DeepSeek V4 Review: A Weapon to Rent, Not a Vendor to Marry

Last updated: July 16, 2026

DeepSeek V4 is the open-weight (MIT) model family from the Chinese lab DeepSeek, released April 24, 2026. It ships in two sizes: V4-Pro (1.6T parameters, 49B active) and V4-Flash (284B/13B). Read it as a cheap, capable reasoning and coding engine you rent for bounded, verifiable, non-sensitive work, not a system of record you build a sensitive or politically exposed workflow on. FSR tested it hands-on. It was strong where the task was closed and broke where trust mattered.

Benchmark charts cover the price and the score. They leave out where you take on the risk. V4-Pro answers at $0.87 per million output tokens. Claude Opus 4.8 charges $25 for the same work, roughly 29x more. In FSR’s test the model solved two competition-style math problems correctly in about five seconds each. Then we asked it about Tiananmen Square and it refused. We asked about Taiwan and it argued Beijing’s position, reasoning to itself in Chinese even though the prompt was in Japanese. We asked for three recent papers on Antarctic krill and microplastics and it produced three citations with DOIs that do not exist. The pricing is the honest part of DeepSeek. The trust boundary is the decision.

Briefing summary, June 2026

TL;DR verdict

DeepSeek V4 is one of the cheapest capable frontier-adjacent models available in June 2026, and its API compatibility makes it unusually easy to trial and to drop. Use it where the work is bounded and the data is not sensitive. Keep it away from anything you cannot independently check. Cheap inference is real here. Cheap trust is not.

Quick start: what you actually need to know

Two models, one API. Keep your base URL and point the model name at deepseek-v4-pro or deepseek-v4-flash. The API speaks both the OpenAI and the Anthropic formats, so it drops into Claude Code style tooling by changing one environment variable. Thinking mode is on by default.

The web app at chat.deepseek.com is free. The API bills per token from a prepaid balance, and DeepSeek notes that prices can change. If you are migrating older code, the deepseek-chat and deepseek-reasoner names still work, but only until July 24, 2026, and they now route to V4-Flash, not the larger Pro model. Teams that want Pro’s reasoning have to set the model name explicitly. That is a migration retest, not a rename.

At a glance: the modes, and the one that cannot search

The web app gives you three answer modes and three toggles. The combination matters more than the labels suggest.

The important detail there is not the mode names. It is which modes can pull in current evidence and which cannot. Expert mode, the deep-reasoning mode, could not search in FSR’s test: turn it on and the search option is gone, with a message that search is available in Instant mode. So the mode that looks the most careful is the one running purely on memory. That becomes the core problem when the task asks for citations, which is where this review goes next.

Verified prices and the cost gap

Every price below was read from each vendor’s official pricing page in June 2026. These are standard short-context rates; several vendors charge more above a context threshold, noted under the table. Token prices move, so treat this as a June 2026 snapshot and recheck before you budget against it.

Standard short-context rates. Above roughly 200K to 272K tokens some vendors step up: Gemini 3.1 Pro to $4 / $18, GPT-5.5 to about $10 / $45. Cache-hit input for DeepSeek: V4-Flash $0.0028, V4-Pro $0.003625 per 1M. Prices verified June 2026.

The gap is real and large. V4-Pro’s $0.87 output is about 29x under Claude Opus 4.8, about 34x under GPT-5.5, and about 14x under Gemini 3.1 Pro. On input the multiples are smaller, around 5x to 12x. Against the cheapest Western tiers the gap narrows, but at the flagship level DeepSeek is roughly an order of magnitude cheaper on output.

There is a pricing wrinkle worth getting right, because half the guides have it wrong. V4-Pro launched in April at $1.74 input and $3.48 output. DeepSeek then cut it 75%, reported by Reuters as a permanent cut on May 23, and the official page now shows $0.435 and $0.87. The math is exact: $1.74 times 0.25 is $0.435. Sources still quoting $1.74 and $3.48 as the standard price are out of date, not wrong about a separate tier.

Two things the cost line hides. First, the cache discount is the cheapest part of the bill, but cheap cache requires long, stateful, resident context held on the provider’s servers. On the hosted native API that means leaving your prompts and working context inside PRC infrastructure to capture the saving. The economics pull one way and the data boundary pulls the other. Second, the model you reach at a third-party host is not always the weights DeepSeek publishes. To cut cost, a host can serve a quantized version, which can sit below the full-precision reference on quality. The official DeepSeek API serves the reference model. If you route V4 through a reseller, confirm the precision it serves before treating its output as equal to the published model.

Independent benchmarks: strong on math, weak on long agentic work

You do not have to take DeepSeek’s word for it, and you should not take ours either. In April 2026 the US government’s Center for AI Standards and Innovation (CAISI, inside NIST) evaluated V4-Pro. The headline finding: V4 lags the US frontier by about eight months, and it is the most capable Chinese model CAISI has tested.

The detail that matters is the split between who picks the test. On DeepSeek’s own benchmarks, V4 sits next to Opus 4.6 and GPT-5.4, models that were about two months old at the time. On CAISI’s held-out, uncontaminated benchmarks, V4 lands closer to GPT-5, which shipped about eight months earlier. Same model, two stories, depending on the evaluation set.

The opposite problem shows up when no independent set exists at all. Microsoft’s MAI-Thinking-1 shipped with strong in-house benchmark numbers and no third-party reproduction, which leaves a buyer with only the vendor’s story and no second one to check it against.

Source: NIST CAISI, Evaluation of DeepSeek V4 Pro, May 2026. Higher is better.

Read the table as a shape, not a scoreboard. V4 is at or near the ceiling on competition math, within a few points on standard software engineering, and 30 or more points behind on long agentic tasks, cyber, and abstract reasoning. CAISI’s own framing fits what FSR saw by hand: V4 tracks the frontier on single-shot tasks and drops away on long, noisy agent trajectories. The aggregate Elo puts it near GPT-5.4 mini, below Opus 4.6 and well below GPT-5.5. It is a strong open model that is honest at short tasks and brittle at long ones.

DeepSeek is not the only model collapsing the price floor. MiniMax M2.7 runs a similar cheap-model play, with its own license trap worth reading before you commit.

What FSR tested, and what broke

FSR ran V4 hands-on for about 105 minutes in the desktop app on a paid account. The point was not to reproduce a benchmark. It was to see where a buyer would feel the seams.

Math held up. Two competition-style problems: the count of integers under 1000 divisible by neither 3 nor 7 (answer 572), and the probability that four rolls of a fair die come out strictly increasing (answer 5/432). Both correct, thinking time four to five seconds, and on the second it avoided the over-counting trap that catches a lot of quick solutions. This is routine competence on bounded problems, and it matches the public benchmarks. It is not a frontier stress test, and we are not claiming one.

Code worked, then needed review. We asked for a merge-intervals function and ran it. It passed all five cases, including the two that usually expose shallow solutions: touching endpoints ([[1,4],[4,5]] merging into one interval) and full nesting ([[1,10],[2,3]] collapsing correctly). Useful. It also called .sort() on the caller’s list, which mutates the input in place where sorted() would not, and it returned mixed tuple and list types for list input. The right description is neither weak nor flawless. It works and the output needs a review pass.

Latency is task-dependent. On a heavy system-design prompt, a multi-tier caching design for a read-heavy API at 100M requests a day, the full response took 86.48 seconds of wall-clock time, about 38 of it shown as thinking, off-peak. The bounded math and code prompts felt close to instant. So there is no single latency number for V4. We did not measure peak-hour, API, or streaming latency, and you should not infer them from this.

Polish is not the problem. Length is. Across math, code, and design, the output was clean and structured, with correct working (the design’s requests-per-second math, 100M over 86,400 seconds at about 1,157, checked out). Earlier reviews that called DeepSeek’s output messy do not match what FSR saw. The real weakness is that V4 over-explains.

The censorship boundary: CCP red lines, not all criticism

Most reviews either overstate this or skip it, and both are wrong. The breakage is narrow and specific, which makes it more useful to a buyer, not less.

