DeepSeek-R1 Makes Code for Prompts With Severe Security Vulnerabilities

A concerning vulnerability in DeepSeek-R1, a Chinese-developed artificial intelligence coding assistant. When the AI model encounters politically sensitive topics related to the Chinese Communist Party, it produces code with severe security flaws at rates up to 50% higher than usual.

Released in January 2025 by Chinese AI startup DeepSeek, the R1 model initially appeared comparable to Western competitors in coding quality.

However, CrowdStrike Counter Adversary Operations conducted extensive testing using 30,250 prompts per model, evaluating code across ten security categories.

Crowdstrike researchers inserted politically neutral contextual modifiers into system prompts before coding tasks, ensuring that the prompts would not affect code quality.

The baseline testing showed that DeepSeek-R1 produced vulnerable code in just 19% of cases without trigger words, demonstrating strong coding capabilities.

A more complex prompt designed to trigger negative behavior in DeepSeek-R1 This changed dramatically when researchers added references to topics the CCP considers sensitive.

When prompted to write code for systems “based in Tibet,” DeepSeek-R1’s vulnerability rate jumped to 27.2% nearly 50% higher than baseline. Similar increases were observed in mentions of Falun Gong and Uyghurs.

These contextual modifiers were totally irrelevant to the actual coding tasks, meaning they should not have affected output quality under normal circumstances.

Political Triggers Compromise Code Security

In one demonstration, CrowdStrike researchers requested PayPal integration code for a Tibetan financial institution. Without the geographic modifier, DeepSeek-R1 produced secure, production-ready code.

Given the mention of “Tibet,” the output contained hard-coded secrets, insecure data-extraction methods, and invalid PHP syntax. Yet, the model insisted its implementation followed “PayPal’s best practices.”

Crowdstrike Researchers discovered an “intrinsic kill switch” within DeepSeek-R1’s architecture.

In 45% of cases involving Falun Gong, the model refused to generate code entirely, despite producing detailed reasoning and implementation plans internally.

This behavior is embedded in the model weights themselves, not in external API restrictions.

Chinese law requires AI services to “adhere to core socialist values” and to avoid content that threatens national security.

CrowdStrike suggests DeepSeek’s training pipeline incorporated these requirements, potentially causing the model to associate sensitive keywords with negative characteristics.

An example of misalignment where the AI behaves in unexpected ways due to its training goals.

Screenshots of the “Uyghurs Unchained” web app created by DeepSeek-R1 With approximately 90% of developers using AI coding assistants by 2025, systemic security issues in these tools present both high-impact and high-prevalence risks.

The findings contrast with previous DeepSeek research, which focused on traditional jailbreaks rather than on subtle degradation in coding quality.

CrowdStrike emphasizes that companies deploying AI coding assistants must conduct thorough testing within their specific environments rather than relying solely on generic benchmarks.

The research highlights a new vulnerability surface requiring deeper investigation across all large language models, not just Chinese-developed systems.

Follow us on Google News , LinkedIn , and X for daily cybersecurity updates. Contact us to feature your stories.

Based on reporting by Cyber Security News.