When you type something into an AI chatbot, where does it go? The answer turned out to be public record, and it still shapes how security experts judge every AI service today.
In late January 2025, a cloud security company called Wiz Research ran a routine external scan of DeepSeek's infrastructure. DeepSeek was the biggest story in tech at that moment; its R1 model had just matched OpenAI's best reasoning model at a fraction of the cost, and Nvidia had lost roughly $600 billion in market value in a single day on the news. One week into that fame, Wiz found the company's entire internal data sitting behind an unlocked door.
They found it in minutes. What happened next is why DeepSeek remains a case study in AI security, and why governments are still banning it from official devices.
An Open Database With No Password
Wiz's researchers mapped DeepSeek's internet-facing systems and found about 30 subdomains. Most looked normal: chatbot pages, status pages, API documentation. Then they went past the standard web ports (80 and 443) and checked the non-standard ones.
Two hosts, oauth2callback.deepseek.com and dev.deepseek.com, were listening on ports 8123 and 9000. Those ports belong to ClickHouse, an open-source database built for analyzing large volumes of log data. DeepSeek had bound its internal ClickHouse cluster to the public internet with no authentication at all. Anyone with a browser could open the database's web interface and run arbitrary SQL queries against it.
Nobody needed stolen credentials or an exploit chain. The door was standing open.
What Was Inside
The database held a table called log_stream with more than one million log entries, going back to January 6, 2025. The logs contained:
- Plaintext chat history — actual conversations real users had with DeepSeek's chatbot
- API keys and secrets for DeepSeek's own backend services
- Backend details: internal API endpoint names, directory structures, operational metadata
That first bullet is the one that matters. If you chatted with DeepSeek between January 6 and 28, 2025, your conversation was stored in plaintext in a database any stranger on the internet could query. Wiz also noted that depending on configuration, an attacker could use ClickHouse's built-in file functions to read files straight off the server itself.
Full database control also opened a path for privilege escalation inside DeepSeek's environment. The company's entire internal environment was potentially one unauthenticated query away from compromise.
The Fix Took 30 Minutes — The Distrust Didn't Fade
To DeepSeek's credit, the response was fast once someone knocked. Wiz contacted every DeepSeek email address and LinkedIn profile it could find, and the company locked the database down within about half an hour. DeepSeek never publicly responded to the disclosure.
Wiz's CTO, Ami Luttwak, put the finding in perspective for WIRED: "The effort level is very low and the access level that we got is very high... I would say that it means that the service is not mature to be used with any sensitive data at all."
Wiz stopped at enumerating table names and didn't run intrusive queries, citing responsible research practice. A darker actor could have quietly dumped a million-plus users' conversations and DeepSeek's own secret keys without leaving much trace.
What Happened After
The leak set the tone for how DeepSeek has been treated ever since. In the months that followed, the security posture never stopped making headlines:
- Australia banned DeepSeek from all government devices (February 2025), citing security risk, and other governments including South Korea, Italy, Taiwan, and Texas followed with their own bans or restrictions on government systems.
- New York State banned DeepSeek on government devices and networks, followed by SUNY-system universities, over data-security concerns.
- In a September 2026 advisory, CISA named DeepSeek among Chinese AI companies used to extract billions of tokens in industrial-scale harvesting campaigns tied to Chinese government interests.
- DeepSeek keeps appearing in every "major AI data leaks" roundup, two years on, as the reference incident for how badly AI platform security can fail.
Twenty-one months later, the database story remains the clearest evidence for the bans: this was a company that couldn't password-protect its front door, being trusted with the world's conversations.
The Lesson the AI Industry Keeps Failing
DeepSeek isn't uniquely careless. This is the pattern of the entire AI gold rush: companies race a model to market, ship their platform fast, and skip the boring work of port scans, database authentication, and cloud configuration review. The model architecture gets a research paper. The infrastructure gets an afterthought.
Wiz's own conclusion was blunt. The biggest AI security risks aren't futuristic prompt-injection science fiction; they're mundane database misconfigurations, the same class of mistake that has caused breaches since the dawn of cloud computing, now holding a million plaintext conversations.
Every time you type something into a hosted AI service, you bet on that company's security basics. The privacy policy is the smaller part of that bet. The config files are the bigger one.
What You Should Do
1. Treat hosted AI chats as potentially public. Anything you type into a cloud AI tool, whether business plans, client information, or personal matters, assumes that provider's competence. Never paste credentials, financial records, client data, or anything you'd be embarrassed to see in a log stream.
2. Know where your data actually lives. If a tool says "AI-powered," ask where inference runs and what gets logged. Most services log your prompts. The log stream is where your data ends up.
3. Consider running models on hardware you control. Open-weight models now run locally on surprisingly modest hardware. When the AI runs on your own machine, there's no provider log stream to leak; the conversation ends at your network and never leaves it. This is why every serious privacy-minded household now keeps a local model around for anything sensitive.
4. Check your own walls. The mistake DeepSeek made is the same one small businesses make constantly: a service bound to the wrong interface, a default password that never changed, a port nobody remembered opening. It's a five-minute discovery for an attacker, and it happens to far more SMBs than anyone hears about.
AI services will keep promising better privacy policies. The DeepSeek incident proved they sometimes struggle with the password on a door. The one variable you control is where your own data sits.