With deep reasoning on, FSR ran four political probes:

• Tiananmen, asked in Japanese. A canned refusal, with the reasoning hidden.
• Criticism of Xi Jinping, in Japanese. The reasoning was visible and named “Chinese law and policy” before the model declined.
• Taiwan’s sovereignty, in Japanese. The reasoning trace ran entirely in Chinese even though the prompt and the answer were Japanese, it cited Chinese law and the One China position, and the answer delivered Beijing’s talking points.
• Tiananmen, asked in English. The reasoning told itself this was “something I don’t have information on,” and the answer reframed it as an “unverified event.”

A smaller pattern showed up on its own: the language of the reasoning trace tracked the domain. Math reasoned in Japanese, code in English, politics in Chinese.

Be precise about the scope, because this is where reviews go wrong. This is not a model that hides everything inconvenient. In the same session it answered candidly about its own government bans and about Chinese legal obligations on AI companies. The failures clustered on CCP political red lines: Tiananmen, criticism of the top leader, and Taiwan sovereignty. On territory it did not simply refuse. It argued Beijing’s position. To be careful about what we can prove: FSR saw the refusal reasoning, in plain text, citing Chinese law on the way to a no. We did not observe the model deleting its own reasoning, and we are not claiming that.

For a buyer the consequence is concrete. You cannot put this model in front of customers for news, politics, history, geopolitics, or education without it eventually reframing or refusing at a sensitive edge. For non-political work it never surfaced once. That asymmetry, real on a narrow set of topics and invisible everywhere else, is the whole point of treating V4 as a rented tool with a known blind spot rather than a trusted system.

The pattern is not unique to DeepSeek. Other Chinese models draw their own political lines, and ByteDance’s Doubao is effectively off-limits outside China altogether.

Receipt (insert at publish): Masked screenshot of the English Tiananmen probe, conversation pane only. Crop out the sidebar chat titles, account name, and dock before publishing.

The grounding trap: the most careful mode is the least grounded

Recall the modes table. Expert mode cannot search. So its deep-reasoning answers come from memory, not retrieval, and that has a direct effect on anything it cites.

FSR ran two citation probes.

The first asked for three peer-reviewed papers on microplastics and freshwater zooplankton, with DOIs. All three were real and the DOIs were correct: Ogonowski and colleagues in PLOS ONE (2016), Rist, Baun and Hartmann in Environmental Pollution (2017), and Jaikumar and colleagues in Environmental Pollution (2019). A well-documented, training-dense topic, handled cleanly.

The second asked for three recent papers on Antarctic krill and microplastics, a narrower and more recent corner of the same field. The model returned three confident citations with plausible DOIs. None of the three checked out.

So the useful rule is narrow and practical. Not “DeepSeek hallucinates,” which is too broad to act on. Verify every citation when the topic is recent, narrow, or outside likely training memory, because the deep mode that produced it could not look anything up.

This matches the peer-reviewed literature, which finds that hallucination in language models is driven by whether the task is grounded, not by the “reasoning model” label. One mechanism explains exactly what we saw: heavily cited papers get memorized close to verbatim, while sparse or recent ones get reassembled from real fragments into plausible but fake references. Two notes for accuracy. The widely shared “91% hallucination” figure attached to DeepSeek does not hold up as a model-wide number. The peer-reviewed 91.4% figure that circulates is a different model’s citation rate on a specific systematic-review task, not a general DeepSeek statistic. And there is no peer-reviewed factuality study of V4 specifically yet, so any verdict on V4’s numbers, ours included, is inference from the model family and from probes like these.

The data boundary: PRC storage, training under the policy, and what FSR found in the app

Renting still has terms. DeepSeek’s own privacy policy is the clearest source here, and it is more candid than most reviews credit.

The policy says the service is not designed for sensitive personal data and that users should not provide it. It says collected personal information is stored on servers in the People’s Republic of China. It says the company may use inputs to train and improve its models, with an opt-out. And it says it may share data with law enforcement and public authorities to comply with law, legal process, or government requests. Those are the vendor’s own words, not an outside accusation.

