AI GovernanceComplianceShadow AI
The US Department of Homeland Security has ordered federal civilian agencies to stop using DeepSeek products. According to BleepingComputer, the "notice of order" was published in the Federal Register on 20 October 2026 (document 2026-21447). It covers DeepSeek's own products, those of its affiliates, and third-party products and services built using DeepSeek technology. It is not a general ban on private or consumer use.
The order cites concern that the Chinese government could access DeepSeek infrastructure, collect personal information, track users, or receive sensitive government data. It also raises the possibility of malware in DeepSeek models, pointing to a February 2025 NowSecure report on the DeepSeek iOS app that found unencrypted data transmission, weak encryption, insecure local storage, and data sharing with ByteDance.
The order does not say any federal system was actually compromised. It is a risk-based exclusion, not an incident response.
Removing an app someone installed is easy. The phrase "third-party products and services built using DeepSeek technology" is not. A model can sit behind a vendor's summarisation feature, a coding assistant's backend, a support chatbot, or an open-weights model fine-tuned and repackaged under another name. Procurement paperwork rarely says which model is underneath.
That is a problem well beyond government. Customers, auditors and insurers tend to copy federal restrictions, and similar questions will show up in vendor questionnaires: which models do your staff and your suppliers send data to, and can you prove none of them are on a restricted list? We covered a related exposure in the DeepSeek Harness sandbox escape, where the risk came from the tool wrapped around a model rather than the model itself.
A ban only works if people have somewhere sanctioned to go instead. Staff who cannot use one model will often reach for another consumer app on a personal account, which is exactly where restricted models sneak back in. Obichat is a managed multi-model chat workspace, built on LibreChat, that runs in your own tenant, either as SaaS on Obiguard-managed infrastructure or as a private deployment inside your AWS, Azure or GCP account.
Administrators choose which models each workspace can reach, so the approved list is something the product enforces rather than a policy document. Every workspace keeps an exportable activity log of conversations and events, which turns "who used what model last quarter?" into a query instead of an investigation. Obichat does not detect DeepSeek hidden inside someone else's software, so the vendor questions above still need asking, but it removes the largest source of unknown usage: employees improvising their own tools.
If a regulator, customer or insurer asked tomorrow which AI models touch your data, could you answer from a list rather than a survey?
See how Obichat works or talk to us about an approved AI workspace for your organisation.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →