DHS orders civilian agencies to remove DeepSeek and any third-party product built on its models

The Department of Homeland Security (DHS) has ordered federal civilian agencies to remove products made by DeepSeek, the Chinese AI lab, from their IT systems and to stop buying them, The Hill reported. Homeland Security Secretary Markwayne Mullin signed the order on July 24, and it appeared on the Federal Register website on Monday.

The scope reaches past DeepSeek's own app and application programming interface. The order covers DeepSeek and DeepSeek-affiliate products, and also "third-party products and services developed using DeepSeek implementations," according to BankInfoSecurity. The AI Post channel noted in its summary of the order that hosting the model in the US does not exempt a deployment. IBTimes read the clause as covering tools built on DeepSeek's open-weight models.

DHS issued the order under the Federal Acquisition Supply Chain Security Act of 2018 (FASCSA), after reviewing a recommendation from the Federal Acquisition Security Council (FASC). The department says DeepSeek's models present "multiple threat vectors." It argues that the Chinese government has "extensive authority" to access private infrastructure, that agency use could send data on federal employees and contractors to Beijing, and that the models themselves might contain malware or security flaws (Korea JoongAng Daily).

That list contains two separate arguments. The data-exfiltration argument applies to DeepSeek's hosted service, where prompts travel to servers DeepSeek controls. It does not apply to weights served on a US-controlled graphics processing unit (GPU). The coverage of derivative products therefore depends on the second argument, that the weights themselves could carry hidden behavior. DHS asserts that risk, but the published reporting cites no demonstrated backdoor in DeepSeek's weights. The reporting also does not explain how the order treats fine-tuned versions, models distilled from DeepSeek's outputs, or models that reuse DeepSeek's published architecture.

Beijing has not issued a direct response to this report. When DHS signed the order in July, Liu Pengyu, a spokesperson for China's embassy in Washington, called congressional allegations of technology theft "nothing but slander and smears." China's Foreign Ministry spokesperson Guo Jiakun said China opposed "the broadening of the concept of national security," CyberScoop reported.

The order governs what runs inside federal agencies. It does not stop attackers from using DeepSeek's models as tools elsewhere. In a separate offensive campaign reported this week, a Chinese-speaking actor reached DeepSeek, Kimi and Anthropic's Claude Opus 4.6 through the OpenRouter aggregator, Computing reported. That campaign used models from both the United States and China.