Homeland Security orders DeepSeek ripped out of US civilian agencies, including apps built on its models

The Department of Homeland Security has ordered federal civilian agencies to remove DeepSeek products, and third-party products and services built using DeepSeek, from their IT systems and to stop buying them, according to a notice filed with the Federal Register on Monday, Oct. 19, 2026.

Banning an app on government phones is easy. This goes further: anything a civilian agency buys that was "developed using DeepSeek implementations" is out too. With open-weight models, that's the hard part — DeepSeek's weights get downloaded, fine-tuned and folded into other people's products, often without a label. So the real work lands on contractors, who now have to trace what model is actually inside the software they sell. It's also a sign of where the open-weight fight is heading: Washington is treating a Chinese model's origin, not just its hosting, as the security risk.

Under the Federal Acquisition Supply Chain Security Act of 2018, and after reviewing a recommendation from the Federal Acquisition Security Council and related evidence, the Secretary of Homeland Security ordered two things: exclusion of IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., including affiliated entities, from federal civilian agency procurements, and removal of all DeepSeek and DeepSeek-affiliate products, "and third-party products and services developed using DeepSeek implementations," from civilian agency IT. The 2018 law, often shortened to FASCSA, lets the government kick a supplier out of federal buying over supply-chain risk. Those terms are the DHS notice's.

The notice was filed for public inspection on Oct. 19 and is scheduled for formal Federal Register publication on Oct. 20. It is signed by DHS General Counsel James H. Percival II. The signed order is posted under docket DHS-2026-0628. Questions go to a FASCSA Order Implementation Team at CISA, the Cybersecurity and Infrastructure Security Agency. The notice does not print a compliance deadline.

Reuters reports that DHS said DeepSeek models pose "multiple threat vectors" and that use of the product "may result in the transfer of sensitive data to the PRC if used by US government employees or vendors," and "could produce actionable intelligence on US persons and/or government agencies. The models themselves may contain malware or other security vulnerabilities." PRC here means the People's Republic of China. Those quotations are DHS's, as Reuters prints them. The language is about risk — may, could, may contain — not a finding that data has already moved or that malware has been found.

Reuters also reports that, in a July memo made public Monday, DHS told federal agencies to monitor traffic in and out of government websites to address potential risks from DeepSeek. Earlier, agencies including the Commerce Department and the Navy had banned DeepSeek on government devices, as had states including New York, Tennessee and Virginia. The Chinese Embassy in Washington did not immediately comment. Those lines are Reuters'.

The order covers federal civilian agencies. DHS orders under this law apply to civilian agencies; the Pentagon and the intelligence community issue their own. It does not ban DeepSeek for US consumers or private businesses.

The wide part is "third-party products and services developed using DeepSeek." DeepSeek publishes open-weight models — files other companies can download, fine-tune and fold into their own tools, often without a DeepSeek label. Contractors selling software to civilian agencies will now have to know whether anything they sell runs on a DeepSeek model, not just whether someone installed the DeepSeek app.

In plain terms, Homeland Security told federal civilian agencies on Monday to pull DeepSeek products out of their systems and stop buying them, including third-party tools built on DeepSeek models. The notice is a FASCSA supply-chain order, signed for a Monday public-inspection filing and set for the Federal Register on Tuesday. Reuters quotes DHS on risk to data and possible malware. The order is for civilian agencies, not phones in American pockets.