The biggest DeepSeek story of the week broke today — and it was actually decided in July.

Homeland Security Secretary Markwayne Mullin signed Exclusion and Removal Order #2026-01 on July 24, directing every civilian executive branch agency to stop buying DeepSeek products and strip existing ones from their IT systems. The department only filed the public notice on Monday, October 19, ahead of formal Federal Register publication on Tuesday, according to Engadget. Reuters, Bloomberg, the Wall Street Journal, CyberScoop and Quartz all reported the notice.

The order, issued under the Federal Acquisition Supply Chain Security Act of 2018 on the recommendation of the Federal Acquisition Security Council, covers products from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates — and goes further than a name ban. Agencies must also remove "third-party products and services developed using DeepSeek implementations," Reuters reported, meaning any vendor tool built on DeepSeek's models has to go too.

The rationale is blunt. DHS says DeepSeek's models present "multiple threat vectors," warning their use "may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors," that prompts could be combined with public records to produce "actionable intelligence on US persons," and that "the models themselves may contain malware or other security vulnerabilities."

Two details matter more than the headline. First, the 60-day exception window counted from the order's July issuance — meaning it had effectively closed before the public ever saw the notice. Second, the "built on DeepSeek" clause turns this into a vendor-audit problem: for open-weight models anyone can fine-tune or distill, every federal contractor now has to prove nothing in its AI stack traces back to DeepSeek's weights.

None of this came out of nowhere. The Commerce Department and the Navy had already banned DeepSeek on government devices, and several states — New York, Tennessee, Virginia — took similar steps. Meanwhile the decoupling keeps widening: the FCC votes October 29 on barring Chinese labs from certifying electronics for US use, and December brought import bans on new Chinese drone and consumer-router models.

There's an irony in the timing, too. The ban went public days after DeepSeek released V4.1-Flash-1017 — the same model Chinese rival MiniMax measured its own new M3.1 Flash against on Monday. Washington treats DeepSeek as a supply-chain risk. The industry treats it as the price to beat. Both of those things can be true at once.

— via Engadget