The US Government Couldn't Keep DeepSeek Out. Can You?

DHS has ordered DeepSeek out of every federal civilian agency, along with any product built on it. The order arrived 21 months after federal staff started using it. By then the prompts were already gone, data was already shared, and nothing in the order can bring them back.

Background: Beyond the Headlines

On October 20, the Department of Homeland Security published an order requiring every federal civilian agency to remove DeepSeek, its affiliates' products and any third-party product or service "developed using DeepSeek implementations.".

The order isn't the alarming part. The timeline is.

• January 2025. DeepSeek releases R1. Within days, Pentagon staff are using the chatbot on work computers, and they keep using it for days before the Defense Information Systems Agency blocks it.
• The following weeks. The Navy, NASA, the House and the Commerce Department restrict it, one at a time. A bill to ban DeepSeek on all government devices is introduced in February. It never makes it out of committee.
• July 24, 2026. DHS signs the civilian-wide order. Nobody outside the government is told.
• October 19 and 20, 2026. The order is made public, 28 days after the window for agencies to request exceptions had already closed.

That's 21 months from first use to a government-wide mandates. These are organizations with dedicated security teams, a formal supply chain council and some of the strictest acquisition rules anywhere. They had stated policies against exactly this. It happened to them anyway.

Meanwhile, the private sector was heading the other way. In June 2026, DeepSeek topped Ramp's list of trending software vendors as US businesses looked for cheaper alternatives to American AI providers.

To be fair, the order covers federal civilian systems, not private companies. Critics argue that parts of it are too broad to enforce, particularly for copies of the models hosted in the US. That's a reasonable debate. It won't help you if your data is already on the wrong side of it.

Three Things That Should Worry You

1. It got in before anyone wrote a rule. This is the pattern, not the exception. A new model lands, it's free or cheap, and it's in use across an organization within days. Policy shows up months later, if it shows up at all. The government's gap was 21 months. What's yours? Across FireTail's customers, the single most common block policy is "Use of AI Provider in a Risky Jurisdiction," with DeepSeek included on the list. Nobody writes that rule for a tool nobody is using.
2. The data never comes back. Anything typed into deepseek.com or sent to DeepSeek's API goes to DeepSeek's servers, and its privacy policy says user data is stored in China. Those servers have had their own problems. In January 2025, Wiz found a DeepSeek database open to the internet with no authentication, holding more than a million lines of logs that included chat history and secret keys. A ban stops tomorrow's prompts. It does nothing about last year's. All those government chats are in the current version of that database. There is no recall button.
3. The history follows you. Justin Daniels of Baker Donelson calls it the "fruit of the poisonous LLM." Swapping the model out later doesn't erase the fact that a product may have been built on it, and customers are starting to ask. If you sell to federal agencies, or to a company that does, the FAR clause behind these orders gives you three business days to report a covered product once you identify it. It flows down to subcontractors at every tier, and the standard is a "reasonable inquiry." Not knowing is not a defense.

It Doesn't Only Come In Through the Front Door

When most security teams hear "DeepSeek," they think of the chatbot. Block the website and move on. That's the one door you can see.

• The website and the app. An employee pastes in a contract, a customer list or a block of code, and it leaves for DeepSeek's servers.
• Code written by DeepSeek Like most LLMs, DeepSeek can build software applications. However, DeepSeek has been demonstrated to write more vulnerable code for entities not aligned with China.
• Apps built on DeepSeek. A service calls DeepSeek's API because it was cheaper. A prompt sits in a repo next to a DeepSeek SDK import. An agent is built on a DeepSeek model and handed tools.
• Your cloud. DeepSeek-R1 is available in Amazon Bedrock, so a developer can deploy it inside your own account without ever visiting deepseek.com. Hosting it yourself keeps the data with you, but the model's behavior comes along. NIST found that agents built on DeepSeek's most secure model were on average 12 times more likely than the US frontier models it tested to follow malicious instructions planted in their inputs. In simulation, hijacked agents sent phishing emails, downloaded and ran malware and exfiltrated login credentials. That travels with the weights.
• Your AI gateway. Gateways such as OpenRouter and Vercel AI Gateway pick a provider for you by default. A team can land on DeepSeek without ever choosing it.
• Your vendors. The product you bought may be built on DeepSeek, or built using DeepSeek, and you can't look inside it.

That's six ways in. Most organizations are watching one, if they're watching any.

Even the government's own fix starts with visibility. Until removal is complete, the order tells agencies to monitor traffic in and out of their systems, increase logging, tighten controls on data leaving and flag anything unusual. First find out what is flowing, then stop it.

Do You Know What You Have?

Sooner or later, someone will ask you about DeepSeek by name. A customer's security questionnaire. An auditor. Your board. A contracting officer with a three-day clock. The questions will be simple. Where is it running? Who is using it? What did they send? When did you first know?

FireTail answers those across your workforce, cloud and code. On the workforce side, DeepSeek appears in your AI platform inventory like any other tool, with the number of employees using it, the volume of usage, and every prompt in a full audit trail. Every interaction is attributed to a person and a device, with the prompt kept, so what went to DeepSeek is something you read rather than guess. One rule blocks it at the browser and the endpoint, and every block is logged.

In your cloud and code, FireTail discovers deployed models, including a DeepSeek-R1 on Bedrock that nobody filed a ticket for, and scores its risk. Model scanning then probes it. Against DeepSeek-R1, the latent injection protection probe failed in 28 of 28 runs. In your repositories, FireTail finds DeepSeek SDK calls and hardcoded prompts down to the file and line, and maps each agent to the models it calls.

Every discovered model carries a first-seen date, and every interaction carries a timestamp. The record starts the day FireTail is connected, which is the argument for connecting it before someone asks.

The Real Takeaways

• Assume it's already in. The government had policies and it still got in. Look before you write the rule.
• A ban only works forward. Find out what has already gone out, and keep a record from here on.
• Look past the website. APIs, repositories, cloud accounts, gateways and vendors are all doors. Pin the providers on any gateway your teams use.
• Decide each path separately. Hosted DeepSeek, open weights in your cloud and vendor products carry different risks.
• Ask your vendors now. Which models are in the product, and do you get to approve a swap?
• Know your clock. If you're anywhere in a federal supply chain, three business days starts when you find it.

Federal agencies got the rule after the model was already inside. You can get the inventory first.

Want to know where DeepSeek, or any other model, is running in your company? FireTail can help. Schedule a demo and see it across your workforce, cloud and code.

‍