DeepSeek database contains chat history, internal secrets for anyone to see

Cloud security services provider Wiz Research discovers DeepSeek security keys, messages, and more... includings chat history, API secrets.

DeepSeek database contains chat history, internal secrets for anyone to see
Comment IconFacebook IconX IconReddit Icon
Gaming Editor
Published
2 minutes & 45 seconds read time

As an Amazon Associate, we earn from qualifying purchases. TweakTown may also earn commissions from other affiliate partners at no extra cost to you.

TL;DR: Wiz Research discovered a publicly accessible database from Chinese AI company DeepSeek, exposing secret keys, chat history, and API secrets. The database allowed full control and potential code execution without oversight. After being alerted, DeepSeek restricted access and took it down. The database was linked to oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000.

DeepSeek is in some deep trouble after cloud services provider Wiz Research did some digging, finding a publicly available database of the Chinese AI company's secret keys, messages, and more.

DeepSeek database contains chat history, internal secrets for anyone to see 22
2

The database includes details like chat history, API secrets, and more, with Wiz researchers saying that the discovered database can be fully controlled. This means that they could execute code without any oversight, manipulating the data to serve their needs. Wiz reached out to DeepSeek to alert them, with the company quickly taking it down after restricting public access.

The team at Wiz Research set out to assess DeepSeek's external security posture, and find any potential vulnerabilities, with the team explaining: "Within minutes, we found a publicly accessible ClickHouse database linked to DeepSeek, completely open and unauthenticated, exposing sensitive data. It was hosted at oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000".

"This database contained a significant volume of chat history, backend data and sensitive information, including log streams, API Secrets, and operational details. More critically, the exposure allowed for full database control and potential privilege escalation within the DeepSeek environment, without any authentication or defense mechanism to the outside world".

You can read Wiz Research's full report here.