Exposed DeepSeek database leaking sensitive information, including chat history (wiz.io)

Article summary

A publicly accessible database belonging to DeepSeek, a Chinese AI startup, was found to be leaking sensitive information, including chat history, secret keys, and backend details. The exposure was discovered by Wiz Research, which immediately notified DeepSeek, and the issue was promptly secured. The database contained over a million lines of log streams with highly sensitive information, posing a critical risk to DeepSeek's security and its end-users. The incident highlights the importance of security in AI applications and the need for companies to prioritize protecting customer data.

Main themes

• AI security
• Data leakage
• Cloud security
• Database exposure
• AI adoption
• Security risks

What commenters say

• Running AI models locally or using stateless services can help avoid data exposure risks associated with remote chat models.
• The exposure of sensitive data is not surprising, given the rapid adoption of AI services without corresponding security measures.
• The incident highlights the need for security teams to work closely with AI engineers to ensure visibility into the architecture, tooling, and models being used.
• The idea that DeepSeek is a side project of a bunch of quants is a myth, and the company has a dedicated team working on LLM research.
• The lack of security chops in ML researchers is not surprising, as their expertise lies in models, not security.
• The comparison between DeepSeek and OpenAI's ChatGPT is notable, as both had similar breakout moments despite being different in nature.
• The fact that DeepSeek's parent company is a hedge fund does not necessarily mean that DeepSeek is a side project, but rather a separate entity with its own goals and resources.
• Security is not the primary responsibility of ML researchers, and companies should prioritize hiring dedicated security professionals to handle such tasks.