🎉 New here? Use code WELCOME10 for 10% off any plan at checkout
All labs
Sourced incident record

DeepSeek

DeepSeek · Hangzhou, China · founded 2023 · DeepSeek-V3 / V4, DeepSeek-R1, open-weight releases

DeepSeek's security notes centre on an exposed database found by external researchers and on the rapid community "abliteration" of its open weights into refusal-removed offensive-security builds.

Each entry summarises what a named outlet reported and links the source. This is commentary on published reporting, not PlayCISO’s own allegation; severity and category are our classification of the reported facts, not a legal conclusion.

Reported incidents (2)

Open weights rapidly abliterated into refusal-removed buildsMedium
2026·Open-weight misuse

DeepSeek open-weight releases are among those quickly turned into refusal-removed ("abliterated") offensive-security models and republished on Hugging Face. This is a property of open weights and the community, not a DeepSeek action; PlayCISO analysed one such build.

PlayCISO analysis
Publicly exposed database found by WizHigh
2025-01·Data exposure

Security firm Wiz reported it found a publicly accessible DeepSeek database (a ClickHouse instance) exposing chat history, API keys and backend details, reachable without authentication. Wiz disclosed it and DeepSeek reportedly secured it.

Wiz Research

PlayCISO coverage

DeepSeek-V4.1-Flash "Abliterated Cybersecurity Unleashed": What It Is and the Risk It CreatesAbliterated Models Explained: What Refusal-Removed LLMs Like GLM-5.3-Cybersecurity Mean for Your Threat Model

Defend against this

Abliterated Model RiskScore a refusal-removed model before it runs anywhere.Model Risk ScannerVet a model artifact before it enters your environment.Prompt Injection LibraryStudy the injection & jailbreak techniques these agents used.
DeepSeek — Security Incident Tracker · PlayCISO