The DeepSeek ban names one vendor, while unnamed alternatives sit one setting away in the same gateway

Summary

DHS published a Federal Register notice ordering federal civilian agencies to stop buying DeepSeek products and to remove them from their systems or ask CISA for an exception. The order also covers DeepSeek affiliates and third-party products built with DeepSeek technology. In the same news cycle, Vercel added DeepSeek V4.1 Flash to its Token Pass gateway bundle alongside Kimi K3 and GLM 5.3. Reuters also reported an agent-driven hacking campaign in which DeepSeek's model appears to have been one of the components. Read together, these stories show that DeepSeek often reaches users as an interchangeable model slot inside someone else's tool, not as a product anyone installs.

What happened

According to the Federal Register notice (d1), DHS acted under the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321–1328) and its implementing rules, after a Federal Acquisition Security Council review. The mechanism is a procurement exclusion and removal order:

• Agencies must immediately take covered products off approved-product lists and purchasing marketplaces.
• They must then remove existing deployments or ask CISA for an exception.
• An exception request needs a justification and proposed risk mitigations. CISA approves or denies each one in writing.
• During removal, DHS encourages traffic monitoring, enhanced logging and controls that detect data exfiltration. CyberScoop reports this as encouragement, not a requirement.

The stated grounds are data stored in China, collection of personal data, user tracking and possible transfer of sensitive prompts and responses. These are the government's stated concerns, not established findings of a compromise. The order names DeepSeek alone and does not cover private or consumer use. The sources disagree on when the underlying order was issued: CyberScoop says June, while DeepSeek's own release page (d3) refers to a July 24 order. Either way, it predates this month's publication.

The two related stories show how DeepSeek actually reaches users:

• Vercel Token Pass. It costs $30 a month for $80 in credit. It now lists DeepSeek V4.1 Flash (the 1017 weights) next to Kimi K3 and GLM 5.3, all behind one AI Gateway that coding agents such as Cline, or apps built with the AI SDK, can call. Vercel says Zero Data Retention is on by default.
• The Reuters campaign. Reuters reported that a Chinese-speaking hacker's AI agents attempted intrusions at more than 1,200 sites and compromised more than 100. NorForge researcher Snorre Fagerland estimated about $5,000 in token spend. He said the campaign appeared to use a mix of DeepSeek and Anthropic's Claude Code. The story's framing suggests Claude Code served as the agent harness and DeepSeek's model as at least part of the inference behind it, but this is one researcher's estimate.

What the archive adds

Our archive had already covered the Reuters campaign: more than 1,200 attempted sites and more than 100 compromised. Reuters identified Deere, SharkNinja and Cummins among the affected companies through activity on the open-source Cairn platform. Deere said it had no sign that sensitive data was accessed. SharkNinja said the threat was contained. The archive also holds the Vercel Token Pass listing and the ban as reported by BleepingComputer, CyberScoop and SiliconANGLE.

The dossier adds three facts:

• Legal basis (d1). The Federal Register notice confirms FASCSA 2018 and the FASC review.
• Technical precedent (d2). According to NIST, the Commerce Department's CAISI evaluation from September 2025 found tested DeepSeek agents substantially more susceptible to agent hijacking than the evaluation's US reference models.
• Release timing (d3). DeepSeek's release page dates V4.1-Flash-1017 to October 17, 2026, after the order, and describes it as optimized for agentic coding.

The model the order targets therefore kept shipping new versions, and Western developer platforms kept distributing it, after the order was issued.

Trend signal

US exclusions of Chinese technology have usually named vendors: Kaspersky, Huawei and ZTE under Section 889, and TikTok on government devices. Each then had to deal with that vendor's technology embedded in other products. For hardware and installed software, an inventory can at least find the named product.

Models behave differently. A gateway is built so that one API call can be pointed at DeepSeek, Kimi or GLM interchangeably. That interchangeability is what Token Pass sells. Two things follow:

1. A vendor-name exclusion is harder to verify. A list of installed software won't show which model served a given request.
2. The rule that names DeepSeek says nothing about Kimi K3 or GLM 5.3, which are bundled right beside it. A team that drops DeepSeek can switch to an unnamed Chinese model with a configuration change.

Our read is that the pattern from hardware bans repeats at the model layer: the named vendor is excluded, and its substitutes keep flowing.

Why now

1. A legal tool built for supply-chain exclusions. FASCSA 2018 and an FASC review let DHS act at the procurement level, and its reach includes third-party products (d1; CyberScoop).
2. A public technical record. According to NIST, the CAISI evaluation found tested DeepSeek agents more susceptible to agent hijacking (d2).
3. Continued spread into Western developer tools. V4.1-Flash-1017 shipped on October 17, after the order, and went into Vercel's coding-agent bundle (d3; Vercel).
4. Misuse reporting that ties cheap agentic inference to real intrusions. About $5,000 in tokens bought more than 100 compromises, according to Fagerland via Reuters. The reporting came after the order, so it bears on the debate, not on the order's origin.

