U.S. Government Bans DeepSeek AI and Orders Federal Agencies to Remove All Related Tools

The U.S. Department of Homeland Security has ordered federal civilian agencies to stop buying DeepSeek products and remove related technology from their IT systems. The action covers products from Hangzhou DeepSeek Artificial Intelligence Co., Ltd., its affiliates, and third-party products and services developed using DeepSeek implementations.

The notice was filed for public inspection on October 19, 2026, with publication scheduled for October 20. It creates a government supply chain restriction, not a nationwide ban on private use. Businesses and individuals are not prohibited from using DeepSeek by this order.

U.S. Government Bans DeepSeek AI

The DHS notice sets out two requirements. Federal civilian agencies must exclude DeepSeek and affiliate IT products and services from procurement. They must also remove DeepSeek and affiliate products, including covered third-party implementations, from agency technology systems. That second requirement makes the order broader than a block on new purchases.

The third-party provision is especially important for security teams. An agency may use DeepSeek through another supplier rather than through an application carrying the DeepSeek name. A review limited to branded chat tools could therefore miss products covered by the removal requirement. Agencies need to establish what powers their existing AI services.

The notice does not provide a public list of every affected third-party vendor or product. Suppliers and agency buyers will need to assess whether particular tools use DeepSeek implementations, rather than assuming that a different product name places them outside the order. Contract records and technical documentation can help support that review.

For vendors serving civilian agencies, the order also raises a direct procurement question. They must understand whether their own AI features depend on technology that government customers must now exclude or remove.

DHS cites the Federal Acquisition Supply Chain Security Act of 2018, along with its implementing rules, as the legal basis. The department says the secretary acted after reviewing a recommendation from the Federal Acquisition Security Council and supporting evidence. The notice identifies affiliates through the definition in federal acquisition regulations at 48 CFR 2.101.

The action treats AI as a supply chain issue. For agencies, the question is no longer only whether a chatbot gives accurate answers or whether staff should upload sensitive files. They must also know which companies and underlying technologies support the software they buy, deploy, and connect to government systems.

A key distinction is that this is an exclusion and removal order, not a public report confirming a federal data breach. The published notice does not describe a specific intrusion, identify stolen government records, or establish that every DeepSeek deployment has leaked information. Those claims should not be inferred from the restriction alone.

Separate reporting has shown how attackers can misuse AI models. Cyber Security News previously covered hackers exploiting DeepSeek and Qwen models to develop malware, including efforts to bypass model safeguards. That reporting provides context about AI abuse, but it does not establish the evidence behind this DHS decision.

More recently, Cyber Security News reported on attackers using Codex and DeepSeek AI agents in a campaign against PaperCut servers. The report described AI-assisted exploit work and follow-up activity against vulnerable systems. Such cases show why model misuse attracts attention, while remaining separate from the government’s supplier exclusion process.

A practical response starts with an inventory of AI tools and their dependencies. Security and procurement teams should examine installed applications, hosted services, internal development projects, and supplier agreements for DeepSeek use. These are review priorities based on the order’s scope, not additional requirements quoted from the public notice.

Removing a visible application may not address a service that still routes requests to a DeepSeek model. Teams should check backend model settings and ask vendors to document the models used in their products. Where a covered service supports an important workflow, replacement planning should account for access controls, stored data, and service continuity.

Agencies should also keep a clear record of what they found, which suppliers they contacted, and which products they removed or replaced. That documentation can help distinguish a completed review from an assumption that no DeepSeek technology exists because employees do not use its public chatbot.

The DHS notice directs readers to the signed order in docket DHS-2026-0628 on Regulations.gov and lists CISA’s FASCSA Order Implementation Team as the contact. Agencies should consult that signed text for detailed implementation terms. The central security challenge is identifying covered technology across the full software supply chain, including products sold under another company’s name.

An EDR alert reveals an attack. But can it tell the full story? Discover how to reconstruct the attack timeline.

The post U.S. Government Bans DeepSeek AI and Orders Federal Agencies to Remove All Related Tools appeared first on Cyber Security News.