DeepSeek's 48 hours: new model tops the open-source leaderboard, 12 points off GPT-6 Sol — as DHS orders it purged from federal agencies

One company, one 48-hour window, two opposite realities: on the evaluation platform, DeepSeek-V4.1-Flash-1017 (Max) claimed the top of the Code Arena WebDev open-source leaderboard, just 12 points behind the strongest GPT-6 Sol (Max); in Washington, the Department of Homeland Security issued a sweeping restriction requiring all federal civilian agencies and their IT systems to remove DeepSeek products — and barring the company from federal contracts entirely^[1][2].

The summit: value-for-money enters the "Pareto frontier"

On October 19, evaluation platform Arena announced that DeepSeek-V4.1-Flash-1017 (Max), scoring 1670, overtook Kimi K3 (Max) to become the highest-ranked open-source model on the Code Arena: WebDev leaderboard — also beating closed models including Muse Spark 1.3 (Max), Claude Opus 5 (High) and Grok 4.7 (xHigh), and trailing only leader GPT-6 Sol (Max) by 12 points^[1]. The model, launched October 17, outscored GPT-6 Astra, GPT-6.1 Sol and Claude Opus 5 on the DeepSWE v1.1 software-engineering test while cutting average cost per task by about 60% versus its predecessor; DeepSeek touts "wish-style programming" that one-shots games and 3D models, and user tests clock its generation speed faster than GPT-6.1's ultra mode^[1]. Pricing is DeepSeek's signature play taken to the extreme: at peak hours, 2 yuan per million input tokens (cache miss) and 8 yuan per million output tokens; off-peak 1 and 4; with input cache hits, just 0.04 yuan peak and 0.02 off-peak — a blended cost roughly one-tenth of Kimi K3's. Arena's comparison chart shows the model sitting on the Code Arena "Pareto frontier": no other model is currently both cheaper and higher-scoring^[1].

The ban: from "data-transfer risk" to full removal

Meanwhile, DHS published a notice in the Federal Register requiring the removal of DeepSeek use across all federal civilian agencies and their IT systems — agencies such as the EPA and FCC must exclude any DeepSeek products and clear out existing ones; the notice characterizes the risk as potentially resulting in the "transfer of sensitive data" of US government employees and vendors to the Chinese government, and says DeepSeek's models could "contain malware or other security vulnerabilities"; DeepSeek is also barred from any federal government contracts^[2]. The timing is pointed: the restriction came just days after V4.1-Flash-1017's release — Engadget notes it landed as the company's cheaper models begin rivaling ChatGPT and Gemini; it is not DeepSeek's first friction with the US government either, with two Congressmembers proposing a ban bill last year^[2].

Two sides of one coin: competitiveness and threat perception rise together

Read side by side, the logic is coherent: the risks DHS lists (data outflow, model penetration of federal IT) and the leaderboard result (closed-frontier performance at one-tenth the cost) are two faces of the same fact — the stronger DeepSeek's technology and cost advantage, the larger the "threat surface" it presents in Washington's eyes. For the developer community the near-term effect forks: in commercial and open-source settings, V4.1-Flash-1017's price-performance will keep attracting cost-sensitive workflows and self-hosting users; in any organization touching the US federal ecosystem, DeepSeek components are turning from "an option" into "a compliance red line." Two things to watch: whether other Western regulators follow DHS's framing (last year's congressional bill, this year's DHS sweep — the escalation path is clear), and whether DeepSeek responds with greater transparency (security audits, data-residency options) — because holding the Pareto frontier ultimately depends on staying on most markets' access lists.

The clock is ticking for observers: in the race between technology and regulation, there has never been neutral ground.