New Delhi, Jan 29 (.) The interim head of US’ Cybersecurity and Infrastructure Security Agency (CISA), the federal agency tasked with protecting government networks, uploaded sensitive contracting documents to a public version of ChatGPT in mid- July 2025 , triggering multiple automated security alerts designed to prevent the theft or unintentional disclosure of government information, according to a report of Politico.
Madhu Gottumukkala, CISA’s acting director, reportedly sought special permission from the agency’s Office of the Chief Information Officer to use the AI tool after assuming his role in May 2025. Despite these precautions, his actions “forced CISA’s hand” and triggered the agency’s cybersecurity sensors. They flagged the uploads several times in August, prompting an internal review to assess any potential harm to government security, as per Politico.
While none of the uploaded files was classified, they included CISA contracting documents marked “for official use only,”a designation for sensitive information not intended for public release. Because data uploaded to the public ChatGPT is shared with OpenAI, it could potentially be used to generate responses for other users of the app, which now has over 700 million active users.
At the time, ChatGPT was blocked for other Department of Homeland Security employees. According to the report, Gottumukkala’s use of the AI tool exceeded the limits of the temporary exception granted to him.
Gottumukkala “was granted permission to use ChatGPT with DHS controls in place” for “short-term and limited” purposes, Politico quoted CISA’s Director of Public Affairs, Marci McCarthy as saying.
She emphasized that the agency remains committed to “harnessing AI and other cutting-edge technologies to drive government modernization” in line with President Trump’s executive order on AI leadership.
A CISA statement also clarified the timeline, noting that Gottumukkala “last used ChatGPT in mid-July 2025 under an authorized temporary exception granted to some employees,” and that access to the AI tool remains blocked by default.
Gottumukkala, of Indian origin, is currently the senior-most political official at CISA. He was appointed acting director in May 2025 by DHS Secretary Kristi Noem.
A day earlier, the CISA called on critical infrastructure organizations to take decisive action against insider threats.
To support this effort, CISA has released a powerful new resource on January 28, assembling a multi-disciplinary insider threat management team.
Designed for critical infrastructure entities and state, local, tribal, and territorial (SLTT) governments, this comprehensive infographic provides actionable strategies guidance to proactively prevent, detect and mitigate insider threats — helping organizations stay ahead of evolving organizational vulnerabilities.
Insider threats often take two forms: calculated acts of harm and unintentional mistakes. Malicious insiders may exploit access for personal gain or revenge, causing severe damage to systems and trust. At the same time, negligence or simple human errors can open the door to vulnerabilities that adversaries can exploit.
. XC . PRS