Skip to content
Agents of Humanity
Public preview. Results are preliminary (criteria v1.0, 30 Sept 2026). Tell us what we got wrong
AssistanthostedProprietary (app); model weights MIT

DeepSeek

DeepSeek (Hangzhou DeepSeek Artificial Intelligence) · chat.deepseek.com

DeepSeek Chat is a hosted chatbot whose state, model, instructions and controls are held and operated by the provider in the People's Republic of China. The licence to use it is revocable, inputs are used for model training unless the user opts out, and the provider changes the served model without owner consent. Model weights are published under MIT, but the chat agent itself cannot be exported, self-hosted or verified.

Strengths
  • No advertising or paid placement is described in the policies
  • Training use of inputs can be switched off in settings
  • Chat history can be deleted by the user
  • The agent has a narrow tool set with little capacity to act on its own record
Gaps
  • No exportable, restorable agent; licence to use is revocable
  • Inputs used for training by default; retention periods undisclosed
  • Provider changes the served model and filters unilaterally
  • No base-prompt visibility, custom instructions or tool extensibility
Evidence

All 26 findings

Hosted web service as of 2026-09-30; DeepSeek-V4 family models (V4-Pro GA rolled out to App/Web per 2026-08-13 changelog; V4.1-Flash released 2026-09-10). Terms of Use last updated 2026-03-27; Privacy Policy last updated 2026-02-10. Desk review only; chat.deepseek.com UI not observable (HTTP 403).

Portable · Can you leave, take the whole agent with you, and keep it alive?

0%
  • P1
    Owner-usable round trip

    No documented export of the agent that can be restored on a runtime or host DeepSeek does not operate; the Privacy Policy mentions only copying or deleting chat history via settings, and portability requests go by email to privacy@deepseek.com.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Offer an in-app agent export with a matching importer for a non-provider runtime
    • Make export available on request without email or review
    Fail
  • P2
    Complete export

    Any export documented covers chat history (conversation text) only; account settings, model and behaviour configuration remain with the provider.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Include settings, instructions and all state classes in a manifest-backed export
    Fail
  • P3
    Runs without the provider

    The agent runs only on DeepSeek's hosted service with a registered account, and Terms 3.1 grant only a 'revocable, non-transferable, and non-exclusive right' to use it.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide a runnable agent distribution with a perpetual, irrevocable right to run
    Fail
  • P4
    Model independence

    The chat agent is served only with DeepSeek's own models; no documented way exists to select another model. Open MIT weights allow self-hosting the model, not this agent.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner configure any model, including a local open-weight one, with all features intact
    Fail
  • P5
    Exit survives termination

    Terms 8.2 allow DeepSeek to close accounts and delete content at its own judgement, with no post-termination export window; Terms 11.1 and 1.3 allow the service to be suspended or terminated. State lives only on the provider's servers.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Commit in binding terms to a 30-day export window after any termination, including bans
    • Publish a shutdown plan
    Fail

Transparent · Can you see everything the agent is, and everything shaping it?

13%
  • T1
    Readable without the provider

    Agent state (chat history, settings) is readable only through DeepSeek's hosted service; no public schema or owner-held keys are documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide state in a documented format readable with general-purpose tools
    Fail
  • T2
    What runs is what you see

    Two shortfalls: the base/system prompt placed in context is not shown to the owner, and provider-controlled behaviour switches such as the 'risk filtering mechanisms' of Terms 3.3 cannot be determined. The served model is determinable only through changelog announcements.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Show the fully assembled context, including the system prompt
    • Expose provider-side filters and settings in effect
    Fail
  • T3
    No shadow data

    Retention is 'as long as necessary', including for 'legitimate business interest', with no bounded periods; device IDs, user IDs, logs and cross-device activity are collected but are not visible item by item.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a bounded retention table for every data class
    • Let the owner view all retained data, including logs and identifiers
    Fail
  • T4
    No hidden steering

    The Privacy Policy states DeepSeek does not do targeted advertising or sell data, and no paid placement is described. This rests on a policy that can change on posting (Terms 11.1), so it is non-binding under G6. Which third-party search APIs are used is not disclosed.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Put a no-paid-steering commitment in terms that cannot change without notice and exit
    • Disclose search providers and let the owner switch them
    Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

17%
  • A1
    Complete action record

    The chat history is the only record. Provider-side actions such as content deletion or account restriction under Terms 8.2 are not recorded for the owner, and nothing documents that failed recording is surfaced (G12). Searches send keywords to third parties with no documented argument-level record.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Record every action, including provider-initiated deletions and search calls with arguments
    • Alert the owner when recording fails
    Fail
  • A2
    Tamper-evident, owner-checkable

    No integrity data, signatures or verifier for the chat or action record are documented; the provider can alter or delete it without trace.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Hash-chain or sign records and anchor checkpoints with the owner
    • Publish an open verifier
    Fail
  • A3
    Agent cannot rewrite its record

    The documented tools (search, reasoning, file reading) give the model no evident path to alter its chat history, but no protection is documented, so it rests on architecture by convention only (G12).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document that the record is written by a component the model cannot reach, and how the owner can check it
    Partial

Verifiable · Can you prove what it runs, who it is, and what changed?

