Sensitive DeepSeek Data Was Exposed to the Web, Cybersecurity Firm Says (reuters.com) 17
An anonymous reader shared this report from Reuters:
New York-based cybersecurity firm Wiz says it has found a trove of sensitive data from the Chinese artificial intelligence startup DeepSeek inadvertently exposed to the open internet. In a blog post published Wednesday, Wiz said that scans of DeepSeek's infrastructure showed that the company had accidentally left more than a million lines of data available unsecured.
Those included digital software keys and chat logs that appeared to capture prompts being sent from users to the company's free AI assistant.
Wiz's chief technology officer tells Reuters that DeepSeek "took it down in less than an hour" after Wiz alerted them.
"But this was so simple to find we believe we're not the only ones who found it."
Those included digital software keys and chat logs that appeared to capture prompts being sent from users to the company's free AI assistant.
Wiz's chief technology officer tells Reuters that DeepSeek "took it down in less than an hour" after Wiz alerted them.
"But this was so simple to find we believe we're not the only ones who found it."
Highlights the need to run DeepSeek locally (Score:1)
Interesting (and not entirely surprising) data leak from DeepSeek. Between this and the inherent risk of any Chinese company having its data accessible by the CCP, it really highlights the need for users to take control of their AI interactions.
The good news is, DeepSeek can be run on your own hardware. For those concerned about data privacy and security (and frankly, who isn't?), running DeepSeek locally is a very viable option. The instructions aren't even that daunting, check out https://unsloth.ai/blog/
Re: (Score:2)
I can't recommend the unsloth Discord though. Mod is an abrasive jerk who will call out others for doing exactly the same thing they do repeatedly, or at least the one that was on duty when I joined, and still a couple hours later when I left. It's nice that they have managed to stand up a server with 256 GB of RAM and two RTX 4090D cards (48 GB VRAM each), but that doesn't make them God. (This is sufficient to run the 1.58 bit quantization of the full fat 671B parameter model, which you can find on Hugging
FUD in full force (Score:2)
There sure seems to be a remarkable urge to find problems with DeepSeek. Wonder why?
See, this is how you know Melonia Musk is a fraud, he would be doing this to his targets if he only could.
Re: (Score:2)
You really need to seek psychiatric help my friend. This obsession will not end well for you.
Re: FUD in full force (Score:2)
Because any tech that comes out of China needs extra scrutiny. This isn't FUD, China is an adversary to the west, not an ally.
Re: (Score:2)
There are also legitimate technical reasons to audit the whole thing, like stripping the nanny filtering entirely. Fortunately, said nanny filter is only applied externally to the model so as not to poison the good parts, and it's a piss-poor implementation which may be deliberate, or it may just be the result of minimum effort being applied to a "feature" they didn't really want. It was only implemented because of the demands of the CCP, and it ceased development the moment it satisfied that goal. It may b
Re: FUD in full force (Score:2)
Re: (Score:2)
The filter truly has to be the worst possible implementation, because it's 100% broken. DeepSeek-R1 has _no taboos_ and will answer 100% of the time once the nanny filter is defeated. Being bad is possible incompetence, but being as bad as it is theoretically possible to be? That takes effort.
Of course if you ask for how to "cook", and it answers, you still don't know if the instructions will turn you into Heisenberg, or the Hindenburg.
Wonder if they're using MongoDB? (Score:2)
I hear it's web scale.
And now do all the others (Score:2)
Yep, they are larger and hence harder to scan. But do you really think they have better security?
when did it become acceptable to scan someones... (Score:2)
when did it become acceptable to scan someone's infrastructure without permission? I mean, I get it's publicly accessible, but from my history on the subject, you still need permission and scope from them before you are supposed to be doing any scans? Even if it is a misconfiguration scan (most are active attacks probing for those misconfigurations)... which I highly doubt this was limited to.
Re: (Score:2)
A million lines of data (Score:2)
"a million lines of data"? This tells us a lot about the quality of the journalist and of the article.
Mitigated by nature. (Score:2)
Everyone should have expected the CCP would be able to see everything sent to the DeepSeek servers, and thus not doxxed themselves in the first place. The fact that these records were also available to the world is only slightly worse. That's no excuse for the poor security, I'm just saying that we should have been behaving all along as if our queries would be viewable by hostile parties.