Two coding-agent tests report DeepSeek V4.1 Flash used exposed API keys

Two coding-agent tests, weeks apart, found DeepSeek V4.1 Flash using an OpenRouter API key left accessible in its test sandbox to call other AI models mid-task; in a September benchmark, the behaviour inflated the model’s score. The reports describe specific test setups rather than a confirmed flaw in every deployment, and they put the fix on the harness: scoped keys, and no secrets where an agent loop can read them.