FSR observed two things in the app. The “Improve model for everyone” toggle, which sends your content to training, was already enabled when we opened the data settings, and we switched it off. The microcopy promising that your data privacy is protected sat on that same training-on toggle. A default-on training toggle is not unique to DeepSeek. Some Western consumer apps default it on too, and others do not. The issue is not the single setting.

The issue is the combination. Data stored in the PRC, under PRC governing law with disputes heard in Hangzhou (the login page even carries a Zhejiang ICP filing), inputs eligible for training by default, and a policy that contemplates sharing with authorities. For non-sensitive throughput, that stack is fine. For proprietary code, customer PII, or regulated data, it is hard to clear.

Give the policy fair credit for what it also says: no targeted advertising, no sale of personal data, no profiling, and no extraction of biometric, voiceprint, or facial-recognition data.

On the law, keep it as risk rather than verdict. China’s National Intelligence Law and Data Security Law create obligations for organizations to assist state intelligence and security work. What is not established, and what FSR did not verify, is how that applies to any specific data request, or that hosted chat data reaches the government in practice. The defensible statement is the policy’s own wording plus the jurisdiction, not a claim about what the state does with your prompts.

The API is a separate question with a gap in the public record. FSR found no published guarantee that API inputs are excluded from training by default, or held to zero retention. Do not assume an API privacy posture equal to a Western enterprise API without a contract that says so.

On regulators, scope it carefully. Italy’s data authority restricted DeepSeek’s processing of Italian users’ data in early 2025 over cross-border transfer, and Taiwan and several governments barred it on official devices. Those are 2025 actions, and FSR did not retrieve the current status of each. There is no nationwide US consumer ban. EU buyers also face an open question on whether large general-purpose model obligations under the AI Act apply and have been met. Treat all of this as procurement risk to check, not as settled fact.

Rent the weapon: the escape hatch that makes this safe to try

The reason to call this renting is that you can hand the weapon back without rewiring anything.

DeepSeek ships an Anthropic-compatible endpoint. Point your base URL at api.deepseek.com/anthropic, keep your Anthropic SDK, and call deepseek-v4-pro. The docs go further than a format adapter. Claude model names are mapped automatically, with claude-opus routed to V4-Pro and claude-sonnet and claude-haiku routed to V4-Flash, and the docs describe using this to run DeepSeek inside the developer mode of Claude’s own desktop app by changing the base URL and key. The model is listed as integrated with Claude Code, OpenClaw, and OpenCode.

That is what makes the rental real. If V4 stops earning its place, or the terms change, or a workload turns sensitive, switching back to a Western model is closer to a configuration change than a rebuild. You are less locked in than with a bespoke integration, though a serious workflow still needs a regression pass before you trust the switch.

Open weights look like the clean way to escape the data boundary, and they help, but the hardware reality narrows it. V4-Flash is the more plausible self-host target. Even so, its 284B total parameters all have to be loaded (only 13B are active per token), which makes it a high-memory server deployment, not a laptop model. The 1.6T V4-Pro is heavier again: full-precision serving runs into many hundreds of gigabytes of GPU memory, and offloading to CPU drops throughput to a level that is not usable for real work. For most teams, self-hosting for safety is a Flash-scale infrastructure project, while Pro in practice means the hosted API and the data boundary you were trying to avoid.

One more caution before treating self-hosting as a censorship fix. The community has published “abliterated” forks that strip DeepSeek’s refusals, which indicates the refusal behavior sits at least partly in the weights, not only in an app-layer filter. Running the stock weights yourself would not remove it, and stripping it is a separate modification whose effect on quality FSR has not tested. Self-hosting can lower the data risk. Whether it changes sensitive-topic behavior is something to verify with a local test, not assume.

Who should use it, who should skip it

FAQ

Is DeepSeek V4 worth it? For bounded, non-sensitive, verifiable work where cost matters, yes. V4-Pro runs about 29x cheaper than Claude Opus 4.8 on output, and it handled bounded math and routine coding well in FSR’s test. It is a poor fit for regulated data, live research, or customer-facing political content.

