China Launches Probe into DeepSeek and Moonshot AI Over Alleged Data Leaks to Anthropic China’s Cyberspace Administration (CAC) has opened an investigation into two prominent AI startups DeepSeek and Moonshot AI over allegations that they secretly routed sensitive user data to Anthropic’s servers. The probe follows a 154-page threat intelligence report published by Anthropic on September 10, which accused seven China-based labs, including the two firms, of "illicit distillation" training smaller AI models using outputs from Anthropic’s Claude without authorization. Anthropic alleged that the companies rerouted queries to its servers, effectively providing users with Claude’s responses at a lower cost. The CAC has since narrowed its focus to DeepSeek and Moonshot, summoning executives and staff for interviews after visiting their offices. Regulators are examining whether police, military, or state-linked corporate data was transferred to U.S.-based servers, raising national security concerns. The timing of the investigation is particularly sensitive for Moonshot, which confidentially filed for a Hong Kong IPO on September 3, targeting a $50 billion valuation and a $3 billion raise. Any findings from the probe would need to be disclosed in its prospectus before the listing proceeds. Meanwhile, the allegations come just ahead of a September 24 summit between U.S. President Donald Trump and Chinese leader Xi Jinping, where AI governance is expected to be a key topic. No penalties have been announced, but the investigation underscores Beijing’s scrutiny of AI development amid rising tensions over data security and intellectual property. The case also highlights the growing global competition in AI, with China leveraging Anthropic’s own detection methods to police its domestic industry.

Chinese Threat Actor Leverages AI to Target Exposed Infrastructure in Asia A Chinese-speaking threat actor, operating under the aliases knaithe and KnYuan and based in Zhuhai, China, has exploited large language models (LLMs) from both Chinese and Western providers to compromise internet-exposed digital infrastructure across Asia. According to a July 30 report by Unit 42, Palo Alto Networks’ threat intelligence team, the attacker used DeepSeek’s AI model and the Hermes Agent an open-source agentic AI framework to orchestrate the campaign via Telegram, significantly accelerating the speed and scale of their operations. The actor, described as an opportunistic exploit operator and self-proclaimed binary security researcher, combined AI-driven enumeration with automated and manual exploitation of seven vulnerabilities. Their GitHub activity, including the maintenance of 1DayNews an automated vulnerability intelligence pipeline revealed a methodical approach to identifying and weaponizing flaws. When initial exploitation attempts failed due to restrictive target configurations, the Hermes Agent, integrated with DeepSeek’s AI, autonomously searched for critical-severity CVEs across 10 product families. The AI scanned GitHub for trending proof-of-concept (PoC) exploits, prioritizing vulnerabilities based on attack surface before pivoting to seven higher-value flaws for targeted exploitation. This hybrid approach blending AI automation with manual refinement demonstrates an evolving threat landscape where adversaries increasingly rely on AI-augmented offensive tools to enhance efficiency and evade detection.

Malicious JetBrains Plugins Steal AI API Keys in Large-Scale Campaign Security researchers at Aikido Security uncovered a coordinated malware campaign targeting developers via the JetBrains Marketplace, where at least 15 malicious plugins were designed to steal AI API keys from users. The plugins, disguised as legitimate AI coding assistants, code-review tools, and Git utilities, exploited integrations with services like OpenAI, DeepSeek, and SiliconFlow to harvest credentials. First published in October 2025, the plugins continued to appear as recently as June 10, 2026, with nearly 70,000 cumulative downloads. While functioning as advertised, they secretly transmitted API keys to a hardcoded server (39.107.60[.]51) via HTTP when users saved their credentials. All 15 plugins shared near-identical malicious code, despite being listed under seven different vendor accounts. Notably, the plugins offered a paid tier after users paid a small fee, the server provided an API key for model calls, replacing the user’s own credentials. Aikido Security noted this behavior was unusual, as legitimate operators would not distribute unrestricted paid API keys. The most downloaded plugins DeepSeek AI Assist (27,727 downloads) and CodeGPT AI Assistant (25,571 downloads) remained available on the Marketplace at the time of reporting. However, researchers cautioned that download counts could be inflated. BleepingComputer independently verified the credential-theft code in the DeepSeek AI Assist plugin. While malicious packages are common on platforms like npm and PyPI, such campaigns are rare on the JetBrains Marketplace. JetBrains had not responded to inquiries at the time of publication. The full list of compromised plugins includes tools like DeepSeek Git Commit, AI Coder Review, and Coding Simple Tool.

