Federal civilian executive-branch agencies have been told to rip DeepSeek out of their computer systems entirely, with the Department of Homeland Security warning that the Chinese AI company's products could funnel sensitive U.S. government data straight to Beijing. The order bans not just DeepSeek's own apps, but any future purchases of its technology by those agencies; it excludes Department of Defense and intelligence-community procurements, as well as national security systems. It reaches further than most people might expect, sweeping in third-party software quietly built on top of DeepSeek's models.
According to meritalk.com, DHS ordered federal civilian executive-branch agencies to immediately remove AI products and services developed by DeepSeek from their IT systems and prohibit any future procurements. The same outlet reports the order covers products built by Hangzhou DeepSeek Artificial Intelligence Co., its affiliates, and any third-party offerings constructed using DeepSeek's underlying technology — a detail that could make compliance messy, since it is not always obvious which software was built on DeepSeek's back end in the first place.
That ambiguity is exactly what has The Register flagging a practical headache: it is not clear which third-party products and services have been developed using DeepSeek's wares, the outlet notes, meaning agencies may struggle to even identify everything they're supposed to pull.
Treasury, State and Justice Among Agencies Covered
Per CNBC, the directive applies to federal civilian agencies including the Treasury, State and Justice departments, as part of what the outlet describes as a Trump administration effort banning DeepSeek-related technology from federal civilian IT systems over cited security concerns. The Defense Department and the intelligence community are carved out of the ban, since the order applies specifically to civilian executive-branch procurements.
The exclusion is also spelled out by meritalk.com, which reports the order applies to federal civilian executive branch agencies but excludes procurements by the Department of Defense and the intelligence community, as well as national security systems. Those exempted arms of government already have their own, separate restrictions in place.
DHS Cites Malware Risk and Data Flowing to China
The justification laid out by Homeland Security goes beyond generic caution. Per BankInfoSecurity, DHS warned that the models themselves may contain malware or other security vulnerabilities — language that treats DeepSeek's software less like a foreign competitor and more like a potential Trojan horse sitting on government networks.
As reported by Politico, DHS said DeepSeek presents multiple threat vectors and that its use may result in the transfer of sensitive data to China. CyberScoop, in its own review of the order, reported that DHS said the data could produce actionable intelligence on U.S. persons and/or government programs — a framing that casts the risk not as abstract cybersecurity hygiene but as a potential window into the lives of American citizens and the inner workings of federal programs.
DHS also grounded its order in existing law, with CyberScoop noting the notice cites the Federal Acquisition Supply Chain Act and a review by the Federal Acquisition Security Council — the kind of bureaucratic machinery that federal agencies typically invoke only when they intend a restriction to stick.
Confusion Over When the Order Was Actually Signed
Exactly when this all started remains murky. CyberScoop reported on a letter from Secretary of Homeland Security Markwayne Mullin ordering the exclusion of DeepSeek products on June 26, while Econotimes reported that the order, signed by Mullin, lists July 24, 2026, as its original release date. Whichever date is accurate, meritalk.com reports that DHS made the order public on October 19 through a Federal Register notice scheduled for publication the following day — meaning the directive sat largely unannounced for weeks or months before surfacing this week.
Agencies Have 60 Days to Beg Off
The ban isn't entirely absolute. Agencies that believe they have a compelling reason to keep using DeepSeek products can ask for an exception, though the bar appears high. BankInfoSecurity reports that the order sets a 60-day window from its issuance for agencies to request exceptions, with written justification required and the Cybersecurity and Infrastructure Security Agency handling the decisions.
This federal crackdown doesn't emerge from nowhere. The Defense Information Systems Agency began blocking DeepSeek on Pentagon networks back in January 2025, and The Register notes that similar moves followed from the Navy, NASA and the House of Representatives. The Commerce Department also barred DeepSeek from government devices, according to Politico's reporting.
States got there even earlier. BankInfoSecurity reports that Texas has banned DeepSeek from state-issued devices since January 2025, with New York and Virginia following within weeks, while Australia, South Korea and Taiwan also keep it off government systems, per the same outlet. A congressional push for a federal statute — the No DeepSeek on Government Devices Act, introduced by Representatives Darin LaHood and Josh Gottheimer in February 2025 — never made it out of committee, The Register notes, leaving executive-branch orders like this one to do the work legislation didn't.
A Cheap Rival Caught in a Bigger Fight
Part of what makes DeepSeek a target is exactly what made it a sensation in the first place: Politico describes its open-weight models as rivals to domestic frontier AI systems, but at a lower cost — the same low-cost competitiveness that rattled American AI stocks when the company first broke through. That tension between DeepSeek's technical appeal and the security concerns now surrounding it sits at the center of the broader standoff over Chinese AI access to U.S. government systems. Separately, a Government Accountability Office review found that federal officials across multiple agencies, including DHS, DOD and NASA, have flagged broader generative-AI risks such as biased or false outputs and cybersecurity vulnerabilities — concerns that extend well beyond any single vendor but help explain why Washington has grown warier of AI tools with unclear security pedigrees.