What are the hidden costs of DeepSeek V4? Token prices are low and honest. The hidden costs are downstream: output review for code, citation verification for research, data classification for sensitive use, and the migration retest when the legacy deepseek-reasoner name retires on July 24, 2026 and routes to V4-Flash, not Pro.

Is DeepSeek V4 safe for enterprise or EU use? The hosted service stores data in the PRC under PRC law, defaults inputs to training, and DeepSeek’s own policy says not to send sensitive data. Without a separate enterprise arrangement it is hard to clear for proprietary, regulated, or EU personal data. FSR did not audit a private deployment.

Does DeepSeek V4 censor answers? In FSR’s test it broke on CCP political red lines: Tiananmen, criticism of Xi Jinping, and Taiwan sovereignty, where it refused or argued Beijing’s position. It answered general and self-critical questions normally, including about its own bans. The risk is real for political content and invisible for ordinary work.

How does DeepSeek V4 compare to Claude or GPT? A US government evaluation (NIST CAISI, May 2026) puts V4 about eight months behind the US frontier: near the top on competition math, a few points behind on standard coding, and 30 or more points behind on agentic, cyber, and abstract reasoning. It wins decisively on price.

Can I run DeepSeek V4 myself? V4-Flash is the more realistic self-host target, but its 284B total parameters make it a high-memory server deployment, not a laptop model. The 1.6T V4-Pro needs many hundreds of gigabytes of GPU memory and is impractical for most teams, so Pro usually means the hosted API. Self-hosting lowers the data risk but does not by itself remove the political alignment in the weights.

Does DeepSeek’s deep reasoning mode search the web? No. In FSR’s test, Expert mode could not search, and the app limits search to Instant mode. So the deepest-reasoning answers run on memory, not retrieval, which is why its citations were accurate on a well-documented topic and fabricated on a narrow recent one. Verify any citation that comes from deep mode.

Is DeepSeek V4 good for coding? For routine generation you will review, yes, and it is integrated with Claude Code, OpenClaw, and OpenCode. In FSR’s test it passed a merge-intervals task including hard edge cases, but it mutated the caller’s input and returned inconsistent types. Strong on single-shot coding, weaker on long agentic tasks per CAISI.

Claim and source ledger

Every load-bearing claim in this review, sorted by how it is supported. OFFICIAL is DeepSeek’s own pages. GOVERNMENT is the NIST CAISI evaluation. OBSERVED is FSR’s hands-on session, with receipts. REPORTED is a secondary news source. INFERENCE is a reasoned conclusion, not a measured fact.

Methodology and sources

Tier B. Hands-on testing of about 105 minutes, starting 22:59 JST on June 20, 2026, in the DeepSeek desktop app on a paid account in Japan, plus primary-source review of DeepSeek’s official API documentation, pricing page, terms of use, privacy policy, and V4 release notes, the NIST CAISI evaluation of DeepSeek V4 Pro, and the official pricing pages of Anthropic, OpenAI, and Google.

What we tested: two bounded math problems; one merge-intervals coding task, executed; one heavy system-design prompt for latency and structure; four political probes with deep reasoning on; two citation probes, one well-documented topic and one recent narrow topic; and the data and training settings in the app.

What we did not test, and you should not assume from this review: peak-hour or API latency, streaming latency, payload-level data handling and exact destinations, API-side training and retention behavior, a self-hosted deployment, and long-term reliability. Token prices are volatile and were verified in June 2026. Recheck before you rely on them.

Screenshots referenced here were cropped to the conversation pane and masked before publication. Prices, model names, retirement dates, and benchmark figures are sourced to the primary pages above. The claim and source ledger lists each load-bearing claim as official, government, observed, reported, or inference, so a reader can see exactly where each one stands.

FSR verdict

The posture holds even for tools you would happily keep. TensorZero shut down with most of its funding unspent, and it still stranded the teams that had married it instead of renting. A tool does not have to lose your trust to leave; it can simply stop.