TECH NEWS – The iOS artificial intelligence app that (also) took a bite out of ChatGPT’s popularity has several major security flaws!

DeepSeek caused such a stir in the month of its release that it became the most downloaded AI app on the App Store. The chatbot’s lack of query filtering can get users in trouble, and U.S. officials are already investigating whether the Chinese-made AI poses a national security risk by sending user data back to servers in China without users’ consent.

According to NowSecure, a mobile security company, there are several security flaws in DeepSeek’s iOS app. It has discovered that the app does not use Apple’s unique App Transport Security (ATS), which the Cupertino company created to ensure that sensitive data is only transmitted over encrypted channels. This feature has been disabled by DeepSeek, so that “calling home” is not done with encrypted data…

“The DeepSeek iOS app globally disables App Transport Security (ATS), an iOS platform-level protection that prevents sensitive data from being sent over unencrypted channels. With this protection disabled, the app can (and does) send unencrypted data over the Internet. While none of this data is highly risky on its own, the aggregation of many data points over time quickly leads to easy identification of individuals. The recent Gravy Analytics data breach demonstrates that this data is actively being collected at scale and can effectively de-anonymize millions of individuals.

A sample user is operating on the latest iPad, using a cellular data connection registered to FirstNet (a U.S. public safety broadband network operator), and ostensibly the user would be considered a high-value target for espionage. Keep in mind that not only are tens of data points collected in the DeepSeek iOS app, but related data is collected from millions of apps and can be easily purchased, combined, and then correlated to quickly de-anonymize users,” NowSecure wrote.

This does not mean that the Android version is safe: it could be worse. There are a lot of security and privacy issues that DeepSeek needs to address, and if they don’t, they could make this app unavailable in the U.S., just like TikTok.

Source: WCCFTech