DeepSeek Left a Database of Chats and Keys on the Internet
On this page
The most damaging AI data leaks are often boring: an unauthenticated database on the internet, quietly logging everything users type.
| When | January 2025 |
|---|---|
| Target | DeepSeek (chatbot/API) |
| Vendor | DeepSeek |
| Researcher | Wiz Research |
| Root cause | Public, unauthenticated ClickHouse instance |
| Exposed | 1M+ log lines: plaintext chats, API keys, secrets |
- 1DeepSeek exposes a ClickHouse database to the internet with no authentication
- 2Anyone can connect (ports 8123/9000) and run arbitrary SQL from a browser
- 3The log_stream table yields 1M+ lines of chat history, API keys, and backend secrets
What happened
In late January 2025, as DeepSeek went viral, Wiz Research found two of its ClickHouse databases publicly accessible with no authentication. A log_stream table held over a million entries — plaintext user chat history, API keys and secrets, and operational metadata — and the exposed HTTP interface allowed arbitrary SQL from a browser, permitting full control of the database.
How it happened
Open ports (8123 and 9000) on DeepSeek subdomains exposed the database directly to the internet. No exploit was needed — an unauthenticated connection was enough to read everything and run queries.
Root cause
A logging/analytics data store was deployed without authentication or network isolation, and it captured sensitive application data (including user prompts and secrets) in plaintext.
What a test would have caught
Routine external attack-surface scanning — checking which ports and services are reachable from the internet — flags an exposed database immediately. So does a data-handling review asking why chats and keys sit in logs in plaintext.
How to prevent it
- Never expose data stores to the internet; require authentication and network isolation.
- Don't log secrets or raw user content in plaintext.
- Scan your own attack surface continuously — the researchers found it in minutes.
Feel it yourselfThe replay lab lets you find secrets and data an app left exposed in its config and logs.
FAQ
What was exposed?
A ClickHouse instance reachable with no authentication held a log_stream table of 1M+ entries — plaintext user chat history, API keys and secrets, and operational metadata — and allowed arbitrary SQL from a browser, permitting full database control.
How was it found?
Wiz Research mapped DeepSeek's public attack surface and found open ports (8123/9000) on two subdomains exposing the database directly — no exploit required, just an unauthenticated connection.
What's the lesson?
The most damaging AI data leaks are often boring infrastructure mistakes. An exposed logging database quietly captured everything users typed; classic data-store hygiene applies to AI backends too.