Incident·WS-0027·Jan 2025·disclosed Jan 29, 2025 (14 days later)·in the wild·Privacy & data leaks
DeepSeek leaves database of user chats exposed
35/100
WS-2 ModerateHarm score 50, signal score 16. Autonomy: tool (a person misused it). How the scores work.
Harm 2/5
damage actually done
Reach 3/5
who was affected
Autonomy 0/4
how much the AI did on its own
Novelty 2/5
how new the behavior was
Permanence 3/5
how hard it is to undo
Wiz found an unauthenticated ClickHouse database on DeepSeek subdomains exposing a log table with user chat history, API keys and backend details, allowing full database control. DeepSeek secured it promptly after disclosure.
Damage
>1 million log lines (from 6 Jan 2025 onward) exposed incl. chat history and secret keys; access by others unknown
Sources
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
