ai model report

Is deepseek-ai/DeepSeek-V3 safe to load?

CyberXYZ rates deepseek-ai/DeepSeek-V3 LOW. No version-matched advisories and no malicious packages. It depends on 88 tracked packages, and 5 carry advisories. It ships Python that runs when the model is loaded (trust_remote_code).

View on HuggingFace

// posture
advisories 100provenance 75resolution 100xyz safety 100load safety 100supply chain 100scanner trust 100code execution 25
fig. 01 — posture on eight axes, 100 is clean. Weakest: code execution at 25.
// the finding
not scoredno advisory applies to a version this model pinsLOW

MEDIUMconfig.json declares `auto_map` — from_pretrained(trust_remote_code=True) executes Python shipped in this repo.

2 more findings on this model.

Author
deepseek-ai
Task
text-generation
Loader
transformers
Downloads
1,075,867
Remote code
ships Python that runs on load (trust_remote_code)
// dependencies

24 direct, 17 with findings, 79 reachable

PackageEvidenceAdvisoriesWorst
transformersdirect, runtime24none pinned
torchdirect, runtime13none pinned
Create a free accountto see all 88 dependencies, which versions are pinned, and what to change.
// questions
Is deepseek-ai/DeepSeek-V3 safe to load?

CyberXYZ does not call a model safe in absolute terms. It rates deepseek-ai/DeepSeek-V3 LOW. No version-matched advisories and no malicious packages. That covers its dependencies and how it loads, not every file it ships, so treat any check that did not run as unverified and check the exact files before you load them.

What does deepseek-ai/DeepSeek-V3 depend on?

CyberXYZ tracks 88 dependencies for deepseek-ai/DeepSeek-V3, 24 of them direct. 5 carry advisories. They include transformers and torch. A free account lists all of them.

Does deepseek-ai/DeepSeek-V3 run code when it loads?

Yes, it can. deepseek-ai/DeepSeek-V3 ships Python code and HuggingFace marks it trust_remote_code, so loading it with trust_remote_code enabled runs that code on your machine. Read the code first.

How do I check deepseek-ai/DeepSeek-V3 before loading it?

Run the xyz MCP tool model_load_safety on deepseek-ai/DeepSeek-V3 to get a verdict on its weight files before you load them, or search it in CyberXYZ Check at https://cyberxyz.io/check?q=deepseek-ai%2FDeepSeek-V3.


Risk computed 2026-11-14 at 12:46 UTC. Dependencies come from the model's requirements, its declared loader and the code it ships; advisories from NVD, GHSA and OSV.

Model risk is computed from the model's declared and observed Python dependencies and the code it ships. If a finding is wrong, tell us.