the prefix hitting cache every time, that is 4,000 million cached input tokens at $12, 200 million cache-miss input tokens at $30, and 100 million output tokens at $60. Total: about $102, of which output is roughly 59%.

Two things fall out of that arithmetic. First, four billion tokens of prompt prefix cost twelve dollars, which is close enough to free that prompt length has stopped being the thing to optimise. Second, and more importantly, the bill is still dominated by output — and output has no cache discount at any hour. If your agent reasons out loud, retries, or emits long structured plans, you are paying $0.60 to $1.20 per million for every one of those tokens regardless of how clever your caching is.

The same loop with no cache hits at all would cost about $690 off-peak. The cache is not a rounding-error optimisation; it is most of the pricing story on the input side. But it only fires on a genuinely stable prefix inside the provider's cache window, and an agent that reorders its tool list, injects a timestamp at the top of the system prompt, or shuffles retrieved chunks between turns will quietly get none of it.

Off-peak is a scheduling decision, not a discount

Halving your rate by running off-peak sounds free until you notice it is a fixed window in DeepSeek's timezone, not yours. Batch and non-interactive work — nightly document extraction, evaluation runs, backfills, bulk classification, regression suites over an agent — can be moved into that window with a scheduler and nothing else. Interactive chat cannot. If a user is waiting, the request happens when the user makes it, at whatever rate applies then.

This lands differently on the two sides of the India–UK corridor, and it is worth five minutes with a calendar rather than an assumption. A Bengaluru team and a London team are five and a half hours apart, so the same published off-peak window falls inside one team's working day and outside the other's. For one of them, shifting batch work into the cheap hours costs nothing but a cron entry. For the other, it means the job runs while nobody is awake to watch it fail — which is a monitoring and alerting problem before it is a cost saving. Check the published window against your own local time before you promise anyone a halved bill.

The benchmarks, separated by how well anyone can check them

There are two tiers of evidence in this release and they should not be read at the same confidence.

The two corroborated results are genuinely strong and can be stated plainly. A DeepSWE v1.1 score of 74.2 that sits above both the Opus 5.0 and GPT-5.6 Sol columns is a frontier result on a benchmark explicitly built to stop models bunching at the top. The CyberGym lead at 88.1% is the more interesting of the pair, because security analysis is exactly the kind of work that organisations are least willing to send to an external API — and this is the model you are allowed to bring in-house.

The AutomationBench and Agent's Last Exam figures should be read differently. Per DeepSeek's own model card, V4.1 Flash scores 54.8 against 45.8 on the former and 31.8 against 26.7 on the latter. Those are single-source numbers from the party with an interest in them, and nobody outside the lab has reproduced either. DeepSeek's aggregate framing — that V4.1 Flash beats GPT-5.6 Sol and Claude Opus 5.0 on four of the five hardest agentic benchmarks — is a vendor claim resting partly on those unreproduced results, and should be quoted as a vendor claim rather than as a finding.

Sakana got to the same number from the opposite direction

One coincidence is worth a paragraph. Sakana released Fugu Ultra v2 on 11 September 2026 — the day after V4.1 Flash — and it scores 74.3 on DeepSWE. V4.1 Flash scores 74.2. A tenth of a point apart, from two architectural bets that could hardly be more opposed.

Fugu Ultra v2 is not a single model. It is a learned orchestrator that routes work across multiple models, a proprietary layer whose value is in the routing rather than in any one set of weights. V4.1 Flash is the other extreme: one sparse model, one forward pass, weights on Hugging Face under a licence that lets you do whatever you like with them. That both approaches land within 0.1 of each other on a long-horizon software engineering benchmark suggests the benchmark is measuring something that can be reached more than one way — and that the interesting difference between the two is not capability but what you are allowed to do with the result. You can host one of them. You can only rent the other.

The self-hosting reality check

Here is where the enthusiasm needs a brake. The previous generation was 284 billion total parameters. V4.1 Flash is 552 billion. That is not an incremental step in the hardware equation; it is close to a doubling of the memory you have to provision before the model will load at all.

