The U.S. Department of Homeland Security (DHS) is ordering federal civilian agencies to stop using DeepSeek products and remove them from government systems.
The order also covers products from the Chinese AI company's affiliates and third-party products and services built using DeepSeek technology.
DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd) develops large language models and offers a chatbot, API services, and models suitable for coding and reasoning tasks.
Its AI tools became extremely popular early on, but were but were soon followed by reports of security risks [1, 2, 3, 4] and concerns about the potential for Chinese authorities to access users’ conversations.
The DHS is now taking regulatory action to limit the use of DeepSeek and derivatives on critical systems in the United States, and has issued a notice of order for agencies to:
- Immediately exclude covered products from procurement, including approved-product lists and purchasing marketplaces.
- Immediately remove covered products from agency IT systems, or seek an exception.
- Submit any exception requests within 60 days of the order’s issuance, explaining the justification and proposed risk mitigations. CISA will review requests and issue written approvals or denials.
The order applies to federal civilian agencies within DHS’s authority and is not a general ban on private or consumer use.
DHS explained that the order stems from concerns about the Chinese government accessing DeepSeek infrastructure, collecting personal information and tracking users, and potentially transferring sensitive government data to China.
The document also raises concerns about potential malware in DeepSeek models, citing a February 2025 report from NowSecure that identified security vulnerabilities in the DeepSeek iOS app.
NowSecure examined the app and found unencrypted data transmissions, weak encryption algorithms, insecure local storage, user fingerprinting risks, and data sharing with ByteDance, the Chinese tech giant behind the TikTok short-form video platform.
The order was published in the Federal Register earlier today, a day after appearing on Public Inspection.
Executive agencies can request exceptions within 60 days of the issuance date of the order. For agencies that cannot comply with this order because of internal capability restrictions, CISA will provide the necessary technical assistance.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.