DHS says the models 'may contain malware' — and every agency must comply

In its notice ordering DeepSeek out of federal civilian IT systems, the Department of Homeland Security warned that the models themselves may contain malware or other security vulnerabilities. That warning sits alongside concerns that use by U.S. government employees or vendors could transfer sensitive data to China and could produce actionable intelligence on U.S. persons and government agencies.

The order requires civilian agencies to remove DeepSeek and DeepSeek-affiliate products and to stop acquiring them, and it extends to third-party products and services developed using DeepSeek. A July DHS memo made public the same day told agencies to monitor traffic flows in and out of government websites for DeepSeek-related risks.