The chat history of DeepSeek users was accessible over the Internet because of a flaw in a ClickHouse database. That's according to research by security firm Wiz.
Because a localhost was open from the Internet, sensitive information was leaked. Malicious parties were able to see internal database data. It involved more than one million lines of log streams including chat history, API secrets, backend details, secret keys and other sensitive information.
Because of DeepSeek's rapidly growing popularity, researchers at Wiz investigated the AI chatbot's security. Reportedly, within minutes they had found the ClickHouse database that DeepSeek is connected to. It required no authentication.
"This level of access posed a critical risk to DeepSeek's own security and to its end users," Wiz states. "Not only could an attacker retrieve sensitive logs and actual plain-text chat messages, but they could also exfiltrate plain-text passwords and local files, along with proprietary information, directly from the server using queries."
Click here for Wiz's research.
