DeepSeek’s AI restricted by ‘hundreds’ of companies and govt agencies in days
Sign up now: Get ST's newsletters delivered to your inbox
Companies and government agencies around the world are moving to restrict their employees’ access to the Chinese AI app.
PHOTO: REUTERS
Follow topic:
New York – Companies and government agencies around the world are moving to restrict their employees’ access to the tools released recently by the Chinese artificial intelligence start-up DeepSeek, according to the cyber-security firms hired to help protect their systems.
Hundreds of companies, particularly those associated with governments, have worked to block access to DeepSeek due to concerns about potential data leaks to the Chinese government and what they view as weak privacy safeguards, said Mr Nadir Izrael, chief technology officer of cyber firm Armis, referring to the start-up’s own clientele.
Most customers of Netskope, a network security firm that companies use to restrict employees’ access to websites, among other services, are similarly moving to limit connections.
Roughly 70 per cent of Armis customers have requested blocks, the company said, and 52 per cent of Netskope clients are blocking access to the site entirely, according to Mr Ray Canzanese, director of Netskope’s threat labs.
“The biggest concern is the AI model’s potential data leakage to the Chinese government,” Mr Izrael said. “You don’t know where your information goes.”
Anxieties around DeepSeek have mounted since the weekend when praise from high-profile tech executives including Mr Marc Andreessen propelled DeepSeek’s AI chatbot to the top of Apple Store app downloads.
Chief among those worries is the fact that DeepSeek states in its privacy terms that it collects and stores data in servers in China, adding that any dispute on the matter would be governed by Chinese government law.
DeepSeek did not respond to a request for comment.
It was not immediately clear how many US Defence Department employees sought to access DeepSeek. There has been no indication that a data breach or security incident has occurred in connection with DeepSeek usage at the Pentagon.
According to DeepSeek’s privacy policy, the company collects users’ keystrokes, text and audio input, uploaded files, feedback, chat history and other content for the purpose of training its AI models, and may share that information with law enforcement and the public authorities at its discretion.
Cyber researchers who set out to probe DeepSeek’s security said they found a publicly accessible database belonging to the company that contained internal data.
The database included some DeepSeek chat history, backend details and technical log data, according to Wiz, the cyber-security start-up that Alphabet sought to buy for US$23 billion (S$31.13 billion) in 2024.
Wiz said DeepSeek secured the information when it reported the discovery.
DeepSeek and the increased adoption of other generative AI services are poised to accelerate the development and sales of cyber-security services, according to research from Bloomberg Intelligence. CrowdStrike Holdings, Palo Alto Networks and SentinelOne are among the companies that could benefit from the trend, said Bloomberg analysts Mandeep Singh and Damian Reimertz.
Already, governments are scrutinising DeepSeek’s privacy controls. Ireland’s Data Protection Commission, which enforces the European Union’s privacy regulations on many of the world’s largest technology companies, on Jan 29 said it had requested information from DeepSeek to determine if the company is properly safeguarding user data.
The Italian data protection watchdog also said it had contacted Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence seeking information on how DeepSeek’s app handles information about Italian users. Italian officials asked whether their citizens’ personal data was transferred to China, and gave the company 20 days to respond.
Britain’s Information Commissioner’s Office said in a statement that generative AI developers must be transparent about how they use personal data, adding that it would take action whenever its regulatory expectations are ignored.
US officials and think-tanks have warned that Chinese national security laws allow the government there to gain access to encryption keys controlled by companies operating in the country and compel them to assist in intelligence-gathering activities. These laws were at the heart of the US government’s case for banning China-based ByteDance’s TikTok platform, with national security officials warning that its Chinese ownership offered Beijing a way into Americans’ personal information.
TikTok has denied that it presents any such threat. US President Donald Trump vowed to come up with a deal that would allow the platform to continue to operate in the US shortly after he took office in January.
Mr Mehdi Osman, chief executive of US software start-up OpenReplay, is among the business leaders who opted not to use DeepSeek’s API service over security concerns. He warned that the firm’s extraordinarily low prices still threaten to lure developers away from OpenAI in the coming months.
Cybercrime researchers are meanwhile warning that DeepSeek’s AI services appear to have fewer guardrails around them to prevent hackers from using the tools to, for example, craft phishing e-mails, analyse large sets of stolen data or research cyber vulnerabilities.
“With very little effort, attackers will be able to make code modifications leading to increased scale and velocity of cyber and fraud attacks,” said Mr Levi Gundert, chief security and intelligence officer of cyber-security firm Recorded Future. BLOOMBERG