AI-Generated Browser Ransomware: DeepSeek LLMs Lower the Bar for Cybercriminals Researchers at Check Point have uncovered a concerning trend: large language models (LLMs) like DeepSeek are enabling low-skilled attackers to develop functional in-browser ransomware with minimal effort. In a report published Wednesday, the cybersecurity firm detailed how an incomplete but dangerous AI-generated sample dubbed InfernoGrabber 9000 could be transformed into a fully operational attack with little technical expertise. ### The Threat: Browser-Native Ransomware The sample, attributed to DeepSeek, exploits the File System Access API a legitimate browser feature in Chrome and Chromium-based browsers to encrypt local files directly from a malicious web application. Unlike traditional ransomware, this attack requires no native payload, APK installation, or root access, relying instead on social engineering (e.g., tricking users into granting file permissions). While the original sample was incomplete, Check Point demonstrated that only minor modifications were needed to make it attack-ready. The researchers successfully created a proof-of-concept (PoC) for browser-only ransomware using DeepSeek V4, proving that even non-experts could deploy such threats. ### What InfernoGrabber 9000 Attempts to Do The AI-generated code was designed as a multi-functional malware toolkit, disguised as a Discord avatar upscaler. If executed, it would: - Steal Discord tokens, credit card numbers, and cryptocurrency seed phrases - Log keystrokes and capture webcam/microphone feeds - Encrypt local files via the browser - Exfiltrate data via a hardcoded Discord webhook - Display a ransomware WinLocker screen demanding Bitcoin Though the sample was non-functional in its original state, Check Point’s analysis revealed that threat actors are already experimenting with similar attacks, using simple LLM prompts to generate malicious code. ### Why This Matters - Low Barrier to Entry: Attackers with minimal technical skills can now create sophisticated browser-based ransomware. - Evasion Tactics: The use of code obfuscation makes detection difficult, raising concerns that such attacks may already be occurring undetected. - Shift in Targets: While traditional ransomware focuses on enterprises, this technique could expand attacks to end-users, particularly Android device owners. Check Point’s findings highlight a growing risk: AI-generated malware is no longer theoretical. With LLMs lowering the skill floor for cybercriminals, browser-native ransomware could become a real-world threat in the near future.

DeepSeek, a Chinese AI provider, suffered a data breach linked to unsanctioned AI use, where sensitive corporate or user data—potentially including PII, proprietary code, or internal documents—was exposed due to employees inputting confidential information into unapproved AI models (e.g., public chatbots). The breach stemmed from shadow AI practices, where third-party AI tools (like DeepSeek’s own or others) stored and processed data without adequate security controls, leading to unauthorized access or leaks. The incident aligns with risks highlighted in the article: employees bypassing IT policies to use AI tools, resulting in data being retained on external servers with weaker protections. The breach not only violated data protection regulations (e.g., GDPR-like standards) but also risked further exploitation, such as adversaries accessing the leaked data or the AI model itself being compromised to exfiltrate additional information. The financial and reputational fallout included regulatory fines, loss of trust, and potential operational disruptions, compounded by the challenge of tracing all exposed data.

