DeepSeek database contains chat history, internal secrets for anyone to see

DeepSeek is in some deep trouble after cloud services provider Wiz Research did some digging, finding a publicly available database of the Chinese AI company's secret keys, messages, and more.

2

The database includes details like chat history, API secrets, and more, with Wiz researchers saying that the discovered database can be fully controlled. This means that they could execute code without any oversight, manipulating the data to serve their needs. Wiz reached out to DeepSeek to alert them, with the company quickly taking it down after restricting public access.

The team at Wiz Research set out to assess DeepSeek's external security posture, and find any potential vulnerabilities, with the team explaining: "Within minutes, we found a publicly accessible ClickHouse database linked to DeepSeek, completely open and unauthenticated, exposing sensitive data. It was hosted at oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000".

"This database contained a significant volume of chat history, backend data and sensitive information, including log streams, API Secrets, and operational details. More critically, the exposure allowed for full database control and potential privilege escalation within the DeepSeek environment, without any authentication or defense mechanism to the outside world".

You can read Wiz Research's full report here.