The quick read: • Homeland Security ordered federal civilian agencies to remove DeepSeek products and stop buying them, in an exclusion and removal order filed for public inspection Mon Oct 19, 2026 (Federal Register Oct 20), per IBTimes UK, Engadget and Quartz. • It was issued under the Federal Acquisition Supply Chain Security Act of 2018 on the Federal Acquisition Security Council's recommendation, and covers Hangzhou DeepSeek Artificial Intelligence Co., its affiliates, and "third-party products and services developed using DeepSeek implementations." • DHS says DeepSeek's products "present multiple threat vectors": servers in China, personal data collected at sign-up, prompts from government staff or vendors that could send sensitive data to China, and models that "may contain malware or other security vulnerabilities." • National security systems fall under separate orders. Agencies can ask for exceptions in writing with a compelling justification. • The same day, Reuters reported that a hacker's AI agents that broke into more than 100 companies' websites appeared to run on a mix of Anthropic's Claude Code and DeepSeek, per a NorForge researcher's estimate. • DeepSeek had not commented as of Oct 20. The Chinese Embassy did not immediately comment, per IBTimes UK. Reports differ on when the order was signed (June or July 2026). • For a small business: if you sell to government, the clause on third-party products puts the question of which model sits under your tools on you.
“DeepSeek Is Banned From U.S. Government Computers, Apps Built On It Included”
who’s making the noise
DHS exclusion and removal order under the Federal Acquisition Supply Chain Security Act of 2018, filed for public inspection Mon Oct 19, 2026, published in the Federal Register Oct 20. Reported by IBTimes UK, Engadget, Quartz and The Register.
our take
The headline is the app. The news is the clause. Pulling DeepSeek's own app and API off agency machines is a familiar move: the Pentagon, the Navy, NASA, the House and several states already restricted it. What is new is that the order reaches "third-party products and services developed using DeepSeek implementations." That clause is where it gets hard. Security researcher Katie Moussouris told The Register the order does not define "developed using," and of checking it: "There's no practical way to verify that." AI gateways can route requests to DeepSeek models without the agency or even the vendor seeing a DeepSeek label on anything. DHS's case rests on risk, not a named incident: servers in China, data collection, the chance that prompts send sensitive data there, and models that "may contain malware." Moussouris points out that last line could be said of any software. DeepSeek has not answered. The plain move for a small business that sells to government, or to anyone who does: list the AI tools your team uses and ask each vendor, in writing, which models they call and where those run. If a vendor cannot answer, that is the answer. What to watch: whether DHS publishes guidance on what "developed using" means, and whether DeepSeek or Beijing responds.