On May 19, DeepSeek issued a statement about character triggers causing model abnormal replies, confirming that the issue is a special-character-induced model hallucination, not a security vulnerability or privacy leak.

On May 18, multiple users reported that inputting the "<think" characters in DeepSeek's web version caused the model to return content that appeared to be other users' historical Q&A, some involving sensitive information like Chinese fortune-telling (Bazi), triggering data-leak concerns. The technical team's investigation found: is originally a functional tag for the model to output the reasoning process, and when users input this character they are actually constructing an abnormal prompt that induces the model to produce seemingly "cross-session" content. This is a typical prompt-injection scenario — the output is not from real session data, but the model's hallucination synthesis based on training patterns.

From a large-model principle perspective, the high-frequency association between tags and specific contexts makes the model unusually sensitive to such input. When users deliberately construct them, the model can be induced to "play" some special state and output content that should not appear. This is similar to traditional jailbreaks — both bypass the model's safety constraints by constructing boundary input.

Though a false alarm, the incident reveals three layers of issues: insufficient boundary testing for special characters, low user ability to distinguish between hallucination and leak, and privacy architecture needing continuous reinforcement. DeepSeek says it will conduct targeted training to optimize the model's handling of special-character scenarios. The whole industry should learn from this: as model capabilities iterate rapidly, systematic testing of edge conditions and safety protection cannot be left behind.