A new and sensitive issue related to cybersecurity and the use of artificial intelligence has emerged in the United States, triggering concern within government and security circles. According to information disclosed by multiple U.S. officials, a senior government figure linked to national cybersecurity oversight made a mistake that has raised serious questions about data protection and the responsible use of AI technologies within federal institutions.
Sources revealed that Madu Gottumukkala, the acting head of the Cybersecurity and Infrastructure Security Agency (CISA), uploaded several sensitive government documents to the free, publicly accessible version of ChatGPT during the previous summer. This disclosure, confirmed by four senior officials from the U.S. Department of Homeland Security, has drawn significant attention from policymakers and cybersecurity experts due to the potential implications for government data security.
What makes the incident particularly striking is that Gottumukkala had formally sought special authorization to use artificial intelligence tools shortly after assuming his position in May 2025. At that time, the use of such AI platforms was prohibited for most other employees within the department. His request was submitted to the agency’s information office, indicating that he was aware of internal restrictions and the sensitivity surrounding AI usage in government environments. This context has intensified scrutiny over how and why the documents were uploaded.
Although the materials shared were not classified under the highest secrecy levels, they were clearly marked “For Official Use Only.” This designation indicates that while the documents are not classified, they are still restricted and not intended for public distribution. The uploaded files reportedly included contractual and administrative documents related to CISA, containing information that should have remained within government-controlled systems rather than being shared on an open AI platform.
The issue came to light when CISA’s internal cybersecurity monitoring systems detected unusual activity in August. Automated security sensors flagged the uploads, prompting senior officials at the Department of Homeland Security to initiate an internal review. The purpose of this investigation was to determine whether the incident caused any harm to government security, exposed sensitive operational details, or created vulnerabilities that could be exploited by hostile actors.
In response to the growing attention, CISA spokesperson Marci McCarthy defended Gottumukkala’s actions, stating that he used the AI tool in a limited manner and in accordance with existing guidelines. She emphasized that there was no intention to expose sensitive data and reiterated the agency’s commitment to complying with President Donald Trump’s executive order aimed at strengthening U.S. leadership in artificial intelligence by removing unnecessary regulatory barriers while maintaining safeguards.
Despite these assurances, critics argue that the episode highlights a broader and more troubling issue: even high-ranking officials with deep knowledge of cybersecurity risks can make errors when using rapidly evolving AI technologies. The concern is amplified by the nature of public AI platforms like ChatGPT, where uploaded information is processed by private companies such as OpenAI and may be retained or used to improve AI systems or generate responses for other users. This raises the risk of unintended data exposure beyond government control.
The sensitivity of the incident is further heightened by Gottumukkala’s role as the top political official at CISA. The agency is responsible for defending federal networks and critical infrastructure against increasingly sophisticated cyber threats from adversarial nations, including Russia and China. Given this mandate, any lapse—real or perceived—in handling sensitive information carries significant symbolic and practical consequences for the agency’s credibility.
Under federal policy, improper disclosure of restricted government information can lead to a range of disciplinary measures. These may include mandatory retraining, formal reprimands, or, in more serious cases, suspension or revocation of security clearances. As a result, the internal investigation is being treated with considerable seriousness, as its findings could shape not only accountability in this specific case but also future rules governing AI use across federal agencies.
The incident is being viewed as a cautionary example for the U.S. government as it continues to integrate artificial intelligence into its operations. While AI tools offer significant potential to enhance efficiency and decision-making, this case underscores the need for strict oversight, clear usage policies, and continuous training. Without such safeguards, even well-intentioned use of AI can pose risks to national security, data privacy, and institutional trust. The outcome of the ongoing review is expected to influence how the U.S. government balances innovation with security in its approach to artificial intelligence moving forward.