We came across the posts on the following topic on the social media platform X (1, 2, 3, 4):
Various posts discussing the DeepSeek suggest that it may contain spyware, malware or malicious code, while some other posts argue to the contrary. Some of the posts have a speculative tone or requests from other users for clarification.
DeepSeek is a Chinese AI chatbot model named after the company that created it. Two models of the AI have been released—DeepSeek-V3, in late 2024, and DeepSeek-R1, in January 2025.
The DeepSeek models rival the performance of western models, such as OpenAI’s ChatGPT, while being developed and operated at a fraction of the cost and available to users for free.
As a result, DeepSeek’s releases have resulted in stock market volatility, as observers and investors question the viability of US tech giants’ growth strategies while weighing the national security risks in a potentially dominant tech product developed in China.
Data Privacy Fears Return
A web keyword search did not reveal any conclusive sources of information that corroborated claims that DeepSeek contained spyware, malware or malicious code. However, we found several articles discussing the risks of using the software.
An article on the tech publication Mashable, for instance, indicates that DeepSeek’s publicly available privacy policy reveals that the app collects profile information, any data uploaded to the app, internet and network activity information, device technical information, as well as any information provided to DeepSeek if a user were to contact them.
The data also includes the collection of ‘keystroke patterns or rhythms’. The collection of this form of data has yet to be fully clarified by DeepSeek, however, it is not uncommon to collect this information, with apps such as TikTok also collecting this data.
Some users have likened this to keylogging, which logs every button pressed on your keyboard, considering it to be highly invasive. However, this does not amount to the app being spyware or malware, and several popular websites already use keylogging in their data collection tools.
While the amount of data collected may provoke alarm, western models such as Meta’s AI apps or OpenAI’s ChatGPT also collect a similar amount of data from users due to a lack of strong data privacy laws in both the US and China.
The difference with DeepSeek appears to be that the model is owned by a Chinese company, and therefore the platform and its data would be subject to access by the Chinese government when requested under the country’s cybersecurity laws.
Concerns over political control have been compounded by indications that the app is censoring some of its answers and giving versions of answers on contentious political issues favourable to the Chinese government.
Similar fears over data privacy prompted a bipartisan effort in the US Congress to ban the TikTok app in the US on national security grounds, though the ban has since been temporarily halted by executive order by US president Donald Trump since he took office.
Security Concerns
In addition to data privacy issues, there was also widespread reporting regarding security concerns over DeepSeek.
On Monday, 27 January, the app purportedly suffered cyberattacks almost immediately after it released its most recent R1 model. DeepSeek said its servers were ‘targeted in large-scale malicious attacks that prevented users from registering’. The description suggests that a DDOS (distributed denial-of-service) attack took place—these are malicious attempts to disrupt a server with a flood of internet traffic.
Apart from this, we found articles on the tech industry publication Cyber Security News and on Forbes that researchers at a cyber intelligence company Kela were able to ‘jailbreak’ DeepSeek.
This process entailed manipulating the model to bypass its restrictions in order to generate harmful content such as ransomware development scripts or malware.
Links to these news articles were cited in several X posts claiming them as proof of DeepSeek containing harmful code.
However, these articles report that DeepSeek has a security vulnerability that allows malicious actors to use it to generate harmful code, not that the software itself is harmful. As an example, the hackers were able to prompt the chatbot to answer a question on how to launder illegally obtained money.
This flaw is not exclusive to DeepSeek. The blog post by Kela which announced vulnerability also noted that the same method was used to jailbreak and bypass the security mechanisms of ChatGPT 3.5 in early 2023.
Moreover, a security expert interviewed by Axios noted that cybercriminals have already built malicious GPT models that enables them to carry out online fraud and write malware, though the release of free, open-source (code that is free to view and modify without permission) DeepSeek models makes this process easier.
Not Entirely Safe, but Not Malicious
In conclusion, our search revealed that many reliable sources in the tech industry consider DeepSeek to be currently lacking in safety. This can be divided into concerns over data privacy and security flaws.
Data privacy concerns are unlikely to be resolved barring a substantial change in the regulatory environment due to the nature of DeepSeek’s ownership and the broader political tensions between the US and China.
The security flaws, meanwhile, are likely to be patched as newer versions of the model are released, just as with ChatGPT, though this is likely to be a constant process as hackers may identify new vulnerabilities, as with other software.
Despite these, there was no evidence to support claims that DeepSeek inherently contained any malware, spyware or malicious code for the user. While the origin of these claims is uncertain, they may have been propagated further by the sensationalised headline used by Forbes.
As such, we find the claim that DeepSeek contains spyware, malware or malicious code to be false due to the lack of supporting evidence.