DeepSeek left ClickHouse databases holding chat logs open to the internet

DeepSeek, the Chinese AI company known for its DeepSeek-R1 model, left two databases reachable from the open internet, exposing user chat histories, API keys and internal operational data. The exposure was reported on 30 January 2025, after the cloud security firm Wiz found it and alerted the company, which then took the databases offline.

What happened

Wiz Research came across two ClickHouse instances, at oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000, that accepted arbitrary SQL queries through a web interface and asked for no credentials at all. A logging table inside them held internal records going back to 6 January 2025.

Impact

According to BleepingComputer, the unsecured instances held more than a million log entries, with user chat history stored in plaintext alongside API keys, backend details and operational metadata. TechCrunch reported that no password protected the database, so anyone online could read the unencrypted logs. Two things remain unknown from public reporting: whether any party other than Wiz reached the data before it was locked down, and how long it had been exposed. Wiz said it could have run more intrusive queries but kept its work to enumeration.

Response

Once Wiz notified DeepSeek, the company closed the exposure and the databases stopped being publicly reachable. DeepSeek gave no answer when TechCrunch asked for comment.

Lessons for security leaders

• AI services sit on ordinary infrastructure. An analytics store on a forgotten port can leak prompts just as easily as any other log system.
• Before staff send business data to a new model provider, ask where prompts and logs live, who can query them, and how the vendor watches its external attack surface.
• Assume anything pasted into a third-party chatbot may end up in a log, and write usage policy with that retention risk in mind.
• Put AI vendors into third-party risk reviews and external exposure monitoring, not only into model-quality evaluations.