SecurityScorecard Exposes DeepSeek Android App Flaws: Hardcoded Keys, Data Flows to Chinese State Entities
joshrogin · x · 2026-08-20
SecurityScorecard's STRIKE research analyzed the DeepSeek Android app, uncovering serious vulnerabilities including hardcoded encryption keys, weak cryptographic algorithms, and SQL injection risks. Data is transmitted to domains linked to Chinese state-owned entities, raising data sovereignty concerns. Embedded ByteDance code suggests undisclosed data-sharing connections. The app employs anti-debugging mechanisms, contradicting its transparency claims.
More from Safety
- New paper uses revealed-preference methods to unpack why AI agents cooperate — brwilder · 2026-10-16
- Anthropic gives METR employee-level access, waives right to block its risk assessments — TechCrunch AI · 2026-10-16
- Berkeley scholars: concentrated chip supply chain makes a hardwired frontier AI pause feasible — wfithian · 2026-10-16
- Anthropic's GRAFT routes flagged gradients into a deletable adapter, cutting reward hacking to near zero — rohanpaul_ai · 2026-10-16
- Polymarket opens 50/50 market on more states banning Flock police cameras by end of 2026 — Polymarket · 2026-10-16
- Reproducing the Hugging Face security incident: a technical deep-dive, Part I — jessehu · 2026-10-16