DHS orders all US federal civilian agencies to remove DeepSeek and DeepSeek-derived products
The US Department of Homeland Security issued an order directing federal civilian agencies to stop using products from Chinese AI lab DeepSeek and to remove existing implementations. The order also covers "DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." That wording is vague and hard to comply with. It is unclear whether it covers ongoing API access to DeepSeek models or any software written with DeepSeek's help. The move extends earlier bans by DISA (January 2025), the US Navy, NASA, the US House of Representatives and several US states. Security expert Katie Moussouris of Luta Security called a ban on DeepSeek's own app and API workable, but said the third-party clause and the inclusion of US-hosted model versions go too far.
Technical Details
- AI gateways such as OpenRouter and Vercel AI Gateway route requests to the "best available" provider by default. Agencies could therefore end up using DeepSeek models unintentionally unless they constrain their providers.
- An AI software bill of materials does not record which tools developers used, so it cannot verify compliance with the "developed using" clause.
- Stated concerns include collection of prompts and responses, data flowing to servers in China, and the possibility that the model contains malware or vulnerabilities.
- A December 2025 report on the DeepSeek Android and iOS apps cited plaintext information leaks, links to servers run by Chinese tech firms, and a lack of SSL pinning. The article notes these are common mobile security problems.
- NIST found DeepSeek more vulnerable to prompt injection and easier to jailbreak than US models.
Remediation
- Inventory direct DeepSeek use, including apps, APIs and self-hosted models.
- Constrain AI gateway provider routing so DeepSeek models cannot be selected implicitly.
- Ask vendors to attest whether their products depend on or were developed with DeepSeek, bearing in mind the article's point that such attestation is hard to verify.
- Await DHS clarification on the scope of "developed using."
Linha do tempo
-
DHS orders all US federal civilian agencies to remove DeepSeek and DeepSeek-derived products
ler a análise desta fonte ocultar
The US Department of Homeland Security issued an order directing federal civilian agencies to stop using products from Chinese AI lab DeepSeek and to remove existing implementations. The order also covers "DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." That wording is vague and hard to comply with. It is unclear whether it covers ongoing API access to DeepSeek models or any software written with DeepSeek's help. The move extends earlier bans by DISA (January 2025), the US Navy, NASA, the US House of Representatives and several US states. Security expert Katie Moussouris of Luta Security called a ban on DeepSeek's own app and API workable, but said the third-party clause and the inclusion of US-hosted model versions go too far.
Technical Details
- AI gateways such as OpenRouter and Vercel AI Gateway route requests to the "best available" provider by default. Agencies could therefore end up using DeepSeek models unintentionally unless they constrain their providers.
- An AI software bill of materials does not record which tools developers used, so it cannot verify compliance with the "developed using" clause.
- Stated concerns include collection of prompts and responses, data flowing to servers in China, and the possibility that the model contains malware or vulnerabilities.
- A December 2025 report on the DeepSeek Android and iOS apps cited plaintext information leaks, links to servers run by Chinese tech firms, and a lack of SSL pinning. The article notes these are common mobile security problems.
- NIST found DeepSeek more vulnerable to prompt injection and easier to jailbreak than US models.
Remediation
- Inventory direct DeepSeek use, including apps, APIs and self-hosted models.
- Constrain AI gateway provider routing so DeepSeek models cannot be selected implicitly.
- Ask vendors to attest whether their products depend on or were developed with DeepSeek, bearing in mind the article's point that such attestation is hard to verify.
- Await DHS clarification on the scope of "developed using."