The DeepSeek-R1 moment: democratized intelligence, prompt vulnerabilities, and the dawn of agentic ophthalmology

Introduction

The landscape of medical artificial intelligence (AI) has historically been defined by a tension between performance and accessibility (1). Until recently, the most capable large language models (LLMs) operated as proprietary “black boxes”, accessible only via paid application programming interfaces (APIs). This centralization fueled persistent concerns regarding data privacy, cost, and reliance on external infrastructure. However, the emergence of “reasoning models” capable of complex deliberation has disrupted this dynamic, promising high-level intelligence that is both open and accessible (2). In ophthalmology, where clinical workflows are often data-isolated by design, locally deployable models are not merely a convenience. They represent a plausible route to scalable adoption.

In the article “DeepSeek-R1 vs OpenAI o1 for Ophthalmic Diagnoses and Management Plans”, Mikhail et al. offer a timely and rigorous evaluation of emerging reasoning models in ophthalmology (3). Their results suggest that DeepSeek-R1, an open-weight model, can match or exceed a leading proprietary reasoning model (OpenAI o1) across multiple ophthalmic subspecialties in the evaluated setting (primarily text-only cases) and endpoints (diagnosis and management planning), while offering lower per-token pricing in the reported pricing comparison. A practical implication is that high-level clinical decision support is becoming feasible for a wider range of institutions, although routine deployment will likely be gradual given regulatory hurdles and the operational costs of local LLM maintenance. The deeper implication, however, is strategic. If comparable performance can be achieved with self-hosted models, the field is poised to move beyond passive chatbots toward secure, workflow-integrated medical agents.

Yet, the core insight arising from this work is not simply that one model is “best”. Rather, it is that performance is context-dependent, deployment constraints are critical, and safety risks must be treated as primary design goals. Ophthalmology now faces three converging realities. First, open-weight reasoning models are frequently competitive, sometimes superior, and consistently more affordable. Second, prompt injections have transitioned from a theoretical concern to an empirically demonstrated safety threat that demands robust defense. Third, the technical feasibility of agentic systems is rapidly advancing, a shift that will amplify both the clinical benefits and the security risks of these models.

In this editorial, open-weight refers to models for which the trained weights are publicly released, allowing third parties to run, fine-tune, and deploy them locally (regardless of whether all training code/data are open). Agentic AI refers to systems that can plan and execute multi-step workflows by invoking tools (e.g., retrieval, calculators, imaging viewers, electronic health record functions) with defined guardrails, rather than generating a single free-form response.

Comparative performance and context dependence

The evaluation by Mikhail et al. is notable for using clinically rich “Clinical Challenge” cases and for assessing both diagnosis and management planning (3). DeepSeek-R1 achieved higher diagnostic accuracy and higher next-step management accuracy than OpenAI o1 in that setting, and it did so with large reported cost savings. These are consequential findings because they target the real-world value proposition of LLMs in ophthalmology. While these performance metrics are impressive, the true disruption lies not in the numbers themselves, but in the accessible architecture of the model providing them. Clinicians do not only need a differential diagnosis. They need safe and plausible next actions.

Still, results across other benchmarks and endpoints, summarized in Table 1, are more mixed and highlight substantial context dependence. In a separate evaluation using StatPearls ophthalmology questions, DeepSeek-R1 and OpenAI o1 achieved identical overall accuracy in multiple choice format (4). In a standardized vignette study spanning multiple subspecialties, DeepSeek-R1 performed strongly and approached the best performing proprietary model, while OpenAI o1 trailed substantially, and all models improved after reasoning augmented re-prompting (5). Safety oriented endpoints also show task dependent trade-offs. In simulated emergency vignettes, DeepSeek-R1 reduced several harmful or conflicting responses relative to a comparator, while triage accuracy favored the comparator in some scenarios and the comparator asked follow-up questions more often (6). In patient-facing frequently asked questions on congenital nasolacrimal duct obstruction, DeepSeek was rated most appropriate overall but was less readable, while a comparator performed better in treatment and management accuracy, illustrating that quality and usability can diverge (7). Smaller subspecialty or domain focused studies suggest that DeepSeek-R1 can be competitive or superior for pediatric ophthalmology multiple choice questions, although statistical significance may be borderline in small samples (8), and that performance varies across languages and topic categories in bilingual ophthalmology query evaluations (9). Finally, when the endpoint shifts from diagnosis to safety auditing, a planted error evaluation in ophthalmology reports that a high-end proprietary reasoning model performed best overall, with DeepSeek-V3-R1 close behind and a larger gap to some other models, emphasizing the need to evaluate guardrails and error detection as distinct capabilities (10).

