US civilian agencies ordered to purge DeepSeek AI tools

Why DHS ordered an immediate purge

The mandate from the Secretary of Homeland Security blocks technology from Hangzhou DeepSeek Artificial Intelligence Co. across civilian executive branches, including the Treasury, State, and Justice departments. Crucially, the exclusion applies not just to standalone DeepSeek applications, but also to third-party enterprise tools that incorporate DeepSeek models beneath the surface.

DHS noted that DeepSeek's models introduce multiple threat vectors inside government networks. The agency highlighted that standard deployment requires users to supply personally identifiable information and proprietary data, which can then be used to track and digitally fingerprint specific operators.

Under China's national security laws, domestic companies can be compelled to hand over stored user records to authorities. Federal officials warned that such data pools could yield actionable intelligence on US government personnel and ongoing federal operations.

Mobile flaws and widening hardware scrutiny

The security assessment also highlighted technical vulnerabilities inside DeepSeek's codebase itself, pointing to open-source security findings that uncovered multiple critical vulnerabilities in the vendor's iOS application. Officials raised concerns that unpatched code could act as an ingress point for malware.

While Chinese foreign ministry spokesperson Mao Ning pushed back by accusing Washington of the politicization of technology, the move reflects a steady tightening of restrictions that began earlier. The Defense Information Systems Agency banned DeepSeek in January 2025, the Commerce Department instructed employees to abandon the tool in March, and congressional measures restricted it across intelligence systems late last year.

Federal scrutiny on foreign hardware and developer pipelines continues to mount. Beyond software purges, the Federal Communications Commission is preparing a vote to bar Chinese testing laboratories from certifying hardware bound for the US market—a supply chain where 82% of electronics underwent compliance testing in China last year. For enterprises rethinking their foundational setups, MiniMax unmasking its M3.1 Flash release earlier this year showed how rapidly alternative foreign models proliferate across enterprise networks before security audits can even begin.

What it means for enterprise users

The directive strictly targets US federal civilian agencies and contractors touching government systems, leaving commercial consumer access in the US, UK, and EU legally operational for now. However, commercial vendors selling software-as-a-service packages to federal bodies will need to audit their backends immediately to ensure no DeepSeek APIs power their sub-processors.