According to security researchers, code found on the website of Chinese AI company DeepSeek has the capability of sending login information from a user to China Mobile. China Mobile is a state-owned telecommunications firm banned from operation in the United States.
Feroot Security, a Canadian cybersecurity firm, found the code on DeepSeek's chatbot web login page and shared it with The Associated Press (AP). Two independent cybersecurity experts later confirmed the existence of the code. The code seems to connect to China Mobile's infrastructure in the process of creating an account and logging in.
DeepSeek data privacy issues have compelled US officials to sound alarm bells since such generative AI systems processes are supposed to be confidential. Security experts fear this might pose a significant intelligence risk, since information transmitted to China Mobile could be misused. AI chatbots like DeepSeek handle a big chunk of personal and business data, which could potentially be misused for data exploitation.
While Feroot's tests in North America did not confirm data transfers to China Mobile, researchers could not rule out the possibility of such transmissions under specific conditions. The analysis focused solely on DeepSeek's web version, leaving the mobile app, currently a top download on Apple and Google app stores, unanalyzed.
China Mobile has been prohibited from operating in the United States since 2019. It happened when the Federal Communications Commission asserted national security risks on account of its ties to the government of China. In 2021, the Biden administration issued sanctions prohibiting American investments in the company due to its connections to the Chinese military.
The discovery could prompt further scrutiny of DeepSeek and other Chinese AI firms operating in the US. As concerns over AI security grow, regulators may investigate whether the chatbot poses a threat to user privacy. Ensuring data security remains a top priority for governments worldwide.