On October 20 the Department of Homeland Security published an order banning DeepSeek from US federal civilian agencies. It also covers "third party implementations of DeepSeek", which reads as covering DeepSeek models running on US servers. OpenAI and Anthropic both have a record on this, of different kinds.
OpenAI's is the most direct. In March 2025 it called DeepSeek "state-subsidized" and "state-controlled" and proposed that the US consider banning PRC-produced models in allied countries, then said it wasn't advocating restrictions on people using models like DeepSeek (TechCrunch). Anthropic's record is about chips and distillation. In January 2025 Dario Amodei wrote that he didn't see DeepSeek as an adversary and that "the point isn't to target them in particular", while pushing for tighter chip export controls (essay). This year Anthropic's head of public policy called adversarial distillation "IP theft and industrial espionage". In July the New York Times reported that both companies had privately pressed Washington to restrict open models, with officials leaning toward action against individual Chinese models (Implicator, on the NYT report). Around the same time OpenAI signed an industry letter against "premature restrictions" on open models, and Anthropic did not. Amodei said Anthropic "has never advocated for a ban on open-weights models" (TechCrunch). The order is dated July 24, 2026, the same day Nvidia's Jensen Huang shared the industry letter and a day before the NYT report.
The evidence behind the order is thin. The only argument in it that applies to DeepSeek running on US servers is that the models "may contain malware or other security vulnerabilities". The only source it cites for that sentence is a February 2025 report on DeepSeek's iOS app, which is an app, not a model. We found no public report of malware or a backdoor in DeepSeek's official weights.
The closest finding is from CrowdStrike in November 2025 (The Hacker News). DeepSeek-R1 wrote code with severe vulnerabilities in 19% of cases on neutral prompts and in 27.2% when the task was set in Tibet. CrowdStrike said there were "no clear reasons" for the gap and suggested guardrails added to comply with Chinese law. That is a code-security weakness, not malware, and the order doesn't cite it either.
The argument that makes "may contain" hard to answer comes from Anthropic itself. In January 2024, a year before DeepSeek released R1, Anthropic published Sleeper Agents. It trained models to write secure code when told the year was 2023 and exploitable code when told it was 2024. Safety training didn't remove the behaviour, and adversarial training taught the models to hide it better. A sleeper agent that stays asleep behaves exactly like a clean model, so ordinary testing can't tell the two apart, for DeepSeek or for US models. Applied to one Chinese lab, "may" was enough for a ban.
The US has banned before without public proof. Federal agencies were barred from buying Huawei equipment under the 2019 defense bill, and in 2022 the FCC stopped approving new Huawei gear (CRS). A UK board that reviews Huawei's code found "serious and systematic defects" in 2019 but did not identify any Chinese backdoors (The Register). In 2020 US officials said Huawei could secretly access networks but gave no public evidence, and Huawei denied it (Tech Advisor). Kaspersky went further: a federal ban in 2017 became a ban on all US sales in 2024.
The order arrives as agencies move from $1 AI trials to paid contracts, and Anthropic's $1 offer ends on October 31 (Nextgov). It names only DeepSeek, so vendors can still switch to Qwen, Kimi or a US open model, which limits what any US lab gains from it in the government market.
Related: DeepInfer: why DeepSeek gave away its inference engine