The acting head of the nation’s cyber defense agency uploaded sensitive government contracting materials into the public version of ChatGPT last summer, setting off multiple automated security alerts designed to prevent the loss or improper release of federal information, according to four officials at the Department of Homeland Security familiar with the matter. The incident was first reported by Politico.
The episode drew particular attention because Dr. Madhu Gottumukkala, who serves as acting director of the Cybersecurity and Infrastructure Security Agency, had personally sought and received special approval from CISA’s Office of the Chief Information Officer to access the AI tool shortly after he arrived at the agency in May, three of the officials said. At the time, the application remained blocked for other DHS employees.
The four officials said none of the materials uploaded were classified. However, they included CISA contracting records labeled “for official use only,” a designation applied to information considered sensitive and not intended for public dissemination. All four sources spoke on condition of anonymity out of concern for possible retaliation.
According to the officials, CISA’s cybersecurity monitoring systems detected the uploads in August. One source said there were several alerts during the first week of that month alone. Senior DHS leadership then launched an internal review to determine whether the disclosures posed any risk to government security, two of the officials said.
The outcome of that review has not been made public.
In a written statement, CISA Director of Public Affairs Marci McCarthy said Gottumukkala “was granted permission to use ChatGPT with DHS controls in place,” adding that “this use was short-term and limited.” McCarthy said the agency remains committed to “harnessing AI and other cutting-edge technologies to drive government modernization and deliver on” President Donald Trump’s executive order aimed at removing barriers to American leadership in artificial intelligence.
Her statement also appeared to challenge the timeline cited by Politico, saying: “Acting Director Dr. Madhu Gottumukkala last used ChatGPT in mid-July 2025 under an authorized temporary exception granted to some employees. CISA’s security posture remains to block access to ChatGPT by default unless granted an exception.”
Gottumukkala is currently the highest-ranking political official at CISA, an agency responsible for defending federal networks from advanced cyber threats posed by hostile nation-states, including Russia and China.
Any information entered into the public version of ChatGPT is shared with its owner, OpenAI, meaning it can be used to help generate responses for other users. OpenAI has said the platform has more than 700 million active users worldwide.
By contrast, AI tools approved for DHS employees, including the department’s internally developed chatbot known as DHSChat, are configured to ensure that queries and documents remain within government systems and do not leave federal networks.
Gottumukkala “forced CISA’s hand into making them give him ChatGPT, and then he abused it,” said one of the officials.
Federal employees receive training on how to properly handle sensitive materials. DHS policy also requires security officials to examine the “cause and affect” of any exposure involving documents marked for official use and to determine the “appropriateness” of administrative or disciplinary steps. Depending on the findings, consequences can range from mandatory retraining or written warnings to more severe actions such as suspending or revoking a security clearance, one official said.
After the activity was detected, Gottumukkala met with senior DHS officials to review the materials he had uploaded to ChatGPT, according to two of the officials. DHS’s then-acting general counsel, Joseph Mazzara, participated in evaluating any potential harm to the department, one source said. DHS Chief Information Officer Antoine McCord was also involved, another official said.
The officials added that Gottumukkala also met in August with CISA’s chief information officer, Robert Costello, and its chief counsel, Spencer Fisher, to discuss the incident and proper handling of “for official use only” information.
Mazzara and Costello did not respond to requests for comment. McCord and Fisher could not be reached.
Gottumukkala has led CISA in an acting role since May, when DHS Secretary Kristi Noem appointed him deputy director. President Trump’s nominee to permanently head the agency, DHS special adviser Sean Plankey, was blocked last year by Sen. Rick Scott of Florida over a Coast Guard shipbuilding contract, and a new confirmation hearing has yet to be scheduled.
His tenure has been marked by controversy, including prior security-related issues. Earlier this summer, at least six career employees were placed on leave after Gottumukkala failed a counterintelligence polygraph exam that he had requested, as Politico previously reported. DHS later described the test as “unsanctioned.” During congressional testimony last week, when asked by Rep. Bennie Thompson of Mississippi whether he was “aware” of the failed exam, Gottumukkala twice responded that he did not “accept the premise of that characterization.”
Separately, Gottumukkala attempted last week to remove Costello from his post as CISA’s chief information officer, a move that was halted after other political appointees intervened.
{Matzav.com}
