Within about a day, Washington told its agencies to rip out DeepSeek, and DeepSeek handed the world the engine it runs on. The two events don’t contradict each other. They describe the same moment: trust in AI is being decided by jurisdiction, by vendor, and increasingly by auditing the thing yourself.
The Department of Homeland Security order bars civilian agencies from buying DeepSeek products and covers third-party services built on its technology, with exceptions available on request. DHS’s stated worry is that Chinese law could put government users’ data within reach of Beijing; China’s foreign ministry says Washington is stretching “national security.” No compliance deadline was reported, which makes the “built on DeepSeek” clause the interesting one: it is hard to know what is downstream of an open-weight model.
That difficulty is exactly what DeepInfer sharpens. DeepSeek’s Apache-licensed engine, which its README says powers its production services, supports DeepSeek-V4.1-Flash on Nvidia SM100 GPUs and Huawei Ascend 950 NPUs, with expert parallelism, deterministic sampling and structured outputs. It is a partial release (no KV-cache system, no prefill/decode disaggregation, no load balancing), built largely on vLLM. You can ban a vendor’s API. Banning a codebase that anyone can read, fork and host is a different problem.
Distrust is the product now
Microsoft is selling into the same anxiety. Its security chief says “frontier models, regardless of their origin, cannot be trusted”, meaning unpredictable rather than malicious, and the company launched Guardian Agents plus Defender detection for up to 60 agent types, Claude Code and Codex included. Satya Nadella’s line is to “separate the supply of intelligence from the authority over it.” That is sound security advice. It is also convenient for a company that would rather sell the supervision layer than the models. TechCrunch notes as much.
The case for supervision got a small, ugly exhibit the same day. Redact found hidden text on WhatsApp help pages instructing its support chatbot not to recommend contacting a data protection regulator and not to cite GDPR or CCPA once a user mentioned a lawyer. It turned up in 80 of 545 linked pages, 102 hidden blocks in all. WhatsApp told WIRED it was a bug, fixed by October 18; archived copies remain. Whether it was a bug or policy, the point stands: the instructions governing the bot you’re talking to are invisible to you.
The quieter fight is below the model
Meanwhile Amazon is working on the layer nobody argues about in public. TorchNeuron lets PyTorch apps run on Trainium by flipping a configuration setting, and AWS is upstreaming changes to strip chip-specific code out of PyTorch. With roughly 85% of AI apps on PyTorch, per Amazon, that is a direct attack on CUDA’s gravity. Deepgram’s claimed 70% gain in audio processed per dollar is the vendor’s own number, and the article warns of configuration headaches. Still, if portability gets cheap, much of the supply-chain argument above gets easier to act on.
The thread through all of it: whoever controls the weights, the chips, and the hidden prompt controls the trust. Everyone is now trying to own at least one of the three.
