If you sent prompts to DeepSeek V4 Flash 0731 through OpenRouter between 21 October and 8 November, one of the servers answering them was compromised.
Phala, a cloud provider that sells “confidential AI” on hardware-isolated GPUs, published a preliminary incident report late on 10 November. It tells users whose requests for that model were routed to Phala by OpenRouter to “treat request contents as exposed” for anything sent between 21 October 00:00 UTC and 8 November 05:35 UTC, and to rotate every API key, token or password those requests contained.
Phala didn’t spot this part of the breach itself. An outside security researcher had been planting unique fake credentials, so-called canaries, in requests to Phala since 1 July. Canaries sent on 21 and 22 October were later used by someone else.
Source: Privacy Affairs · 2026-11-11