MiniMax M3.1 Flash in practice: tests and comparisons with DeepSeek V4.1 Flash

An independent security benchmark found M3.1 Flash hit 24/32 CVEs at pass@3 (75%) vs DeepSeek V4.1 Flash's 28/32 (87.5%), with 59.4% vs 70.8% single-run recall, ~40% more false positives, and $4.20 vs $2.40 per CVE; the author does not recommend it for security work.

A developer says DeepSeek V4.1 Flash produces vulnerable code in critical areas like authentication, GLM-5.3 finds flaws but writes insecure code, and Opus 5.5, GPT-6.1 Sol and MiniMax M3.1 Flash clearly do better there.

A user had DeepSeek V4.1 Flash write code, then had MiniMax M3.1 Flash and GPT-6.1 Sol review it, and the review turned up a large number of vulnerabilities.

The author plans to fine-tune baked-in guardrails away for local vulnerability testing, saying DeepSeek V4.1 Flash 1017 tends to cause thinking loops while M3.1 Flash seems safer, and has started tuning it.

CashuPayServer's audit fixes include a WordPress plugin flaw letting any password reveal the seed phrase, found by MiniMax M3.1 (Space Bunny) after earlier scans missed it.

An updated NetWatch AI threat-hunting benchmark tested Haiku 5.5, GPT6.1-Sol, Gemini 4, Muse Spark and others; MiniMax M3.1 Flash scored best, though the author flags a caveat.

Claims M3.1 Flash jumped from 17% to 56% on AA-Omniscience, that a researcher suspects it trained on undisclosed test items, and that it still output the old answer after a public question's correct answer was altered.

Using MiniMax Code on a phone, the author had M3.1 Flash build a detector for hidden AI instructions; across three messages and 3-5 minute self-fix cycles it flagged 6 of 7 hidden instructions as high risk.

CashuPayServer ran AI security audits across models; MiniMax M3.1 (Space Bunny) alone found a higher-severity bug all prior scans missed, and the author urges using it free on OpenCode.

Confirms OpenCode's anonymous chart-topper Space Bunny was an early M3.1 Flash, explains how to use the 3-day free tier and its zero-retention policy, and warns that OpenCode's Console was breached over the weekend so outside provider keys should stay unlinked.