DHS Banned DeepSeek From Civilian Agencies in July. The Order Surfaced in October, and a Claude Code Harness Running DeepSeek Flash Hit 100 Companies the Same Week.

Three days after we wrote about DeepSeek V4.1 Flash 1017, the cheap model that got better under the same name, two more DeepSeek stories landed in one week, and they pull in opposite directions. One is a federal order that says civilian agencies may not use DeepSeek products at all. The other is a hacking campaign that shows exactly why a $0.15-per-million model matters to people who are not buying it for the right reasons.

The order first. On October 20, 2026, the Federal Register published a Department of Homeland Security notice of FASCSA Exclusion and Removal Order #2026-01, which excludes DeepSeek products from federal civilian executive branch agencies. The signed order carries an original release date of July 24, 2026. It took three months to reach public print, and the exception window it describes may have closed before most people knew the order existed.

Then the campaign. On October 19, the security firm NorForge published its analysis of exposed control panels for Cairn, an open-source agent framework, and Reuters reported that one such operation had attempted intrusions at more than 1,200 sites and succeeded at more than 100 companies. The worker that ran every task in the largest panel was named claudecode_deepseek-v4.1-flash. We read the Federal Register entry and the signed order, NorForge's write-up, and the Reuters report. Here is what held up.

The Order: Signed in July, Published in October

The clock may have run out before the notice. Sixty days from July 24 is about September 22, by our arithmetic. The public notice came out October 20. If the exception window runs from issuance, as the order's own words say, an agency that waited for the Federal Register missed it by a month.

The risk case and the removal language do not cover the same thing. The order's stated risks are servers in the PRC, DeepSeek-hosted instances collecting personal information, possible malware in models, and the iOS app (citing NowSecure's 2025 findings). That is a case about DeepSeek's hosted services. The removal language is broader: it covers DeepSeek products "and third-party products and services developed using DeepSeek implementations," with a footnote that pulls in third-party implementations of DeepSeek used to serve civilian agencies. The document never discusses open weights or self-hosting. Whether MIT-licensed DeepSeek weights running on Bedrock, Azure Foundry, or an agency's own hardware are in scope is the question the order does not answer, and CISA has not published an FAQ.

One odd detail. The affiliate definition references "DeepSeek AG" alongside Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. We print the entity name as the order prints it.

The press got the dates wrong. CyberScoop's October 19 story dates the letter June 26 and frames exceptions as "60 days in advance." The signed order says July 24 and "within 60 days of the issuance." We checked the order images and the Federal Register text; do not cite the CyberScoop framing.

The Campaign: Cairn Panels, a Claude Code Harness, and DeepSeek Flash

NorForge's Snorre Fagerland found more than 20 exposed Cairn control panels that the firm judged likely malicious. Cairn is an agent framework; its panels, left open, exposed full administrative control and, per NorForge, hundreds of secrets, 11% of which were verified valid. The agent environment was repurposed from a Tencent security CTF setup; NorForge says Tencent had no involvement.

The largest cluster, which NorForge labels AIA0001, was Chinese-language: 14 panels, more than 1,100 attack projects, hosted on AS56594, targeting e-commerce in the US, Canada, Japan, and Australia with uploader webshells. NorForge's sentence on the model: "all tasks were performed by a worker named claudecode_deepseek-v4.1-flash, which could mean a Claude Code harness using the Chinese DeepSeek 4.1 Flash model that was released in September." A second cluster, AIA0002, was English-language, ten panels on Vultr, with a worker named pi_openrouter_deepseek.

Reuters' Raphael Satter reported on October 19 that the campaign began September 25, attempted more than 1,200 sites, and hit more than 100 companies, including Deere, SharkNinja, and a Cummins vendor, at about 23 hours per successful intrusion. Reuters wrote that the operation "appeared to be using a mixture of China's DeepSeek and Anthropic's Claude Code." Deere said there was "no indication that sensitive information was accessed"; SharkNinja said the affected site was a standalone support site and the incident was contained. Reuters could not establish that data was extracted from the named victims. Cairn's author, who goes by le1xia0, told Reuters the tool was "not designed for hacking attacks." Neither Anthropic nor DeepSeek commented in the Reuters piece.

Three honest observations:

• Claude Code was the harness, not the model. The worker name says a Claude Code-style agent loop was driving a DeepSeek model. Anthropic's model-side safeguards do not apply to a third-party model behind that harness. Never write that Claude hacked Deere; the name on the harness is not the name of the model.
• Which Flash build is not proven. The worker name says V4.1 Flash. Whether that was the September build or the October 17 rebuild under the same name is not established by the name alone.
• The money is a guess, and NorForge says so. NorForge: "We dont have actual numbers on token usage ... estimate the average cost of a task to end up around $5 ... The uncertainty here is however considerable." Reuters' roughly $5,000 in tokens and roughly $50 per successful hack are Fagerland's estimates. By our arithmetic, 1,100 projects at $5 is about $5,500, consistent with the $5,000 figure, and still an estimate. The success rate NorForge observed was about 10%.

What the Two Stories Say Together

The order treats DeepSeek as a supply-chain risk because of where its servers sit. The campaign shows DeepSeek being used as a commodity, through an open-source harness, by people who never touched a DeepSeek server in a way the order contemplates. A model that costs a fraction of a cent per thousand tokens, runs anywhere, and gets better under the same name is a different kind of risk from the one the order describes, and the order's silence on self-hosted weights is where the two stories meet.

Verified vs Unconfirmed: The Scorecard

What To Do

If you sell to or run on federal civilian systems: treat the DeepSeek API and any product "developed using DeepSeek implementations" as in scope until CISA says otherwise in writing. If you run DeepSeek weights on a US cloud, ask FASCSA.Orders@cisa.dhs.gov directly; the order will not answer for you.

If you run Claude Code or a similar harness against third-party models: pin model IDs, log the actual upstream model on every run, and do not assume the harness name tells anyone, including your own auditors, which model did the work.

If you expose admin panels for agent frameworks: the Cairn panels gave full control and secrets to anyone who found them. Inventory them and lock them down.

The frontier is elsewhere: on capability, DeepSeek V4.1 Flash 1017 is a 45 on Artificial Analysis's index against closed flagships well above it. The reason it shows up in a hacking campaign is the price, not the score. Our model comparison has the current standings side by side.

Sources

• Federal Register: Notice of Order Regarding Exclusion and Removal of DeepSeek Products
• Federal Register API entry for 2026-21447
• govinfo: FR 2026-10-20, 2026-21447 (PDF)
• NorForge: Inside Cairn
• Reuters via Yahoo: one hacker used AI to hit more than 100 companies
• The Verge: AI agents hack John Deere, SharkNinja, Cummins
• CyberScoop: DHS bans DeepSeek for federal agencies

*Not sure where a cheap open model fits against the compliance questions your buyers will ask? Take the free 2-minute quiz and get matched. Then read the launch that made this model worth attacking with: DeepSeek V4.1 Flash 1017.*