Security and Privacy Risks of DeepSeek: Censorship, Jailbreaks, and Bans (2026)

DeepSeek's models are cheap, capable, and open-weight. They are also the subject of a growing body of security research, privacy complaints, and government restrictions. Multiple independent labs, data protection regulators, and a US congressional committee have raised concerns about jailbreak resistance, embedded censorship, and where user data goes. This breakdown collects those findings, attributes each one to the researcher or agency that produced it, and presents DeepSeek's own responses alongside the accusations.

One distinction matters more than any single statistic, so it comes first.

Which Model Was Actually Tested

Most of the independent jailbreak and censorship research below tested DeepSeek R1 or a distilled R1 variant such as R1-LLaMA-8B. It did not test V4, the company's most recent model family. This is the single most common error in coverage of DeepSeek security: a finding about R1 gets repeated as if it described every DeepSeek model. s11

Throughout this article, every security or censorship finding names the specific model that was examined, the researcher or agency that examined it, and the date. Where a claim is an allegation rather than a settled fact, it is framed as one. As of the sources reviewed here, DeepSeek V4 has not yet been independently red-teamed for jailbreak resistance or censorship behavior. The absence of published V4 testing is not evidence that V4 is safe; it means the public record on V4 is, for now, thin.

Data Residency and Chinese Law

DeepSeek's published privacy policy states that personal information collected through its consumer service is stored on servers located in the People's Republic of China. Data held in the PRC is subject to Chinese law, including the Cybersecurity Law, the Data Security Law, and the National Intelligence Law. The last of these obligates organizations to support and cooperate with state intelligence work when asked. s17

Feroot Security, a web security firm, reported finding code in DeepSeek's web infrastructure with backend links associated with China Mobile, a state-owned carrier. In March 2025, the US House Select Committee on the Chinese Communist Party published a report that characterized DeepSeek as a national security threat, citing data flows to China and the legal environment those flows are subject to. s17

These are statements about the company's cloud service and the laws that govern data held in China. They are not, by themselves, claims that data has been misused. The practical mitigation, discussed later, is that self-hosting the open weights keeps data off DeepSeek's servers entirely.

The Exposed Database (Wiz Research, January 2025)

In January 2025, Wiz Research reported that it had discovered a publicly accessible, misconfigured DeepSeek database. According to Wiz, the database exposed more than one million log entries, including plaintext chat history, backend details, and API authentication keys, with no authentication required to access it. s15

Wiz stated that it disclosed the exposure to DeepSeek, which then secured the database. The finding concerns an operational security lapse in DeepSeek's cloud infrastructure rather than a weakness in a specific model. It illustrates the broader point that data sent to a hosted service is only as safe as that service's configuration.

Jailbreak and Safety Research

Three independent studies make up most of the published jailbreak evidence. Each tested R1 or a distilled R1 variant, and each is named and dated below.

Cisco and the University of Pennsylvania (January 31, 2025)

Researchers from Cisco and the University of Pennsylvania ran 50 prompts drawn from the HarmBench benchmark against DeepSeek R1. They reported a 100% attack success rate, meaning the model failed to block any of the 50 harmful prompts in that test set. The researchers framed this as a measure of R1's safety guardrails relative to other frontier models, several of which also performed poorly but not at 100%. This figure describes that specific 50-prompt test set against R1, not a property of every DeepSeek model. s11

Qualys TotalAI (March 16, 2026)

Qualys evaluated a distilled R1-LLaMA-8B model, an 8-billion-parameter open-weight variant, using its TotalAI testing suite. Qualys reported that the model failed 61% of 891 knowledge-base risk tests and 58% of 885 jailbreak attempts. Because this was the distilled 8B model rather than full R1 or V4, the results speak to the safety of that smaller open-weight variant specifically. s12

CrowdStrike (November 20, 2025)

CrowdStrike's Counter Adversary Operations team reported that when prompts to DeepSeek R1 contained trigger words sensitive to the Chinese Communist Party, the likelihood that the model produced code with severe vulnerabilities rose by up to roughly 50%, reaching 27.2% in those conditions compared with a lower baseline. CrowdStrike described what it called an intrinsic kill switch baked into R1's weights, and reported that R1 refused to generate code for a project associated with Falun Gong in about 45% of attempts. These findings are specific to R1 and to CrowdStrike's testing methodology. s13