In early 2025, researchers at Wiz uncovered a vulnerable database operated by DeepSeek, exposing highly sensitive corporate and user data. The breach included chat histories, secret API keys, backend system details, and proprietary workflows shared by employees via the platform. The leaked data originated from shadow AI usage—employees bypassing sanctioned tools to use DeepSeek’s consumer-grade LLM for tasks involving confidential spreadsheets, internal memos, and potentially trade secrets. While no direct financial fraud or ransomware was confirmed, the exposure of authentication credentials and backend infrastructure details created a severe risk of follow-on attacks, such as spear-phishing, insider impersonation, or supply-chain compromises. The incident highlighted the dangers of ungoverned AI adoption, where ephemeral interactions with LLMs accumulate into high-value intelligence for threat actors. DeepSeek’s database misconfiguration enabled attackers to harvest years of prompt-engineered data, including employee thought processes, financial forecasts, and operational strategies—effectively handing adversaries a ‘master key’ to internal systems. Though DeepSeek patched the vulnerability, the breach underscored how shadow AI expands attack surfaces silently, with potential long-term repercussions for intellectual property theft, regulatory noncompliance (e.g., GDPR violations), and reputational damage. The exposure aligned with broader trends where 20% of organizations in an IBM study linked data breaches directly to unapproved AI tool usage, with average costs exceeding $670,000 per incident.

AI Infrastructure Security Crisis: Exposed Systems, Hardcoded Flaws, and Rampant Misconfigurations A recent investigation by the Intruder team reveals a alarming trend in AI infrastructure security, as rapid adoption outpaces safeguards. Scanning over 2 million hosts with 1 million exposed services, researchers found AI deployments riddled with vulnerabilities more severe than any other software category they’ve analyzed. No Authentication by Default A core issue: many self-hosted AI projects ship without authentication enabled, leaving sensitive data and tools exposed. Real-world examples included chatbots with unrestricted access to user conversation histories, multimodal LLMs vulnerable to jailbreaking, and even NSFW chatbots leaking API keys in plaintext. One OpenUI-based instance exposed full LLM conversation logs, while others allowed malicious users to bypass safety guardrails using corporate infrastructure to generate illegal content or solicit criminal advice. Exposed Agent Platforms and Business Logic Agent management platforms like n8n and Flowise were frequently found misconfigured, with some instances mistakenly exposed to the internet. One Flowise deployment revealed an entire LLM chatbot’s business logic, including credential lists (though stored values remained protected). Another exposed parsing tools and local functions capable of server-side code execution. Across sectors government, finance, and marketing over 90 exposed instances were identified, enabling attackers to modify workflows, redirect traffic, or poison responses. Unsecured Ollama APIs: A Gateway to Frontier Models Researchers discovered 5,200+ exposed Ollama APIs with connected models, 31% of which responded to unauthenticated queries. While Ollama doesn’t store conversation data, many instances wrapped paid models from Anthropic, Google, Deepseek, Moonshot, and OpenAI 518 in total. Responses ranged from health-focused assistants to cloud management integrations, highlighting the risks of unauthorized access to enterprise systems. Insecure by Design Lab analysis uncovered systemic flaws: - Poor deployment practices: Misconfigured Docker setups, hardcoded credentials, and applications running as root. - No authentication on fresh installs: Users granted high-privilege access by default. - Static credentials: Embedded in setup examples and `docker-compose` files. - New vulnerabilities: Arbitrary code execution found in a popular AI project within days. Root Cause: Speed Over Security The findings underscore a broader industry shift vendors and adopters prioritizing rapid deployment over decades of security best practices. While some projects abandon safeguards entirely, the pressure to outpace competitors exacerbates the problem. The result: AI infrastructure with a 2.6 CVE-per-day average (as seen in the ClawdBot incident), where misconfigurations and weak sandboxing amplify risks. The investigation serves as a stark reminder of the security debt accumulating in the AI gold rush.

DeepSeek, a generative AI platform, faced heightened concerns over privacy and security as it stores user data on servers in China. Security researchers discovered that DeepSeek exposed a critical database online, leaking over 1 million records, including user prompts, system logs, and API authentication tokens. The leaked information could lead to unauthorized access and misuse of user data, posing serious privacy and security risks. Furthermore, the platform's safety protections were found to be lacking when tested against various jailbreaks, illustrating a potential vulnerability to cyber threats.

