DeepSeek V4 Pro: The AI Security Killer Nobody Is Talking About
87 cents per million output tokens on a model that just scored higher than Claude Opus 4.8 at finding software vulnerabilities. DeepSeek shipped V4 Pro the same day Grok 4.6 landed, and every AI channel covered Grok. The one that matters for your security budget is the other one.
The Promise
- Long-context work that was out of reach became routine this week. Codebase ingestion, multi-step agents and putting a full contract set in a single window rather than chunking it and hoping the seams hold — those stopped being budget decisions.
- The engineering is real, not just a price subsidy. Compressed sparse attention cuts single-token inference compute to 27%, and the KV cache drops to 10% of the previous generation. 27% of the compute and 10% of the memory is the whole story of 87 cents.
The Risk
- A model that finds software vulnerabilities at roughly frontier quality is now cheap enough to run continuously against everyone. A defender scans their own code on a schedule; at 43 cents per million input tokens, an attacker can afford to scan everybody's. That isn't a forecast — it arrived on Wednesday.
- 'Open weight' is doing marketing work the artefact doesn't support. The repositories still host the April build; DeepSeek has published no timeline for production weights. The model you can download and the model you can call are measurably different models wearing the same name.
- The pricing page carries a notice that the company plans a 'significant increase in overall API pricing'. Today's price is not a commitment, and the benchmarks are vendor-reported on DeepSeek's own harness with nobody independent replicating the 0813 build.
Why a 1.6-trillion-parameter model costs less than a dollar
DeepSeek shipped V4 Pro out of preview on Wednesday — build 0813, 1.6 trillion parameters, 49 billion active, a million-token context and a maximum output of 384,000 tokens. The price didn’t move: roughly 43 cents per million input tokens on a cache miss, 87 cents per million out. Grok 4.6 is $6 out. GPT-5.6 Soul is $30 — a thirty-fourth of the price.
A model that size should be expensive to serve. Three things decide what a token actually costs.
The first is standard: V4 Pro is a mixture-of-experts model, so 1.6 trillion parameters sit on disk while only 49 billion fire for any given token. Enormous knowledge, a compute bill thirty times smaller. Frontier models have worked this way since 2024.
The second and third are where DeepSeek did the work. Standard attention compares every token to every other token, so cost grows with the square of the context; DeepSeek’s compressed attention variants cut single-token inference compute to 27%. And conversations require a running KV cache in expensive GPU memory — that cache drops to 10% of the previous generation.
The number worth sitting with
On DeepSeek’s reported agent benchmarks the jump from preview to production isn’t incremental. Terminal-Bench 2.1 went from 72.1 to 87.9. CyberGym went from 52.7 to 83.3.
That second one is the number to sit with. CyberGym measures finding vulnerabilities in real software, and 83.3 beats Claude Opus 4.8 at 78.3. On Terminal-Bench, DeepSeek reports 87.9 against Opus at 85.
Hold those loosely — vendor-reported, run on DeepSeek’s own harness, unreplicated on the 0813 build. This isn’t a clean sweep and the company didn’t claim one. But treat the direction as real, because the direction is the point.
I’ve spent 25 years in cybersecurity and this is the oldest story in the field: the tool doesn’t know which side it’s on. What a price collapse changes is how many people can afford to run it at scale, continuously, against everyone.
Check which build you mean
If you were planning to self-host, read the open-weight claim carefully. DeepSeek calls V4 Pro open-weight, but the 0813 build isn’t there — the repositories still host the April artefacts, and no timeline has been published for the production weights. If your architecture review has MIT-licensed, self-hostable sitting in the mitigation column, check which build that sentence refers to before it gets signed.
Don’t plan on running Pro anyway. 1.6 trillion parameters at 4-bit is roughly 800GB of weights — a no-go on an RTX 5090 and a no-go on a Mac Studio Ultra. This is a data centre model. V4 Flash, the 284-billion-parameter sibling at about 140GB, is the one a Mac will hold and run slowly.
Three things to do with this. If you run agentic or long-context workloads at volume, price the switch properly — the actual bill on your actual traffic, with your fallback model still wired in. If you work in security, assume your adversaries have already priced it, and run it first on your own code. And if you’re writing this into a vendor assessment, be precise about which build you mean.
Intelligence is commoditising faster than the labs modelled it, and the companies charging a premium are watching that premium evaporate.