US orders civilian federal agencies to rip out DeepSeek, including third-party tools built on its models

What's the deal? The US Department of Homeland Security has ordered federal civilian agencies to remove all products from DeepSeek and its affiliates from their IT systems and to stop buying them. The order also covers third-party products and services “developed using DeepSeek implementations”, so tools built on top of DeepSeek's open-weight models are caught too. The notice went on public inspection on 19 October and was published in the Federal Register on 20 October (docket DHS-2026-0628).

The legal basis: DHS acted under the Federal Acquisition Supply Chain Security Act of 2018, following a review by the Federal Acquisition Security Council. Bloomberg and CyberScoop report that the underlying order was signed by Homeland Security Secretary Markwayne Mullin months before it was made public. Agencies can ask for exceptions, but must apply 60 days in advance with a “compelling justification”, according to CyberScoop.

DHS's reasoning: In the order, Mullin argues DeepSeek's models present “multiple threat vectors”: data stored on servers in China, where national security laws let the government demand it; collection of personal data by DeepSeek-hosted models; and prompts that “may result in the transfer of sensitive data” to the Chinese government.

Why it matters: Until now, US agencies decided for themselves whether to block Chinese models. A formal supply-chain exclusion turns that into government-wide policy and reaches into the software supply chain: vendors whose products run on DeepSeek models now risk losing federal customers. It lands days after DeepSeek shipped its V4.1-Flash update alongside its own Search and Fetch APIs for developers building agents.

Sources: Federal Register, CyberScoop, Bloomberg, WSJ, Andrew Curran on X.