DHS Directs Federal Agencies to Purge DeepSeek AI From Civilian IT Networks

Homeland Security mandates removal of DeepSeek tools and affiliated third-party software from all federal civilian agency systems.

Threat Times Intrusion DeskOctober 20, 20262 min read

Share LinkedIn Reddit

Illustration: A sleek black laptop sits on a sterile white desk with its screen displaying only abstract geometric shapes. — AI-generated illustration: Threat Times

Key points

The order covers DeepSeek products, affiliated entities, and third-party applications built on DeepSeek technology.
DHS cites multiple threat vectors, including potential data transfers to China and user tracking capabilities.
The directive applies to civilian agencies, excluding the Department of Defense and intelligence community.

The U.S. Department of Homeland Security has instructed federal civilian agencies to remove DeepSeek artificial intelligence products from their information technology systems. The directive also prohibits the acquisition of any new DeepSeek-related products or services, according to GBHackers.

This order, published in the Federal Register on October 20, 2026, targets Hangzhou DeepSeek Artificial Intelligence Co., Ltd. and its affiliated companies. DHS invoked the Federal Acquisition Supply Chain Security Act of 2018 to enforce these procurement exclusions and technology removal requirements across civilian agency environments.

Scope of the Ban

The directive extends beyond standalone DeepSeek applications to include third-party products and services developed using DeepSeek implementations. According to GBHackers, agencies must assess the underlying AI technology in any product rather than relying solely on supplier names or application branding. A third-party interface does not exempt a covered DeepSeek implementation from the removal mandate.

DHS stated that the order follows a review of recommendations from the Federal Acquisition Security Council. The department cited supporting evidence that DeepSeek models present multiple threat vectors, potentially allowing government employees or vendors to transfer sensitive information to the People’s Republic of China.

Affected Agencies and Timeline

The ban applies to federal civilian agencies, including the Treasury, State, and Justice departments, but excludes the Department of Defense. As Threat Times reported on October 20, 2026, this action aligns with broader restrictions on Chinese technology within U.S. government infrastructure. TechRadar noted that the order was originally issued in late July this year.

Previous restrictions have already targeted DeepSeek in other sectors. The Defense Information Systems Agency banned the tool in January 2025. The U.S. Commerce Department instructed its staff to stop using DeepSeek in March, according to TechRadar. Additionally, U.S. Congress restricted DeepSeek use in intelligence community systems late last year.

What should you do?

Security teams must conduct a comprehensive inventory of all AI tools and third-party applications within their networks. Organizations should verify whether any software relies on DeepSeek implementations, regardless of the vendor's name. Once the vendor provides an update or further guidance, agencies must ensure complete removal of identified components to maintain compliance.

What to do and how to stay safe: DeepSeek

Audit all installed AI applications and third-party services to identify any underlying DeepSeek technology.
Review procurement contracts for affiliated entities as defined in federal acquisition regulations.
Monitor official channels for additional guidance on compliance and removal procedures.
Ensure that no new acquisitions include products or services derived from DeepSeek implementations.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.