DeepSeek’s Unsecured ClickHouse Database Exposes Chat Histories and API Secrets
On January 29, 2025, security researchers at Wiz identified two publicly accessible ClickHouse database instances belonging to DeepSeek, a prominent Chinese AI startup. These databases were left exposed without authentication, allowing unauthorized access to highly sensitive data, including over a million lines of chat histories, API secrets, backend operational details, and internal API endpoints. The exposure also posed a risk of privilege escalation, potentially granting attackers full control over DeepSeek’s backend systems.
The databases were hosted on the domains oauth2callback.deepseek.com:9000 and dev.deepseek.com:9000, both accessible via open ports (8123 and 9000). Wiz’s investigation revealed that these instances were part of DeepSeek’s broader infrastructure, which included around 30 internet-facing subdomains. While most subdomains hosted standard components like chatbot interfaces and API documentation, the exposed ClickHouse databases represented a critical security failure.
ClickHouse, an open-source columnar database developed by Yandex, is commonly used for real-time data processing and log storage. In this case, its HTTP interface allowed direct execution of arbitrary SQL queries without authentication. Wiz researchers accessed the /play path, which enabled them to run queries such as SHOW TABLES;, revealing a table named log_stream containing the bulk of the exposed data.
The log_stream table contained over 1 million log entries, with columns such as span_name, string.values, _service, and _source. These fields exposed plaintext chat histories, API keys, backend directory structures, and operational metadata. The string.values column, in particular, included unencrypted chat messages, API secrets, and internal system details. Additionally, the exposure allowed for potential data exfiltration through queries like SELECT * FROM file('filename'), depending on the database configuration, though Wiz refrained from executing such intrusive queries to maintain ethical research practices.
DeepSeek acknowledged the exposure and secured the databases within an hour of Wiz’s responsible disclosure. However, the incident had significant repercussions, including regulatory scrutiny that led to Italy blocking the app and government bans in other regions. The exposure highlighted broader industry risks, particularly the rapid adoption of AI services without adequate security measures in place.
Implications for AI Infrastructure Security
The incident underscores a critical vulnerability in AI-driven platforms: the accidental exposure of foundational infrastructure components. While much of the discourse around AI security focuses on advanced threats like adversarial attacks or model poisoning, this case demonstrates that fundamental risks—such as unsecured databases—remain a persistent and immediate danger. The exposure of DeepSeek’s ClickHouse instances was not the result of a sophisticated attack but rather a misconfiguration, a failure to implement basic access controls.
AI companies, particularly startups scaling rapidly, often prioritize innovation and deployment speed over security hardening. This rush to market can lead to oversight in securing critical components like databases, APIs, and cloud services. The DeepSeek case serves as a cautionary example of how such oversights can result in the compromise of user data, proprietary information, and internal systems.
The exposure also raises questions about the broader security posture of AI providers. As AI models and platforms become integral to business operations, they often handle sensitive data—user interactions, proprietary algorithms, and operational secrets. The lack of authentication in DeepSeek’s databases suggests a systemic issue: many AI companies may not apply the same security standards as traditional cloud providers or infrastructure services. This discrepancy increases the risk of data breaches, regulatory penalties, and erosion of user trust.
For security teams, the incident highlights the importance of Data Security Posture Management (DSPM). DSPM involves proactive identification and remediation of misconfigurations, exposed assets, and unauthorized access points. In DeepSeek’s case, a DSPM approach could have detected the open ClickHouse instances before they were exploited.
Additionally, the incident aligns with the Zero Noise security approach, which emphasizes attacker-focused detections and minimizing false positives. By adopting this methodology, security teams can prioritize genuine threats—such as exposed databases—over noise, enabling faster and more effective responses. The DeepSeek exposure, though resolved quickly, demonstrates the consequences of neglecting such foundational security practices.
Broader Industry Risks and Regulatory Fallout
The exposure of DeepSeek’s databases had immediate and far-reaching consequences. Italy’s Garante per la protezione dei dati personali (the country’s data protection authority) issued a temporary block on DeepSeek’s app, citing privacy risks stemming from the exposure of user chat histories. Similar regulatory actions were reported in other regions, reflecting growing scrutiny over AI companies’ handling of sensitive data. The incident also contributed to a broader narrative of AI security failures, further pressuring governments and organizations to enforce stricter compliance measures.
From an industry perspective, the case serves as a reminder that AI adoption does not exempt companies from adhering to established security frameworks. Traditional cloud providers and infrastructure services undergo rigorous security audits, penetration testing, and compliance checks. AI startups, however, often operate with less oversight, particularly when scaling rapidly. This disparity increases the likelihood of security oversights, as seen in DeepSeek’s unsecured databases.
The incident also underscores the need for third-party security assessments in AI deployments. Organizations integrating AI tools should conduct thorough security evaluations of their providers’ infrastructure, including database configurations, API security, and access controls. Without such due diligence, businesses risk exposing their own data and systems to similar vulnerabilities.
For DeepSeek specifically, the exposure damaged its reputation at a critical juncture, coinciding with the launch of its DeepSeek-R1 reasoning model—a competitor to OpenAI’s o1 model. Moving forward, AI companies must balance rapid development with robust security practices to avoid similar incidents.
The broader AI industry must take note of this case as a benchmark for security expectations. As AI models and platforms become more integrated into global infrastructure, the risks of data exposure, credential theft, and unauthorized access will only grow. For stakeholders in the AI space, this serves as a call to action: security must be a priority from the earliest stages of development, not an afterthought.