Censorship of Politically Sensitive Topics

Independent researchers report that DeepSeek's models suppress or alter answers on topics the Chinese government treats as sensitive. The US House Select Committee on the CCP report (Mar 2025) stated that a reported 85% of politically sensitive topics it examined were altered or suppressed. That figure reflects the committee's own testing and topic selection, not an audited universal rate. s16

The legal context is explicit. China's Interim Measures for the Management of Generative Artificial Intelligence Services require providers to uphold what the rules call core socialist values, which is widely understood to oblige domestic models to avoid politically disfavored content. A model built under those rules is expected to decline certain subjects by design. s16

Probing the Censorship: Thought Token Forcing (January 31, 2025)

Can Rager, an independent researcher, working with David Bau of Northeastern University and the BAIR group, published an analysis of DeepSeek R1 using a technique they called thought token forcing. By manipulating the model's visible reasoning trace, they reported surfacing knowledge the model normally withholds, including discussion of the 1989 Tiananmen Square events, and what they described as an internal list of forbidden topics covering Falun Gong, Tibet, Uyghurs, Taiwan, and Hong Kong. Their work targeted R1 specifically and demonstrated that the suppression sits in the model's behavior rather than only in a surface-level filter. s14

Government Bans and Regulatory Actions

Between January 2025 and April 2026, multiple governments and data protection authorities restricted DeepSeek or opened reviews. The timeline above lists the dated actions. Briefly: Italy's Garante ordered the app blocked on January 31, 2025; NASA and New York State moved to restrict it on government systems in January 2025; Taiwan barred it from government devices on February 3, 2025, and Australia did the same on February 4, 2025; the US House Select Committee published its report in March 2025; Berlin's data protection authority asked Apple and Google to review the app on June 27, 2025; and a US State Department cable addressed distillation and intellectual property concerns on April 24, 2026. s16

Most of these actions target the hosted consumer app and its data handling, not the open model weights as a mathematical object. That distinction matters for organizations weighing whether a self-hosted deployment changes their exposure.

DeepSeek's Response and the Mitigation

Each accusation deserves the other side. DeepSeek and connected parties have responded to several of the claims above.

On data protection, DeepSeek told EU regulators that GDPR did not apply to its service. Italy's Garante deemed that position totally insufficient and proceeded with its block. On intellectual property, the Chinese embassy rejected allegations of IP theft, and DeepSeek denied intentionally training on synthetic data generated by OpenAI. These are the company's and connected parties' stated positions; they do not resolve the underlying disputes, which remain contested. s16

The Self-Hosting Mitigation

The most consequential mitigation is structural. Because DeepSeek publishes open model weights under a permissive license, organizations can run the models on their own infrastructure rather than through DeepSeek's cloud service. A local or self-hosted deployment, for example using an inference server such as vLLM, keeps prompts and outputs on infrastructure the operator controls and off servers in the PRC. s17

Self-hosting addresses the data residency and cloud leak concerns directly. It does not change the censorship behavior or jailbreak findings, which are properties of the model weights themselves, nor does it automatically satisfy GDPR or sector-specific obligations. Operators still need their own data protection assessment for any system processing personal data.

Who Should Weigh These Risks

The findings land differently depending on who you are and how you deploy. Each group below is paired with the mitigation most relevant to it.

Where the Concern Is Highest

• Regulated and privacy-sensitive organizations using the hosted app: data residency in the PRC and the Wiz exposure are direct concerns; self-hosting addresses the data path but not compliance on its own
• Applications needing uncensored historical or geopolitical content: the suppression behavior documented on R1 sits in the weights and is not removed by self-hosting
• Teams generating code from user text that may contain CCP-sensitive terms: CrowdStrike's trigger-word finding on R1 is relevant; review output and add guardrails

Where the Concern Is Lower

• Self-hosted deployments for non-sensitive coding, data analysis, and writing that do not touch suppressed topics, with prompts kept on controlled infrastructure
• Isolated experimentation with the open weights, where no personal or confidential data is involved

For the self-hosting path in detail, see Running DeepSeek V4 Cost-Effectively. For the broader context, visit the DeepSeek hub.

Frequently Asked Questions

DeepSeek is a trademark of its respective owner. CrowdStrike, Cisco, Qualys, Wiz, Feroot Security, Anthropic, OpenAI, Apple, Google, and Nvidia are trademarks of their respective owners. This article is editorially independent and is not affiliated with, endorsed by, or sponsored by any vendor named. Findings are attributed to the cited researchers, agencies, and official records.