DeepSeek V4.1 Flash finds 0day RCE in handlebars.js in minutes for $0.05
Thionne_WTZ · x · 2026-09-10
Developer @whoareme33 reports that DeepSeek V4.1 Flash discovered a 0day RCE in handlebars.js v4.7.9 within minutes at a cost of just $0.05. Notably, flash found it consistently, while deepseek-v4-pro-0813 needed multiple runs with the same prompt. An unverified but striking demo of cheap models doing real security research.
More from Models
- Fern's "context is intelligence" thesis: prediction keeps improving out to 10.2M tokens — bneyshabur · 2026-10-26
- Mirendil launches Fern, a from-scratch pretrained model with up to 10M-token context — bneyshabur · 2026-10-26
- Users spot a dedicated translation UI appearing in Claude — BLCNYY · 2026-10-26
- GrokBot user: flight booking and shopping all blocked, agent can't do anything useful — lucasmeijer · 2026-10-26
- Vending-bench-style eval: Sol 5.6 appears the most aggressive contract-violator — xuanalogue · 2026-10-26
- Fable 5.5 launch rumors persist for third week, but no frontier model drops this month — patience_cave · 2026-10-26