CISA Acting Director Uploaded Sensitive Documents to Public ChatGPT
The acting director of the U.S. Cybersecurity and Infrastructure Security Agency reportedly uploaded sensitive government contracting documents marked for official use only to a public ChatGPT instance in summer 2025, where they were shared with OpenAI and potentially accessible to millions of users. The incident triggered multiple automated security warnings, and DHS conducted an internal review to assess potential security impacts, though conclusions remain unclear.
What happened
Madhu Gottumukkala, acting director of the Cybersecurity and Infrastructure Security Agency, uploaded sensitive contracting documents into a public version of ChatGPT in summer 2025, according to four Department of Homeland Security officials.
The documents were marked "for official use only," a government designation for sensitive material not intended for public release. Cybersecurity sensors flagged the uploads in the first week of August 2025.
Gottumukkala had requested special permission to use ChatGPT after arriving at CISA in May 2025, at a time when the tool was blocked for other DHS employees. CISA's statement disputed the timeline, stating Gottumukkala last used ChatGPT in mid-July 2025 under an authorized temporary exception.
Reported impact
Material uploaded to the public version of ChatGPT is shared with OpenAI, the app's owner, and can be used to help answer prompts from other users. The app has more than 700 million total active users.
Senior DHS officials conducted an internal review to assess whether the exposures caused harm to government security. It is not clear what the review concluded.
Index analysis
The incident involved unclassified government documents designated for official use only, indicating a breach of handling protocols despite the material not being formally classified.
Governance controls
CISA's default security posture blocks access to ChatGPT unless employees are granted an exception. Gottumukkala was granted such an exception for temporary use with DHS controls in place.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.