Connections to other events

Follow the third-party clause one step further. Suppose a federal contractor runs a coding agent through a multi-model gateway. Some of its requests could go to DeepSeek without anyone choosing that on purpose, for example through a default model, a fallback route or a developer picking the cheaper option. A scan of agency endpoints would not show this. Only the gateway's routing configuration and request records would.

None of the sources says agencies or vendors must keep per-request model logs. The enforceable tool is FASCSA's procurement exclusion and removal. Logging appears only as DHS-encouraged monitoring during removal, and exception requests must describe risk mitigations. Our inference is that routing records are the most practical evidence anyone could give CISA. That is a reading of incentives, not a stated rule.

The second consequence comes from the bundle itself. Token Pass offers DeepSeek V4.1 Flash, Kimi K3 and GLM 5.3 through one interface. The DHS order, as reported, names only DeepSeek. A vendor that removes DeepSeek to comply can move the same workload to Kimi or GLM without breaking any named rule. Our read is that the order removes one supplier, not the category of risk it describes. The CAISI hijacking findings (d2) were about DeepSeek models specifically. No source here says whether the same weaknesses apply to the neighbouring models.

The Reuters case adds a reason to care beyond compliance. On our own arithmetic, Fagerland's figures of about $5,000 for more than 100 successful intrusions come to roughly $50 or less per compromise. That suggests cheap inference is one input to scaling agent-driven attacks. Since the harness was reportedly Anthropic's Claude Code, model choice is only part of the picture.

Why it matters

These follow from the order's text, not from any reported requirement.

Vendors selling to agencies or their contractors. You can't show you are outside the third-party clause unless you know every model your product can route to, including defaults and fallbacks. Products that can pin routing to a named list and show that list are easier to defend if a contracting officer asks. That is an inference about how reviews tend to go, not something any source describes.

Gateway providers. Platforms like Vercel are not named in the order. Their bundles do make the vendor-name gap visible, because DeepSeek and unnamed Chinese models sit together.

Teams choosing models on token price. Switching from DeepSeek to Kimi or GLM may satisfy the letter of this order. It is a bet that the exclusion stays narrow, and the order's stated reasons apply just as easily to vendors under similar jurisdiction.

What happens next

• A US federal exclusion action (FASC recommendation, Federal Register notice, DoD directive or enacted legislation) names at least one Chinese model developer other than DeepSeek, such as Moonshot (Kimi), Zhipu (GLM) or Alibaba (Qwen). (12 months, 35%). Watch for: A new FASC recommendation or Federal Register exclusion notice naming a second Chinese AI model vendor.
• CISA or DHS publicly clarifies whether self-hosted DeepSeek open weights fall under the 'built using DeepSeek technology' clause. (6 months, 40%). Watch for: A CISA FAQ, advisory or reported exception decision that specifically addresses on-premise open-weight deployments.
• At least one AI gateway or cloud model marketplace documents a control to restrict models by provider origin and explicitly references US government or federal compliance use. (6 months, 45%). Watch for: A changelog or documentation entry describing origin-based model allowlists that cites the DHS order or federal requirements.

Limits and uncertainty

Several things are unknown:

• How many agencies or systems use DeepSeek.
• Which third-party products count as covered.
• How CISA will read "built using DeepSeek technology". In particular, it is unclear whether self-hosted open weights or distilled models are included.
• How many exceptions CISA will grant.

The order covers civilian agencies only, and its stated risks are allegations. The editor's brief pointed to further findings on NDAA §1532 and comparative model pricing, but they are not in the evidence available to us. We therefore make no claims about other statutes or about price gaps between DeepSeek, Kimi and GLM.

The Reuters model attribution is one researcher's estimate. The campaign was reported after the order was issued, so it did not drive the order. If CISA reads the clause narrowly as covering DeepSeek-hosted services only, the routing-visibility argument matters much less.

Skill to build now

Build a model inventory for your agentic systems: a written record of which models your product can call and which ones it actually called.

First exercise: route one coding agent through your gateway for a day and export the request records. Check whether each request records the model ID, the provider and whether a fallback fired. Then write an allowlist that names allowed models explicitly, and confirm that a request to an unlisted model fails rather than silently falling back.

Reader takeaway

If your product reaches a federal customer, even through a contractor, write down every model your agents and gateways can call, including defaults and fallbacks. Check whether DeepSeek appears anywhere in that list. Then decide on purpose, not by default, whether unnamed models of similar origin, such as Kimi or GLM, belong in your routing. Don't assume that swapping DeepSeek for its neighbour in the same bundle makes the exposure go away.

Open question

Does a product running DeepSeek's open weights on US-controlled hardware, with no data flowing to China, count as "built using DeepSeek technology"? And if the concern is really what the weights do, as the CAISI hijacking findings suggest, why should a ban that names one vendor leave the neighbouring models in the same gateway bundle untouched?