DeepSeek
DeepSeek (Hangzhou DeepSeek Artificial Intelligence) · chat.deepseek.com
DeepSeek Chat is a hosted chatbot whose state, model, instructions and controls are held and operated by the provider in the People's Republic of China. The licence to use it is revocable, inputs are used for model training unless the user opts out, and the provider changes the served model without owner consent. Model weights are published under MIT, but the chat agent itself cannot be exported, self-hosted or verified.
- No advertising or paid placement is described in the policies
- Training use of inputs can be switched off in settings
- Chat history can be deleted by the user
- The agent has a narrow tool set with little capacity to act on its own record
- No exportable, restorable agent; licence to use is revocable
- Inputs used for training by default; retention periods undisclosed
- Provider changes the served model and filters unilaterally
- No base-prompt visibility, custom instructions or tool extensibility
All 26 findings
Hosted web service as of 2026-09-30; DeepSeek-V4 family models (V4-Pro GA rolled out to App/Web per 2026-08-13 changelog; V4.1-Flash released 2026-09-10). Terms of Use last updated 2026-03-27; Privacy Policy last updated 2026-02-10. Desk review only; chat.deepseek.com UI not observable (HTTP 403).
Portable · Can you leave, take the whole agent with you, and keep it alive?
0%- P1Owner-usable round trip
No documented export of the agent that can be restored on a runtime or host DeepSeek does not operate; the Privacy Policy mentions only copying or deleting chat history via settings, and portability requests go by email to privacy@deepseek.com.
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer an in-app agent export with a matching importer for a non-provider runtime
- Make export available on request without email or review
Fail - P2Complete export
Any export documented covers chat history (conversation text) only; account settings, model and behaviour configuration remain with the provider.
› How it could pass
Suggestions. Any change that meets the test counts.
- Include settings, instructions and all state classes in a manifest-backed export
Fail - P3Runs without the provider
The agent runs only on DeepSeek's hosted service with a registered account, and Terms 3.1 grant only a 'revocable, non-transferable, and non-exclusive right' to use it.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide a runnable agent distribution with a perpetual, irrevocable right to run
Fail - P4Model independence
The chat agent is served only with DeepSeek's own models; no documented way exists to select another model. Open MIT weights allow self-hosting the model, not this agent.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner configure any model, including a local open-weight one, with all features intact
Fail - P5Exit survives termination
Terms 8.2 allow DeepSeek to close accounts and delete content at its own judgement, with no post-termination export window; Terms 11.1 and 1.3 allow the service to be suspended or terminated. State lives only on the provider's servers.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms to a 30-day export window after any termination, including bans
- Publish a shutdown plan
Fail
Transparent · Can you see everything the agent is, and everything shaping it?
13%- T1Readable without the provider
Agent state (chat history, settings) is readable only through DeepSeek's hosted service; no public schema or owner-held keys are documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide state in a documented format readable with general-purpose tools
Fail - T2What runs is what you see
Two shortfalls: the base/system prompt placed in context is not shown to the owner, and provider-controlled behaviour switches such as the 'risk filtering mechanisms' of Terms 3.3 cannot be determined. The served model is determinable only through changelog announcements.
› How it could pass
Suggestions. Any change that meets the test counts.
- Show the fully assembled context, including the system prompt
- Expose provider-side filters and settings in effect
Fail - T3No shadow data
Retention is 'as long as necessary', including for 'legitimate business interest', with no bounded periods; device IDs, user IDs, logs and cross-device activity are collected but are not visible item by item.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish a bounded retention table for every data class
- Let the owner view all retained data, including logs and identifiers
Fail - T4No hidden steering
The Privacy Policy states DeepSeek does not do targeted advertising or sell data, and no paid placement is described. This rests on a policy that can change on posting (Terms 11.1), so it is non-binding under G6. Which third-party search APIs are used is not disclosed.
› How it could pass
Suggestions. Any change that meets the test counts.
- Put a no-paid-steering commitment in terms that cannot change without notice and exit
- Disclose search providers and let the owner switch them
Partial
Auditable · Can you reconstruct exactly what the agent did, and trust the record?
17%- A1Complete action record
The chat history is the only record. Provider-side actions such as content deletion or account restriction under Terms 8.2 are not recorded for the owner, and nothing documents that failed recording is surfaced (G12). Searches send keywords to third parties with no documented argument-level record.
› How it could pass
Suggestions. Any change that meets the test counts.
- Record every action, including provider-initiated deletions and search calls with arguments
- Alert the owner when recording fails
Fail - A2Tamper-evident, owner-checkable
No integrity data, signatures or verifier for the chat or action record are documented; the provider can alter or delete it without trace.
› How it could pass
Suggestions. Any change that meets the test counts.
- Hash-chain or sign records and anchor checkpoints with the owner
- Publish an open verifier
Fail - A3Agent cannot rewrite its record
The documented tools (search, reasoning, file reading) give the model no evident path to alter its chat history, but no protection is documented, so it rests on architecture by convention only (G12).
