DeepSeek, Huge Security Flaw: Over 1 Million Chats And Other Data Exposed Online

An investigation by Wiz Research has revealed a significant vulnerability in the databases of DeepSeek, the Chinese artificial intelligence startup. The exposure put over a million records containing sensitive user information at risk.

The DeepSeek-R1 language model has been in the news in recent days. But not all the news is good. A recent investigation has, in fact, brought to light a serious security flaw that has publicly exposed two databases containing highly sensitive information

The revelation has further called into question the reliability of the data protection measures adopted by the company. In an area in which there were already more than one doubt .

Specifically, Wiz Research discovered unsecured ClickHouse instances during an assessment of DeepSeek’s external infrastructure, revealing a trove of sensitive information .

 The exposed data included over a million log entries containing unencrypted user chat history, API keys, backend details, and operational metadata . This information was accessed through simple SQL queries via a web interface. With no authentication required.

DeepSeek, discovers trivial security flaws in the infrastructure

The scope and nature of the data exposed is quite alarming: the “log_stream” table in the databases contained sensitive internal logs dating back to January 6, 2025, including user queries to the DeepSeek chatbot , keys used by backend systems to authenticate API calls, internal information about the infrastructure and services, as well as various operational metadata.

 According to Wiz Research, “this level of exposure poses a serious security risk to DeepSeek and its end users,” underscoring the significance of the situation.

The implications of this exposure are many: not only could an attacker have retrieved sensitive logs and chat messages in plain text . But they could have potentially exfiltrated unencrypted secure passwords, local files, and confidential data straight from the server.

The configuration used in the databases allowed for potentially intrusive queries. Although the Wiz researchers limited their exploration to keep their research within ethical constraints. The good news is that DeepSeek responded to the allegations in a timely manner. Addressing the exposure and making the databases no longer publicly accessible.

However, it is currently unknown whether Wiz researchers were the first to discover this vulnerability. Or whether malicious actors have already exploited the misconfiguration to gain access to the significant amount of sensitive user data left exposed.

 The breach is part of a crowded field of data security in the AI ​​sector. And it becomes even more significant considering the origin of R1’s developer. As a Chinese company, Deepseek is subject to potentially aggressive data access requests from the Chinese government. Which adds another layer of complexity to the situation.https://youtu.be/s1QUmTQ3nyw?si=ROcbq_PbyfTcojvt

Leave a Reply

Your email address will not be published. Required fields are marked *