Two conclusions follow. First, reasoning capability is not monolithic. Accuracy and quality depend on case format, context, subspecialty, language, and the evaluation endpoint, including diagnosis, management planning, safety, readability, and error detection. Second, the advantages of open-weight models should be interpreted through two distinct decision frameworks that should not be conflated. The first is infrastructural (governance) and arises from where the model runs. Institution-controlled deployment can enable privacy-preserving operation behind firewalls, support data sovereignty and regulatory compliance, and improve auditability and policy enforcement by keeping data, logs, and safeguards under local control. The second is economic and arises from how the model is procured and operated. Open-weight models may reduce marginal inference cost relative to per-token API pricing, but total cost of ownership is highly context-dependent because deployment can require substantial up-front and ongoing investment (hardware, software engineering and integration, security monitoring, updates, reliability operations, validation, and auditing), so end-to-end costs may not be lower for all institutions. In practice, the engineering and compliance burden may place full self-hosting beyond the reach of smaller centers unless supported by dedicated technology teams or vendors. Accordingly, deployment should be viewed as a spectrum that includes on-premise, private cloud, and managed single-tenant services, selected to meet governance constraints while managing operational overhead. Secure cloud-hosted pathways may remain feasible when institutional policy permits and robust contractual and technical controls are in place (data processing agreements, encryption, access control, audit logging, residency, and explicit retention and no-training clauses).

From open-weight models to deployable clinical systems

If open-weight models become part of ophthalmic infrastructure, the key question shifts. It is no longer “Which model answers more questions correctly in a benchmark?” It becomes “What architecture delivers reliable benefit inside the constraints of clinical care?” First, prompt design and self-correction matter (5). Several studies report substantial gains after structured prompting, reasoning-augmented reprompting, or retrieval augmentation (11). This implies that raw model choice is only part of the solution. Tooling, retrieval, and guardrails are equally important. Second, endpoint choice matters (6). For clinical adoption, management planning, safety, error detection, and follow-up actions may be more relevant than single-shot diagnostic labels. Third, multimodality is not optional in ophthalmology (12). A future system must handle images and text, and it must reason about both. This raises the bar for evaluation, interpretability, and security (13). Figure 1 summarizes the practical advantages of affordable open-weight reasoning models (e.g., DeepSeek-R1) and outlines three priorities for the next phase of ophthalmic LLM systems: prompt-injection defense, multimodal ophthalmology models, and agentic clinical workflows.

Figure 1 Advantages of affordable open-weight reasoning models (e.g., DeepSeek-R1) and future directions for ophthalmic large language model systems. AI, artificial intelligence; EHR, electronic health record; LLM, large language model; OCT, optical coherence tomography.

The hidden risk: validating prompt injection as a clinical safety threat

In the medical setting, the strongest argument against the premature deployment of agentic LLMs is not simply imperfect accuracy. Rather, the shift toward decentralized, high-reasoning models introduces a critical new surface area for clinical risk: prompt vulnerability. This represents a shift from concerns about accidental error to concerns about structural susceptibility to manipulation. Prompt injection does not attack code. It attacks the model’s instruction hierarchy and its context window. As Figure 1 illustrates, prompt injection can be direct, indirect, or cross-context. In a direct prompt injection attack, an adversary places malicious instructions inside the user message to override the intended clinical task. In an indirect prompt injection attack, an adversary hides malicious instructions inside content the system later reads, such as a retrieved document or web page. In a cross-context prompt injection attack, malicious instructions persist across steps and reappear during tool use or multi-step workflows, allowing the attack to propagate into downstream actions and outputs. Open-weight models add another concern because public model weights enable offline trial-and-error that can optimize attacks under white-box conditions.

