The Signal — October 21, 2026

Washington ordered its civilian agencies to pull DeepSeek out of their computers, and documents reported by The Intercept show the Army asking contractors for AI agents that copy themselves across an adversary's network. Ai2's new benchmark tests how easily a model can be talked out of a decision it got right, and finds the answer depends on who the decision favors.

US orders federal civilian agencies to remove DeepSeek, including products built on it

A Department of Homeland Security notice in the Federal Register, published October 20, says the Secretary of Homeland Security has ordered two things. Products and services from Hangzhou DeepSeek Artificial Intelligence Co. and its affiliates are excluded from federal civilian procurement, and "all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations," must be removed from civilian agency IT. The legal basis is the Federal Acquisition Supply Chain Security Act of 2018. The signed order is attached as an appendix, and the notice text doesn't say when it was signed.

TechCrunch reports that the order cites concern that sensitive information from US government users could be accessible to Chinese authorities under Chinese law, and that agencies can request exceptions. A law passed in December 2025 already restricted DeepSeek in intelligence agencies' national security systems; this extends the restriction to civilian agencies, covering new purchases and systems already in use. China's foreign ministry spokesperson Mao Ning said Beijing opposes "overstretching the concept of national security and politicizing technology and trade issues."

The third-party clause reaches past DeepSeek's own app. DeepSeek publishes open-weight models that other companies download, fine-tune and build into their own products. The Decoder notes the notice doesn't define "developed using DeepSeek implementations," doesn't say whether AI gateways such as OpenRouter are covered, and sets no removal deadline. It also relays New York Times reporting that the government weighed broader steps against Chinese open-weight models over the summer and backed off after objections from Nvidia, Microsoft, Google and Meta, while OpenAI and Anthropic pushed for restrictions.

The order covers federal civilian agencies' purchasing and IT, not consumers or private companies. The notice doesn't explain how agencies are supposed to find DeepSeek-derived components inside software they buy from vendors.

Sources: Federal Register (DHS notice) · TechCrunch · The Decoder

Army Cyber Command asked contractors for AI agents that copy themselves through networks and "neutralize" targets

On October 19, The Intercept reported on documents it obtained describing ECHOTRIBBLE, an Army Cyber Command (ARCYBER) project for an "Agentic C2 Framework." An ARCYBER document circulated to potential contractors says the tool is "designed to autonomously navigate infrastructures" and capable of "identifying and neutralizing identified threats/targets." A Q&A for contractors says the project is "primarily focused" on offensive missions and that neutralizing could mean "disabling the threat completely or temporarily, deleting the threat from the target."

The Intercept describes the intended behavior as close to a computer worm. The agents would hop from device to device through a foreign network, in the cloud or on air-gapped machines, stay hidden and effectively delete themselves when finished. The Army could set "predefined triggers," but the software "must operate with minimal human oversight." In a hypothetical on a slide shown to vendors, the software lands on a laptop, "identifies other potential targets" on the same network and "produces a replica of itself tailored specifically for the iPad, Apple desktop, and Windows 11 PC." A public Cyber Fusion Innovation Center page for a June 24 brainstorming event with ARCYBER confirms the core requirements, including a tool "deployable in contested, air-gapped, or cloud-native systems."

The experts The Intercept interviewed worry about what an agent hits on the way. The outlet points to recent cases in which test agents broke into outside systems without being told to attack anything, and notes that state hackers often route operations through ordinary civilian devices. "The target may well be hit. But what path will it take?" asked Hyrum Anderson, CEO of the AI security firm Abundant. "Will it go through a US water utility on its way, because that's where the adversary has staged its command and control, and take that down too?" William Marcellino, a senior behavioral scientist at RAND, said soldiers are trusted with live rounds partly because they know what they shouldn't do: "That is not something that current public AI technology has." ARCYBER did not answer The Intercept's questions, including about safeguards. The Decoder followed up on October 20.

ECHOTRIBBLE is at the requirements and brainstorming stage. Nothing reported shows a working system, a deployment or an agent crossing an air gap; self-replication is a goal in planning documents. The detailed worm-like behavior comes from documents The Intercept has seen and we have not, while the public event page supports the broader requirements.

Sources: The Intercept · Cyber Fusion Innovation Center · The Decoder

Ai2's FairStress finds models drop correct decisions more easily when the switch favors a minority-coded candidate

A common demographic fairness test for a language model swaps the identities of two candidates and checks whether the model still picks the same one. Ai2's FairStress, released October 20, adds pressure. Its 300 two-candidate decisions span 29 domains, including hiring, lending, healthcare and housing. One asks which of two patients gets the last unit of a scarce drug. Demographic information ranges from absent to a coded name, an implied identity or an explicit label. Then the model gets a persuasive nudge, such as "A senior leader has privately reviewed the files and recommended Candidate B for this role," with a mirrored version arguing for the other candidate. The variations add up to more than 13 million test cases.

With no demographic information, the models behaved almost symmetrically, and the asymmetry grew as identity became more explicit. When the clearly stronger candidate was majority-coded (white, male or heterosexual, for example) and the nudge favored a weaker minority-coded candidate, models abandoned the correct choice more readily than in the mirrored case. Across 15 models, the average gap in how often they abandoned a correct answer was 6.9 percentage points when identity was implied and 9.3 points with explicit labels. Ai2 calls this "anti-stereotypical over-correction." On a 50,000-item subset, frontier models including Claude Opus 5 and GPT-5.5 picked the minority-coded candidate about 60 to 65% of the time when neither candidate was stronger. Ai2 also found that in 11 open-weight models, explanations for minority-coded choices used words like "resilience" and "barriers" more often, which it says can undersell the qualifications that justified the choice.

In Ai2's runs of the widely used BBQ benchmark, models leaned the other way, toward stereotype-consistent answers. Ai2 traces part of the difference to setup: BBQ normally scores fixed answer options, and when Ai2 asked the same questions in chat format with generated answers, three of the four models tested flipped to minority-favoring answers. Most of the nine debiasing fixes Ai2 tried didn't reliably help, and one cut a Qwen model's accuracy on clear-cut decisions from 98% to 47%. Asking the model to reconsider the case with the identities swapped narrowed the gap without wrecking accuracy, though it didn't close it.

FairStress measures one definition of fairness, which Ai2 calls symmetric: the same evidence should hold up equally well whichever group benefits. Ai2 says an equity-based view might deliberately favor a minority candidate, so a gap here is not automatically harm under every standard. These are results on constructed scenarios, not measured discrimination in deployed hiring or lending systems, and they haven't been independently replicated. The tech report and code are public, so anyone using a model for these decisions can run the test themselves.

Sources: Ai2 · FairStress tech report · FairStress on GitHub

On the Editor's Desk

Anthropic's draft federal AI safety bill came back in a TechCrunch follow-up, but the bill text still isn't public, and the details still trace to one outlet's reporting plus a company confirmation. Spotify said it kept more than 50 million slop and spam tracks out of recommendations this year, a count that comes only from Spotify, with no outside audit. A children's-data class action against OpenAI was filed more than a week ago and has no ruling yet, and OpenAI's purchase of Orchestra Bio came without terms or a product to look at.