The phrase “roughly 8 billion active parameters” is doing a lot of work in the announcement coverage, and it is being read as though it meant the model runs like an 8B model. It does not. The rule is straightforward and worth memorising: memory footprint tracks total parameters; throughput tracks active parameters. Every one of the 552 billion parameters has to be resident and addressable, because the router can select any expert for any token, and you cannot know in advance which ones a request will need. What sparsity buys you is arithmetic — only about 8 billion parameters' worth of compute per input token, 16 billion on output — which is why it is fast and cheap to serve once loaded. It buys you nothing on the memory bill.

That distinction is the same one we walked through for Qwen 3.8 Flash Next, a 125B MoE with 6B active, and it matters more here simply because the total is four times larger. Anyone sizing this should start from the honest version of the question, which our guide to the self-hosting break-even under memory price inflation sets out: at current memory prices, the hardware you need to hold 552 billion parameters is expensive, and it is expensive whether or not you are using it. Compare that against a per-token rate that starts at $0.60 for output, and the break-even volume is considerably higher than teams expect.

Who the MIT licence is actually for

Licensing is the least glamorous part of a model release and, in this case, the most consequential. Most strong open-weight models ship under community or custom licences carrying revenue thresholds, field-of-use restrictions or acceptable-use appendices that a legal team has to read and sign off. MIT has none of that. Commercial use, redistribution, modification and fine-tuning are all permitted, with no threshold at which the terms change.

For most teams that is a convenience. For one specific kind of team it is the whole decision. If you cannot send the data to a third-party API at all — because the data is clinical, or it is the contents of a customer's core banking system, or a regulator has views — then the choice was never “which model is best”. It was “which capable model can legally and physically come inside the perimeter”, and until now that shortlist has been short and weaker than the frontier.

Both of our markets have versions of this constraint, arriving from different directions. UK organisations in financial services, healthcare and central government routinely carry contractual data-residency requirements that are stricter than any statute, and those requirements are written into procurement rather than legislation, which makes them harder to argue with rather than easier. India's position is different and frequently misdescribed: the DPDP Act's cross-border provision is a negative-list model, under which transfers are broadly permitted unless the government notifies a restricted country, no such list has been notified, and substantive compliance obligations land on 13 May 2027. In practice, Indian enterprise teams are not blocked from using an overseas API by law so much as by their own customers' contracts and their own risk committees — which is why in-house deployment keeps coming up in both markets for reasons that have little to do with cost.

The Indian-language angle is worth noting too. A permissively licensed base model that can be fine-tuned without threshold clauses is the raw material for the kind of domestic work we covered when Gnani shipped Artha Evon at 30B across eleven Indian languages. MIT weights mean a team can build on this and ship the result commercially without asking anyone.

What to do about it this week

Three concrete moves, in the order they are worth making.

Test it through the API first, on your own tasks. The benchmark leadership is real on the two corroborated tests, but DeepSWE and CyberGym are not your workload. Run your existing agent evaluation set against V4.1 Flash at the API rate, and compare against whatever you are paying now. This costs almost nothing and it is the only evidence that matters.

Instrument your cache-hit ratio before you model the savings. The economics of this model depend on a number most teams have never measured. Find out what fraction of your input tokens are a genuinely stable prefix, then work out what it would take to raise it — usually freezing prompt ordering and moving anything volatile to the end of the context rather than the start.

Cost the self-hosted option honestly, and be prepared for it to lose. The MIT licence is a real option and it is worth pricing. It is also 552 billion parameters of memory at a moment when DRAM is sold out for 2026 and the inference cost floor has moved. Price both, write down the break-even volume, and revisit it quarterly rather than deciding once.

The release that matters here is not the benchmark table. It is that the frontier-adjacent, cheapest-in-class agentic option now comes with a licence that imposes no conditions and weights anyone can download. That changes the shape of the decision for regulated teams in Mumbai and Manchester alike — even if, for most of them, the honest answer this quarter is still to use the API and keep the option in reserve. If you have taken a model in-house and measured what it actually cost, write that up. It is one of the few pieces of evidence in this field that nobody can fake.