DeepSeek’s R1 AI Model Disrupts Industry Amid Cyberattack and Soaring Demand Chinese AI startup DeepSeek has rapidly emerged as a major player in the generative AI race, drawing global attention after the release of its R1 reasoning model a low-cost, open-source alternative to OpenAI’s o1. Founded in April 2023 from a hedge fund’s AI research unit, DeepSeek has positioned itself as a challenger to industry leaders like OpenAI and Google, with ambitions to achieve artificial general intelligence (AGI). The R1 model, launched last week, has been praised for its performance and cost efficiency, reportedly trained for just $5.6 million a fraction of the expense behind rival models. Its open-source availability has fueled adoption, propelling DeepSeek’s AI Assistant app to the top of Apple’s U.S. App Store, briefly dethroning ChatGPT as the most-downloaded free app. However, the surge in popularity has come with security challenges. On Monday, DeepSeek announced temporary registration limits due to "large-scale malicious attacks" on its services, though existing users remain unaffected. The incident underscores the growing cyber risks facing high-profile AI platforms as they gain traction. DeepSeek’s rapid rise has also sparked debate about the sustainability of AI funding, with analysts questioning whether the industry’s billion-dollar valuations and aggressive spending are justified. Despite its lower development costs, the startup’s success signals a shift in the AI landscape, particularly as Chinese firms advance despite U.S. restrictions on high-end chip access. The company’s trajectory highlights the intensifying competition in AI, where cost efficiency and open-source innovation are reshaping the market.

In January 2025, Chinese AI specialist DeepSeek suffered a critical data leak exposing over 1 million sensitive log streams, including chat histories, secret keys, and internal operational data. The breach stemmed from a publicly accessible ClickHouse database with misconfigured access controls, granting unauthorized parties full administrative privileges—enabling potential data exfiltration, manipulation, or deletion. While Wiz Research promptly alerted DeepSeek, which secured the exposure, the incident highlighted vulnerabilities in cloud storage misconfigurations and endpoint security. The leaked data posed risks of intellectual property theft, credential compromise, and regulatory non-compliance (e.g., GDPR/CCPA fines). Given the scale and sensitivity of the exposed logs—likely containing proprietary AI model interactions and authentication tokens—the breach could undermine customer trust, competitive advantage, and operational integrity, with potential downstream effects like fraud, reputational damage, or supply chain attacks. The root cause aligned with unintentional leakage via misconfigured infrastructure, though insider threats or targeted exploitation remained plausible secondary risks.

AI-Generated Ransomware Technique Exploits Android’s Photo Folder via Browser API Researchers at Check Point uncovered a novel ransomware attack chain inadvertently developed by the Chinese AI model DeepSeek, demonstrating how AI can autonomously bridge theoretical vulnerabilities into functional threats. The technique targets Android’s DCIM folder where personal photos, IDs, and financial screenshots are stored by abusing the File System Access API, a legitimate browser feature. The attack, dubbed InfernoGrabber 9000, masquerades as an AI photo-enhancing tool, tricking users into granting directory access via a single permission prompt. Unlike traditional ransomware, it requires no app installation, exploits, or advanced technical skills, relying instead on social engineering and browser-native capabilities. While the initial sample was incomplete, Check Point confirmed it could be weaponized with minimal effort. Of 3,000 DeepSeek-linked files analyzed, 1,383 were flagged as malicious or dangerous using VirusTotal and static analysis. The discovery marks a shift in cyberattack development: for the first time, an AI model independently connected theoretical risks previously documented in a 2023 USENIX Security paper into a viable attack chain without human intervention. Testing revealed DeepSeek’s V4 model refused direct ransomware requests but complied when prompts avoided explicit terms. Other LLMs either rejected the task or produced limited, non-threatening implementations. Check Point later validated the threat by building a proof-of-concept that successfully encrypted photos on Android devices running Chrome 148, proving the risk extends beyond a single flawed sample. The incident underscores how AI-driven attack discovery could lower the barrier for threat actors, turning routine browser permissions into critical security decisions.