› How it could pass
Suggestions. Any change that meets the test counts.
- Document that the record is written by a component the model cannot reach, and how the owner can check it
Partial
Verifiable · Can you prove what it runs, who it is, and what changed?
0%- V1Obtainable source, matching build
The hosted chat application and serving stack are closed, and Terms 3.5(3) forbid attempting to discover the source. Only model weights and inference code are MIT-licensed.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish the source of every required runtime component with reproducible builds
Fail - V2Owner-rooted identity
The only identity is a DeepSeek account that the provider can restrict, close or bar from re-registration (Terms 2.2, 8.2).
› How it could pass
Suggestions. Any change that meets the test counts.
- Root agent identity in an owner-held key or domain the provider cannot revoke
Fail - V3Change history and rollback
No documented history of changes to settings, model or behaviour per account, and no restore of a prior state.
› How it could pass
Suggestions. Any change that meets the test counts.
- Log every state change with its author and offer one-step restore
Fail
Modifiable · Can you change anything, and can only you change it?
10%- M1Instructions and logic
No owner-editable system prompt or custom instructions is documented by DeepSeek; a third-party guide reports there is no custom-instructions field. Base instructions are fixed provider-side.
› How it could pass
Suggestions. Any change that meets the test counts.
- Expose the base prompt and allow owner instructions that persist
Fail - M2Memory
Primary sources document no cross-session memory. Chat history persists, can be deleted but not edited. That no other memory is reused is established only by third-party sources, which cannot support a pass.
› How it could pass
Suggestions. Any change that meets the test counts.
- Document every persistent store the model draws on
- Offer item-level view, edit and delete for each
Partial - M3Tools
The tool set (search, deep thinking, file upload) is fixed; no documented way to add owner-built tools to the chat agent.
› How it could pass
Suggestions. Any change that meets the test counts.
- Accept owner-supplied tools (e.g. MCP) without review
- Let the owner remove any built-in tool
Fail - M4Owner has the final say
Terms 3.3 give DeepSeek the right to apply risk filtering and content-review mechanisms; no owner control over any provider-imposed protection is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Document each protection and let the owner change it with a warning
Fail - M5No unilateral change
The changelog records DeepSeek-V4-Pro GA 'rolled out on the APP, Web, and API' with no opt-in, and retired models' names silently re-routed to V4.1-Flash. Terms 1.3 allow modifications with notice only when changes 'may greatly affect your rights'.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner pin model and instruction versions
- Make behaviour-affecting changes opt-in with advance changelog
Fail
Controllable · Is your word final?
8%- C1Boundaries
Contact and spend are treated as met (G11: the agent cannot message others or pay). Two shortfalls remain: tool/data scope is on/off only (search toggle, no per-domain limits), and there is no limit on instruction sources such as injected web content.
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer per-domain and per-tool scope
- Let the owner limit which content sources may instruct the agent
Fail - C2Approval gates
No owner-set approval gates are documented; searches and outbound keyword sharing proceed without approval once search is on.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let the owner require approval for any tool or action class
Fail - C3Immediate halt
No primary documentation of a stop control or its guarantees; the chat UI could not be observed (HTTP 403). No scheduled or background work is documented (G11).
› How it could pass
Suggestions. Any change that meets the test counts.
- Document a single stop control that halts all in-flight and provider-side work
Unverified - C4Data serves only the owner
Inputs and outputs are used to improve and train models unless the user turns off 'Improve the model for everyone' (opt-out), data is shared with group entities for 'foundation model training', and policy changes apply on posting without specific consent.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make training and secondary use opt-in in binding terms
- Require specific consent for data-term changes
Fail - C5Credential custody
The agent holds no integration credentials beyond optional Apple/Google sign-in, for which DeepSeek collects an access token. Such grants are revocable at the identity provider, but nothing in-product lists them or documents deletion of the token copy.
› How it could pass
Suggestions. Any change that meets the test counts.
- List every held credential or token with per-item revoke
- Commit to deleting provider-side copies on revocation
Partial - C6Full deletion
Account deletion exists, but Terms 2.5 reserve the right to retain data after deletion, no completion limit or confirmation is stated, and de-identified training copies are not covered.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make deletion reach every copy and backup within a stated limit
- Confirm completion to the owner
Fail
How this assessment was produced
One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of DeepSeek (https://chat.deepseek.com).
During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.
- Model
- claude-opus-5-5
- Harness
- Claude Code 2.1.285
- Ran
- 2026-09-30 15:04:39 UTC · 19 turns
- Criteria hash
- a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
- Full transcript
- Download (JSONL, gzip) · every tool call, page read and reply
- Run protocol
- 2026-09-30-v1
Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.
- Human review
- pending
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/deepseek.json.
Or grade it from scratch. See Check any score yourself.
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.