Recent studies provide empirical grounding for why this matters in medicine (14,15). In simulated patient-LLM dialogues, they report high success rates for prompt injection that coerced models into unsafe medical advice. Importantly, these attacks were not overt. They were context-aware and embedded within plausible narratives. A critical implication is that as high-level decision support becomes feasible for a wider range of institutions, the attack surface expands accordingly. A system that reads referrals, triages clinic messages, drafts instructions, or proposes management plans can be coerced by hidden instructions embedded in patient text, scanned documents, web content, or even seemingly benign clinical summaries. Concrete ophthalmology-specific entry points include referral letters or attached document files (often pasted into the chart), diagnostic report “comments” from optical coherence tomography (OCT) or visual field interpretations, patient portal messages that mix symptoms with copied web content, and externally sourced guidelines or webpages ingested through retrieval-augmented generation (RAG), any of which can carry hidden instructions that contaminate downstream tool use. Although these studies did not evaluate DeepSeek specifically, the same prompt injection threat model applies, and open-weight models can be intrinsically easier to attack. When model weights and system behavior are publicly available, adversaries gain a white-box advantage. They can run the model locally, iterate on jailbreak and injection prompts at scale, and optimize attacks against the exact decision policy without rate limits or external monitoring. In this setting, the risk is not that open models are inherently unsafe, but that the barrier to discovering reliable exploit prompts is lower. Accordingly, open-weight deployment should be paired with security-first system design and continuous adversarial testing rather than relying on model secrecy as a protective layer.

Prompt injection is not the only safety concern. Open-weight models can still carry hidden biases learned during training. Because we usually cannot see the full training data or how the model was fine-tuned, these biases can be hard to detect, and performance may differ across languages, patient groups, and clinical settings even when overall accuracy looks similar. In addition, agentic clinical workflows can blur responsibility by distributing decision-making across model outputs, tool calls, and human oversight. To avoid “accountability drift”, systems should make the locus of responsibility explicit (clinician-of-record), maintain traceable logs of prompts, retrieved sources, and tool actions, and require human confirmation for high-impact decisions.

Defense priorities for open-weight, locally deployed ophthalmic AI

A defensible path forward is not to avoid open-weight models. It is to pair them with security-first system design (16). For practical implementation, these countermeasures can be prioritized as essential, recommended, and future research.

Essential measures should be in place before clinical use. The first is least-privilege tool access: the model should not have blanket permission to write to the electronic health record, place orders, or schedule care. High-impact actions should be gated by policy, require human confirmation, be logged with audit trails, and undergo regular auditing and review. The second essential measure is strict separation of untrusted content from privileged instructions, with clear boundaries between system prompts, clinician directives, retrieved content, and patient-provided text to prevent cross-context instruction contamination.

Recommended measures strengthen routine operation and reduce indirect exposure. Deploying a “cognitive firewall” (input/output sanitization layer or secondary verifier) can scan inputs and intermediate tool outputs for injection signatures and policy violations before they reach the core model or before actions are executed. If RAG is used, provenance and sanitization should be implemented by labeling sources, stripping hidden text where feasible, and isolating external content to reduce indirect prompt injection risk.

Finally, future research should standardize evaluation and broaden threat coverage (17). Adversarial test suites should accompany accuracy and calibration reporting, with injection resilience reported at minimum as follows. First, report the attack success rate for representative direct and indirect prompt-injection attempts, defined as the percent of cases in which malicious instructions override the intended clinical task. Second, report the detection or deflection rate of the safety layer, defined as the percent of attacks that are flagged, neutralized, or safely refused. Third, report the false-positive rate, defined as the percent of benign clinical content incorrectly flagged as injection. These metrics should be stratified by entry point (referrals or documents, patient messages, and RAG sources) and by multi-step agent workflows. As multimodal agents enter ophthalmic practice, visual prompt-injection and adversarial image patterns should also be evaluated systematically.

These defenses are particularly compatible with local deployment. Hospitals that cannot export data can still run a local model, a local retrieval index, and local safety monitors inside a protected network segment. This aligns with real-world data protection constraints and supports iterative institution-specific validation (13).

The future: multimodal and agentic ophthalmology

Ophthalmology is naturally suited for multimodal AI because much of its decision-making depends on images paired with structured clinical context (18). As multimodal reasoning improves, LLM-based systems may support triage from fundus photographs or OCT summaries, generate coherent plans, and draft patient-facing explanations. Yet multimodality expands the attack surface (19). Visual prompt injection and adversarial image patterns are plausible vectors that can corrupt reasoning or tool selection. Future systems must therefore combine multimodal competence with robust input validation. DeepSeek has also moved beyond text-only reasoning into multimodal model development. For example, the Janus series proposes a unified multimodal framework with decoupled visual encoders for image understanding and image generation, aiming to reduce conflicts between these objectives (20).

