Supply-Chain Order Sweeps in Vendor Tools Running on DeepSeek Models
In a significant move that has raised concerns across federal networks, the U.S. Department of Homeland Security (DHS) has issued an order to federal civilian agencies enforcing the removal of all products associated with the Chinese artificial intelligence developer, DeepSeek. This action, announced on October 19, 2026, marks a stringent response to ongoing fears regarding cybersecurity threats posed by DeepSeek’s technology.
The DHS directive follows a growing trend over the past year and a half, during which well-known agencies such as the Navy and NASA proactively decided to block the use of DeepSeek’s chatbot in their operations. The underlying reason for this escalation stems from various assessments regarding DeepSeek’s models, which the DHS claims display "multiple threat vectors." Officials express particular concern that the deployment of these models could lead to the generation of actionable intelligence, potentially compromising sensitive information about U.S. persons and federal government agencies.
In its official statements, the Department of Homeland Security has warned that the AI models may harbor malware and other security vulnerabilities, creating potential gateways for cyber threats. The department further cautioned that federal employees or contractors utilizing DeepSeek’s services risk inadvertently transferring sensitive data to China—a fear compounded by the presence of DeepSeek’s servers in Chinese territory, where local laws permit state cyber and intelligence services to access privately owned infrastructures.
Markwayne Mullin, the Secretary of Homeland Security, enacted this ban under the Federal Acquisition Supply Chain Security Act of 2018. This law empowers the DHS secretary to exclude risky technologies from civilian agency systems, a capability shared with the defense secretary and the director of national intelligence, who can impose similar restrictions on military and intelligence networks. Notably, the Department of Defense has also utilized the law to place restrictions on other technology providers, reinforcing the growing unease surrounding foreign tech firms linked to national security risks.
The procurement ban explicitly applies to information technology products and services from Hangzhou DeepSeek Artificial Intelligence Co. and comprises third-party products and services developed with DeepSeek’s implementations—many of which are likely built around the company’s open-weight models. This comprehensive approach highlights the depth of concern within governmental circles regarding the potential repercussions of continuing to use DeepSeek technologies.
Alongside the removal mandate, agencies have been instructed to monitor their network traffic keenly for any signs of data exfiltration and to enforce stricter logging practices. This signifies a broader shift in how federal agencies may need to operate to safeguard sensitive information in a landscape increasingly fraught with cyber threats.
The implications of this directive are far-reaching. Texas has already taken steps to ban DeepSeek from state-issued devices since January 2025, with New York and Virginia following suit shortly thereafter. This pattern has extended beyond U.S. borders, with countries such as Australia, South Korea, and Taiwan also instituting bans on DeepSeek products, reflecting a global response to perceived risks associated with the firm.
Moreover, the House Select Committee on the Chinese Communist Party has characterized DeepSeek as a "profound threat" to U.S. national security. Citing a report from April 2025, the committee alleged that DeepSeek’s applications could be siphoning off data from American users, suggesting an alarming tendency for such technologies to exploit vulnerabilities and extract user data illicitly. Lawmakers have indicated that DeepSeek may have trained its AI models using outputs from U.S. AI systems, further complicating the legal and ethical landscape surrounding these technologies.
The DHS order provides agencies with a 60-day window to request exceptions, which will be reviewed and either approved or denied by the Cybersecurity and Infrastructure Security Agency (CISA). Additionally, companies that find themselves targeted by this exclusion order are afforded a 60-day period to contest the decision in the U.S. Court of Appeals for the District of Columbia Circuit.
The response from federal agencies and the DHS reflects a broader narrative in which safety and security concerns over foreign technology and potential espionage are being prioritized. As the landscape of technology evolves, so too does the need for rigorous scrutiny of products that may jeopardize the integrity of national security infrastructures. This order is a testament to the ongoing battle between advancing technology and safeguarding sensitive information in an era of persistent cyber threats.