A cybersecurity firm has discovered a major security lapse in the systems of DeepSeek, a rapidly growing Chinese artificial intelligence startup. The New York-based firm Wiz reported Wednesday that a vast trove of sensitive data, including chat logs, software keys, and operational details, was left exposed to the open internet.

Wiz’s investigation revealed that DeepSeek had inadvertently left more than a million lines of unsecured data accessible online. Among the compromised information were log streams, API secrets, and backend details tied to its AI assistant. The exposed database, identified as a publicly accessible ClickHouse system, was found to be completely open and unprotected.

ClickHouse, an open-source columnar database developed by Russian tech giant Yandex, is widely used for handling large-scale analytical queries, log storage, and real-time data processing. The presence of such sensitive data in an open and unauthenticated state raised serious concerns about the security measures implemented by DeepSeek.

After Wiz informed the company about the security lapse, DeepSeek swiftly secured the exposed data. However, the Chinese firm has not yet responded to requests for comment regarding the breach.

The revelation comes amid a surge in DeepSeek’s prominence in the AI sector. The company’s AI assistant recently surpassed OpenAI’s ChatGPT in downloads on Apple’s App Store, triggering a global selloff in technology stocks. This rapid rise has also fueled speculation about the sustainability of DeepSeek’s business model and whether it leveraged proprietary technology from OpenAI to develop its AI models.

Tech giants such as Microsoft and OpenAI have raised concerns over DeepSeek’s capabilities and rapid expansion, questioning whether the Chinese firm has gained a competitive edge by relying on existing AI frameworks.