Deepseek exposes your chat logs to hackers

0:00 now some of you may know deep seek as the AI that brought Gamers Joy not because they like the AI but because it crashed the Nvidia stocks allowing people to finally afford a 3-year-old GE Force card it's the biggest competitor Chad GPT has seen and it's from China so don't ask it what happened in tenan square but you might want to think about asking it anything because recently they exposed their database with over a million chat records and this was data that hackers could have accessed and could be on the dark web now the reason I want to talk about this more is because this could be a problem in all future AI models including chat GPT so you have to be very careful about the type of information that you're typing in as the search queries because a lot

0:45 of the people using these platforms they're using it for personal reasons they're using it to summarize a document for them and those documents could include personal details and if that information ends up being public or as in this case if it was stored in plain t text form along with the API Keys backend details you could be in trouble if all of that data ends up on the dark web let me show you what I mean so let's say we open up chat GPT one of the first things that kind of shows up is summarize text and if I say summarize look at the kind of things people are summarizing summarize my lease agreement you know the information that's in your lease agreement your name your address your phone number it literally has all the details of where you live the condition of the house how to get in how

1:31 many keys there are and if you are submitting this information in plain text online like you're putting a lot of trust in the company to secure your data and if they don't you could be in big trouble if that data is on the dark web so do not use Chad GPT to summarize your lease agreement and definitely not deep seek from China and judging from the description this was not a very sophisticated hack even they actually publicly exposed their database so anyone could go to this URL and type in an SQL command so SQL is structured query language it's kind of like a command line version of excel so you could type in select this data from this table and it would give you back the answer and it did not require

2:16 authentication now what's also concerning is that this data is easily accessible so even if they locked it now cuz they have it means that one of their employees could easily get it and the data that was exposed included a log stream table and this includes user queries to deep seeks chat bot so if you went on their website type something in it could be there keys used to authenticate the API calls so if you're a developer using this then you might want to reset your keys and the rest is kind of like their internal information which we don't care about unless of course it gets them hacked or infiltrated by ransomware and then all of your data ends up being public but what's also concerning is not only could an attacker retrieve sensitive logs they could also potentially filtrate plain text passwords using the simple select

3:04 star from file command here's some uh screenshots of the tables that you can get back so you just say select star from logstream limit 10 and you get the answer back it's amazing what you can still do with basic SQL knowledge in 2025 now this hack was discovered by researchers thankfully but who knows I mean hackers may have done it just not disclosed it yet as it says it's unknown if whiz researcher were the first to discover this exposure or if malicious actors have already taken advantage of the misconfiguration now despite deep seek being from China One of the benefits of using it is you can actually download it try to run it locally which gives you some privacy but I would seriously warn against using a lot of personal information when using chat

3:50 Bots and let's say you want to get advice get advice on salary negotiation get advice on moving to a new city again a lot of these questions could have personal details like your addess you don't want to be sending that information not just because the company may just sell it which let's be honest if you're using things like deep seek we have no idea what their goals are or even with Chad GPT given that open AI has changed its Mission and goal several times when thinking about using AI a lot of the time I think about malm from Jurassic Park they were so preoccupied with whether or not they could they didn't stop to think if they should and a lot of people are doing that with AI they're using it as a toy doesn't matter if it actually is better doesn't matter if they actually need it it they're like oh cool let me send it my lease agreement let me ask it to design my house and if you're sending large

4:36 volumes of personal information and it turns out the AI company actually exposed their database publicly you will have a lot to worry about if any of you are using AI tools like chat GPT and I know many of you are make sure you get rid of any personal information before sending in your queries I do think there needs to be more discussion on what kind of data goes into AI because a lot of people are even using it for things like mail Automation in which case again if that gets hacked and we have seen instances I've been to conferences where I've seen actual hacks of email clients using AI that allows attackers to basically send any email they want on your behalf things like that could be used for ransom there's a lot of potential for Bad actors and as more and more small companies just keep adding AI stuff things are going to break hackers are going to have a f day and you don't

5:22 want to be one of those people who ends up being the victim so be very careful about the AI tools you're using what kind of data they have access to and don't just blindly trust them with everything now I wanted to see what else we can find on this so I'm doing a search here on flare which is going to look at private chat rooms telegram the dark web and one of the first things that comes up is very interesting so apparently Korea's interior Ministry warns against deep sea because of the data leak concerns and this was posted in a chat room cyberspace monitoring we can also see discussions here of deep seek opening the registrations and we can look at the categories here so we've got references in the open web elicit networks of course for Chan things Trump will ban deep seek we've also got a post

6:07 in Russian here seems like most of discussions are telegram chat rooms but of course if any of your data is leaked let's say you put in your email address or some kind of personal information you could do a search and flare I'm just going to type in the p security Channel as an example but it's going to tell you where your name is being mentioned if it's out there in dark web forums if it's on GitHub so if you want to keep an eye on the dark web flare is an interesting platform to check out they are the sponsor of this video and a lot of our other educational content so if you'd like to monitor the dark web for any kind of information about your devices being compromised you can check them out using link in description if you're an organization this is actually a great way to know if any of your employees have been compromised and take action early but again I hope you

6:53 enjoyed this video please like and share it if you did and thank you all so much for watching this is Le and as always stay informed stay secure