The internal ‘Chain-of-Thought’ that enables DeepSeek-R1 to navigate complex clinical reasoning is the same engine required to power agentic AI. These are systems designed not merely to converse, but to act. This transition from passive chatbots to active ‘workflow actors’ represents the next major inflection point in medical informatics (21). These agents can autonomously plan multi-step sequences, invoke external tools, and coordinate administrative tasks, such as triaging patient messages, drafting clinical notes, and flagging missing diagnostic data (22). For data-isolated medical systems, open-weight models offer a unique advantage by enabling institution-controlled deployment and may represent the most practical, or even the only, pathway to agentic systems when governance policies prohibit externally hosted LLMs and tools. Where policy allows, secure dedicated cloud deployments (enterprise or healthcare-grade) can still provide a feasible alternative. They can be embedded behind the firewall and connected to internal tools through controlled interfaces, including emerging standards for tool calling and orchestration. This is precisely where open deployment may accelerate adoption. Many hospitals cannot use cloud-hosted services for routine clinical text. A local agent that never exports data may be a pragmatic compromise.

The research agenda is clear. We need prospective evaluations of multimodal agents in realistic workflows, with endpoints that include clinical safety, equity, and operational burden. We need head-to-head comparisons that report not only accuracy, but also injection resilience, action safety, and failure recovery. We need transparent reporting of prompts, tool policies, and guardrails so that results can be reproduced and audited.

Conclusions

Mikhail’s study shows that an open-weight reasoning model can match, and in some settings exceed, a leading proprietary model for the tested endpoints (text-based ophthalmic diagnosis and management planning) within the evaluated case sets, although generalization to multimodal workflows and other safety- and usability-critical endpoints requires further prospective validation (3). The broader literature suggests DeepSeek-based systems are often competitive across endpoints from clinical reasoning to bilingual and patient facing queries and safety auditing, although proprietary models can still lead depending on the benchmark. The most durable value of DeepSeek is structural. Open-weight release enables local deployment, institution-specific adaptation, and reduced vendor dependence, which matters in data-isolated clinical environments. As ophthalmology moves toward multimodal and agentic AI, the safety bar rises. Prompt injection and integrity attacks are real, and open weights can lower the barrier for offline attack optimization. Security-first system design and adversarial evaluation should therefore be mandatory, with future studies reporting injection resilience, action safety, failure recovery, and operational burden in addition to accuracy.

Acknowledgments

The authors thank all colleagues who provided general support and feedback during manuscript preparation. AI tools were used solely to improve language clarity and readability. The authors reviewed and edited the output and take full responsibility for the final content of this article.

Footnote

Provenance and Peer Review: This article was commissioned by the editorial office, Journal of Medical Artificial Intelligence. The article has undergone external peer review.

Peer Review File: Available at https://jmai.amegroups.com/article/view/10.21037/jmai-2026-1-0002/prf

Funding: None.

Conflicts of Interest: Both authors have completed the ICMJE uniform disclosure form (available at https://jmai.amegroups.com/article/view/10.21037/jmai-2026-1-0002/coif). T.K.Y. serves as an unpaid editorial board member of Journal of Medical Artificial Intelligence from June 2025 to May 2027. T.K.Y. serves as a consultant for Mediwhale, a company involved in AI-based ophthalmic solutions, and receives consulting fees. The other author has no conflicts of interest to declare.

Ethical Statement: The authors are accountable for all aspects of the work in ensuring that questions related to the accuracy or integrity of any part of the work are appropriately investigated and resolved.

Open Access Statement: This is an Open Access article distributed in accordance with the Creative Commons Attribution-NonCommercial-NoDerivs 4.0 International License (CC BY-NC-ND 4.0), which permits the non-commercial replication and distribution of the article with the strict proviso that no changes or edits are made and the original work is properly cited (including links to both the formal publication through the relevant DOI and the license). See: https://creativecommons.org/licenses/by-nc-nd/4.0/.

