Choosing a provider
An open database with DeepSeek's chat logs
In January 2025 security researchers found a DeepSeek database that anyone could reach without a password. It held users' chat history and secret keys, and could be queried from a web browser.
DeepSeek became world-famous in January 2025, when its app shot to the top of the download charts within days. In the same days, researchers at the security company Wiz examined the company's internet-facing systems and found two servers where a database was open without any authentication.
One table held more than a million log lines, starting from 6 January. Among them, in plain text, were users' chat messages, API keys and internal details of the backend. The server's built-in web interface let anyone run any query from a browser. According to the researchers, this gave full control of the database and could have let an attacker move further into the company's systems.
Wiz only listed the tables and reported the problem at once; DeepSeek closed the access promptly. Whether anyone else had found the database before them is not known.
The researchers' point was that the most pressing danger is not some exotic AI risk but an everyday mistake: a misconfigured database left facing the internet. AI providers are growing fast, and their security practice does not always keep up.
What can we learn from it?
Whatever we type into a cloud AI service lives on in the provider's logs, databases and backups, and it is only as safe as the provider's settings. We cannot see those from the outside, but we do decide what leaves our hands. Cloud AI can still serve us well at work. Confiella sends only reviewed, pseudonymised text to the cloud, to an EU regional endpoint. With any other tool the same practice works: for client data, choose a service whose contractual and data-protection terms you know, and leave names and identifiers out of the text.
Sources
- Wiz: Wiz Research Uncovers Exposed DeepSeek Database Leaking Sensitive Information, Including Chat History
- TechTarget: Wiz reveals DeepSeek database exposed API keys, chat history
This article is based on the public sources listed. If you find a mistake, write to us: [email protected]