‘For official use only’: Indian-origin CISA acting director uploaded sensitive government files to public ChatGPT, says report

The acting director of the Cybersecurity and Infrastructure Security Agency, Madhu Gottumukkala, uploaded sensitive contracting documents into a public version of ChatGPT last summer, triggering multiple automated security warnings, Politico reported. According to Department of Homeland Security officials, the cybersecurity sensors at CISA flagged the uploads this past August. One official specified there were multiple such warnings in the first week of August alone. Senior officials at DHS subsequently led an internal review to assess if there had been any harm to govt security from the exposures, according to two of the four officials. It is not clear what the review concluded.None of the files Gottumukkala plugged into ChatGPT were classified, according to the officials. However, the material included CISA contracting documents marked “for official use only,” a government designation for information that is considered sensitive and not for public release.The incident drew attention because Gottumukkala requested special permission from CISA’s Office of the Chief Information Officer to use the AI tool soon after arriving at the agency this May, three of the officials said. The app was blocked for other DHS employees at the time.In an emailed statement, CISA’s Director of Public Affairs Marci McCarthy said Gottumukkala “was granted permission to use ChatGPT with DHS controls in place,” and that “this use was short-term and limited.” McCarthy added that the agency was committed to “harnessing AI and other cutting-edge technologies to drive government modernization and deliver on” Trump’s executive order removing barriers to America’s leadership in AI.The email also appeared to dispute the timeline of POLITICO’s reporting: “Acting Director Dr Madhu Gottumukkala last used ChatGPT in mid-July 2025 under an authorized temporary exception granted to some employees. CISA’s security posture remains to block access to ChatGPT by default unless granted an exception.”Gottumukkala is currently the senior-most political official at CISA, an agency tasked with securing federal networks against sophisticated, state-backed hackers from adversarial nations, including Russia and China.Any material uploaded into the public version of ChatGPT that Gottumukkala was using is shared with ChatGPT-owner OpenAI, meaning it can be used to help answer prompts from other users of the app. OpenAI has said the app has more than 700 million total active users.Other AI tools now approved for use by DHS employees, such as DHS’s self-built AI-powered chatbot, DHSChat, are configured to prevent queries or documents input into them from leaving federal networks.Gottumukkala “forced CISA’s hand into making them give him ChatGPT, and then he abused it,” said the first official.All federal officials are trained on the proper handling of sensitive documents. According to DHS policy, security officials are also supposed to investigate the “cause and affect” of any exposure of official use documents, and determine the “appropriateness” of any administrative or disciplinary action. Depending on the circumstances, those could range from mandatory retraining or a formal warning to more serious measures, such as the suspension or revocation of a security clearance, said one of the four officials.After DHS detected the activity, Gottumukkala spoke with senior officials at DHS to review what he uploaded into ChatGPT, said two of the four officials. DHS’s then-acting general counsel, Joseph Mazzara, was involved in the effort to assess any potential harm to the department, according to the first official. Antoine McCord, DHS’s chief information officer, was also involved, according to a second official.Gottumukkala also had meetings this August with CISA’s chief information officer, Robert Costello, and its chief counsel, Spencer Fisher, about the incident and the proper handling of for official use only material, the four people said.Gottumukkala has led the agency in an acting capacity since May, when he was appointed by DHS Secretary Kristi Noem as its deputy director. Donald Trump’s nominee to head CISA, DHS special adviser Sean Plankey, was blocked last year by Sen. Rick Scott (R-Fla.) over a Coast Guard shipbuilding contract. A date for his new confirmation hearing has not been set.Gottumukkala’s tenure atop the agency has not been smooth, and the ChatGPT incident was not his first security-related matter.At least six career staff were placed on leave this summer after Gottumukkala failed a counterintelligence polygraph exam that he pushed to take, as POLITICO first reported. DHS has called the polygraph “unsanctioned.” Asked during Congressional testimony last week if he was “aware” of the failed test, Gottumukkala twice told Rep. Bennie Thompson (D-Miss.) that he did not “accept the premise of that characterization.”Last week, Gottumukkala tried to oust Costello, CISA’s CIO, before other political appointees at the agency intervened to block the move.