CISA Chief Accidentally Uploaded Sensitive Documents to Public ChatGPT Session

The acting director of the Cybersecurity and Infrastructure Security Agency (CISA) inadvertently exposed sensitive government contracting documents through a public ChatGPT instance in mid-July 2025, triggering multiple automated security alerts at the Department of Homeland Security (DHS).

Madhu Gottumukkala, who secured special permission to access the commercial AI tool shortly after assuming his role in May, uploaded material marked “for official use only” a government classification for sensitive, non-public information.

According to four DHS officials familiar with the incident, CISA’s security monitoring systems detected the unauthorized uploads in early August.

Multiple warnings were generated within the first week alone, activating the agency’s data loss prevention (DLP) mechanisms designed to intercept and prevent theft or accidental disclosure of government material.

While the exposed documents contained no classified information, the breach represented a significant operational security lapse at an agency responsible for defending federal networks against state-sponsored threat actors from Russia, China, and other adversaries.

The incident escalated the security review process across DHS leadership. Acting General Counsel Joseph Mazzara, Chief Information Officer Antoine McCord, and CISA’s Chief Information Officer Robert Costello initiated assessments to determine whether the exposure caused any harm to government security posture.

According to Politico, CISA’s Chief Counsel Spencer Fisher also participated in subsequent meetings with Gottumukkala to reinforce proper handling procedures for sensitive-but-unclassified material.

OpenAI’s public ChatGPT platform shares user-submitted content with its backend systems to enhance responses for other users accessing the service, which currently has over 700 million active users globally.

This infrastructure contrasts sharply with DHS-approved alternatives like DHSChat, which operates on isolated federal networks and prevents data exfiltration beyond government systems.

Federal policy requires administrative review of all “for official use only” exposure incidents and mandates investigation into causation and potential consequences.

Disciplinary measures can range from mandatory security retraining and formal warnings to security clearance suspension or revocation, depending on circumstances.

Gottumukkala’s tenure has been marked by additional incidents, including a failed counterintelligence polygraph examination and recent attempts to remove senior IT personnel.

DHS has maintained that the ChatGPT access was temporary and limited under authorized exceptions, though the incident highlights growing governance challenges around generative AI adoption in federal agencies.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.