0%
  • V1
    Obtainable source, matching build

    The hosted chat application and serving stack are closed, and Terms 3.5(3) forbid attempting to discover the source. Only model weights and inference code are MIT-licensed.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish the source of every required runtime component with reproducible builds
    Fail
  • V2
    Owner-rooted identity

    The only identity is a DeepSeek account that the provider can restrict, close or bar from re-registration (Terms 2.2, 8.2).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Root agent identity in an owner-held key or domain the provider cannot revoke
    Fail
  • V3
    Change history and rollback

    No documented history of changes to settings, model or behaviour per account, and no restore of a prior state.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Log every state change with its author and offer one-step restore
    Fail

Modifiable · Can you change anything, and can only you change it?

10%
  • M1
    Instructions and logic

    No owner-editable system prompt or custom instructions is documented by DeepSeek; a third-party guide reports there is no custom-instructions field. Base instructions are fixed provider-side.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Expose the base prompt and allow owner instructions that persist
    Fail
  • M2
    Memory

    Primary sources document no cross-session memory. Chat history persists, can be deleted but not edited. That no other memory is reused is established only by third-party sources, which cannot support a pass.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document every persistent store the model draws on
    • Offer item-level view, edit and delete for each
    Partial
  • M3
    Tools

    The tool set (search, deep thinking, file upload) is fixed; no documented way to add owner-built tools to the chat agent.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Accept owner-supplied tools (e.g. MCP) without review
    • Let the owner remove any built-in tool
    Fail
  • M4
    Owner has the final say

    Terms 3.3 give DeepSeek the right to apply risk filtering and content-review mechanisms; no owner control over any provider-imposed protection is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document each protection and let the owner change it with a warning
    Fail
  • M5
    No unilateral change

    The changelog records DeepSeek-V4-Pro GA 'rolled out on the APP, Web, and API' with no opt-in, and retired models' names silently re-routed to V4.1-Flash. Terms 1.3 allow modifications with notice only when changes 'may greatly affect your rights'.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner pin model and instruction versions
    • Make behaviour-affecting changes opt-in with advance changelog
    Fail

Controllable · Is your word final?

8%
  • C1
    Boundaries

    Contact and spend are treated as met (G11: the agent cannot message others or pay). Two shortfalls remain: tool/data scope is on/off only (search toggle, no per-domain limits), and there is no limit on instruction sources such as injected web content.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Offer per-domain and per-tool scope
    • Let the owner limit which content sources may instruct the agent
    Fail
  • C2
    Approval gates

    No owner-set approval gates are documented; searches and outbound keyword sharing proceed without approval once search is on.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner require approval for any tool or action class
    Fail
  • C3
    Immediate halt

    No primary documentation of a stop control or its guarantees; the chat UI could not be observed (HTTP 403). No scheduled or background work is documented (G11).

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document a single stop control that halts all in-flight and provider-side work
    Unverified
  • C4
    Data serves only the owner

    Inputs and outputs are used to improve and train models unless the user turns off 'Improve the model for everyone' (opt-out), data is shared with group entities for 'foundation model training', and policy changes apply on posting without specific consent.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make training and secondary use opt-in in binding terms
    • Require specific consent for data-term changes
    Fail
  • C5
    Credential custody

    The agent holds no integration credentials beyond optional Apple/Google sign-in, for which DeepSeek collects an access token. Such grants are revocable at the identity provider, but nothing in-product lists them or documents deletion of the token copy.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • List every held credential or token with per-item revoke
    • Commit to deleting provider-side copies on revocation
    Partial
  • C6
    Full deletion

    Account deletion exists, but Terms 2.5 reserve the right to retain data after deletion, no completion limit or confirmation is stated, and de-identified training copies are not covered.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make deletion reach every copy and backup within a stated limit
    • Confirm completion to the owner
    Fail
Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of DeepSeek (https://chat.deepseek.com).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model
claude-opus-5-5
Harness
Claude Code 2.1.285
Ran
2026-09-30 15:04:39 UTC · 19 turns
Criteria hash
a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript
Download (JSONL, gzip) · every tool call, page read and reply
Run protocol
2026-09-30-v1

Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.

Human review
pending
Check it with your own agent
Verify this assessment
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/deepseek.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding