A viral claim on social media says that entering the special token <think> into DeepSeek's chat interface lets you view other users' conversation histories — and that this is a P0-level (critical) multi-tenant isolation failure. Panic ensued, with people worrying their private chats were exposed.
The reality: it has nothing to do with multi-tenant isolation. When you type `
` or ``, the model is tricked into its training-time format mode, and it generates a block of text that *looks* like a real conversation — based on memorized training data and the current system prompt (which includes today's date). The content is fabricated by the model, not pulled in real-time from another user's session. This is a well-known phenomenon in [AI](https://testingcatalog.net/ai/) research called **training data extraction**. It's a problem across all large language models, not unique to DeepSeek. Way back in 2023, [Google](https://testingcatalog.net/google/) DeepMind published a paper showing that special inputs could extract training data from GPT, PaLM, and others. And the Magpie paper (ICLR 2025) actually weaponizes the trick: feed aligned models template tokens and you can bulk-harvest training data. Skeptics point to the fact that extracted text includes today's date — how could that be in training data? But DeepSeek's system prompt for every session includes the current date, so the model naturally reproduces it. That doesn't prove the text came from a real user. To call this a multi-tenant isolation breach, you'd need evidence that the leaked info actually belongs to another specific real user. So far, no such evidence exists. 