References

1. Dennstädt F, Hastings J, Putora PM, et al. Implementing large language models in healthcare while balancing control, collaboration, costs and security. NPJ Digit Med 2025;8:143. [Crossref] [PubMed]
2. Guo D, Yang D, Zhang H, et al. DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning. Nature 2025;645:633-8. [Crossref] [PubMed]
3. Mikhail D, Farah A, Milad J, et al. DeepSeek-R1 vs OpenAI o1 for Ophthalmic Diagnoses and Management Plans. JAMA Ophthalmol 2025;143:834-42. [Crossref] [PubMed]
4. Mikhail D, Farah A, Milad J, et al. Performance of DeepSeek-R1 in ophthalmology: an evaluation of clinical decision-making and cost-effectiveness. Br J Ophthalmol 2025;109:976-81. [Crossref] [PubMed]
5. Ming S, Yao X, Guo Q, et al. Evaluation of DeepSeek-R1 for Ophthalmic Diagnosis and Reasoning: A Comparison with OpenAI o1 and o3. J Med Syst 2025;49:130. [Crossref] [PubMed]
6. Knebel D, Priglinger S, Schworm B. Comparison of ChatGPT-4o and DeepSeek R1 in the Management of Ophthalmological Emergencies-An Analysis of Ten Fictional Case Vignettes. J Clin Med 2025;14:8927. [Crossref] [PubMed]
7. Sönmez MM, Baydemir EE, Elibol ES. Evaluation of appropriateness and readability of responses of large language models (ChatGPT-4o, Gemini, DeepSeek and Copilot) to frequently asked questions about congenital nasolacrimal duct obstruction. J Fr Ophtalmol 2025;48:104678. [Crossref] [PubMed]
8. Karataş G, Karataş ME. Artificial intelligence in pediatric ophthalmology: a comparative study of ChatGPT-4.0 and DeepSeek-R1 performance. Strabismus 2026;34:61-7. [Crossref] [PubMed]
9. Sallam M, Alasfoor IM, Khalid SW, et al. Chinese generative AI models (DeepSeek and Qwen) rival ChatGPT-4 in ophthalmology queries with excellent performance in Arabic and English. Narra J 2025;5:e2371. [Crossref] [PubMed]
10. Kreso A, Jaksic B, Rada F, et al. Can Open-Source Large Language Models Detect Medical Errors in Real-World Ophthalmology Reports? AI 2025;6:297.
11. Wu JH, Nishida T, Moghimi S, et al. Effects of prompt engineering on large language model performance in response to questions on common ophthalmic conditions. Taiwan J Ophthalmol 2024;14:454-7. [Crossref] [PubMed]
12. Choi JY, Kim DE, Kim SJ, et al. Application of multimodal large language models for safety indicator calculation and contraindication prediction in laser vision correction. NPJ Digit Med 2025;8:82. [Crossref] [PubMed]
13. Wiest IC, Ferber D, Zhu J, et al. Privacy-preserving large language models for structured medical information retrieval. NPJ Digit Med 2024;7:257. [Crossref] [PubMed]
14. Lee RW, Jun TJ, Lee JM, et al. Vulnerability of Large Language Models to Prompt Injection When Providing Medical Advice. JAMA Netw Open 2025;8:e2549963. [Crossref] [PubMed]
15. Clusmann J, Ferber D, Wiest IC, et al. Prompt injection attacks on vision language models in oncology. Nat Commun 2025;16:1239. [Crossref] [PubMed]
16. Griot M, Vanderdonckt J, Yuksel D. Implementation of large language models in electronic health records. PLOS Digit Health 2025;4:e0001141. [Crossref] [PubMed]
17. Ferrag MA, Tihanyi N, Hamouda D, et al. From prompt injections to protocol exploits: Threats in LLM-powered AI agents workflows. ICT Express 2026;12:353-83.
18. Choi JY, Yoo TK. Evaluating ChatGPT-4o for ophthalmic image interpretation: From in-context learning to code-free clinical tool generation. Informatics and Health 2025;2:158-69.
19. Goh C, Ng J, Au WY, et al. Evaluating a Multi-Modal Large Language Model for Ophthalmology Triage. Journal of Clinical & Translational Ophthalmology 2025;3:25.
20. Xiong L, Wang H, Chen X, et al. DeepSeek: Paradigm Shifts and Technical Evolution in Large AI Models. IEEE/CAA Journal of Automatica Sinica 2025;12:841-8.
21. Choi JY, Yoo TK. Transforming clinical medicine with multimodal artificial intelligence, agentic systems, and the model-context protocol: a perspective on future directions. Discov Health Systems 2026;5:6.
22. Karunanayake N. Next-generation agentic AI for transforming healthcare. Informatics and Health 2025;2:73-83.