“DeepSeek AI models present multiple security threat vectors to U.S. federal IT systems.” — U.S. Department of Homeland Security. Our verdict: True.

What we found

The evidence

• Supports the claim

  The Department of Homeland Security issued an order on 20 October 2026 mandating the exclusion and removal of DeepSeek products from federal civilian IT systems. [1]

• Supports the claim

  The National Institute of Standards and Technology found that DeepSeek software is significantly more vulnerable to hijacking and jailbreaking than U.S. reference systems. [2]

• Supports the claim

  The National Institute of Standards and Technology reported that DeepSeek's security shortcomings pose risks to U.S. national security. [3]

• Supports the claim

  A security blog reported that DeepSeek software has technical vulnerabilities such as susceptibility to jailbreaking, and that it has been involved in incidents such as exposed databases. [4]

• Background

  The 2026 Economic Report of the President discusses artificial intelligence but does not mention DeepSeek or a federal ban, so it neither supports nor contradicts the claim. [5]

What we could not confirm

• The order applies to federal civilian agencies; it is not explicitly confirmed to cover all federal IT systems, such as defence or intelligence systems.
• The evaluations of DeepSeek's vulnerabilities date from 2025 and are not directly linked to the specific 2026 order.
• The claim refers to multiple threat vectors; hijacking and jailbreaking are documented, but other possible vectors, such as data poisoning or supply chain risks, were not assessed.
• The order we reviewed is a public inspection document, so the final published rule may differ.

How we checked

We looked at the Department of Homeland Security order, official National Institute of Standards and Technology evaluations of DeepSeek, a security company blog post, and the 2026 Economic Report of the President. We reviewed 5 relevant sources.