The acting head of the United States Cybersecurity and Infrastructure Security Agency Madhu Gottumukkala is under scrutiny after reportedly uploading sensitive government documents to the public version of ChatGPT triggering internal security alarms and a Department of Homeland Security review.
Officials say the files were not classified but were labeled “For Official Use Only” a designation used for sensitive government information not meant for public release. The uploads occurred last summer activating multiple automated cybersecurity warnings designed to detect unauthorized disclosures from federal networks.
Gottumukkala who has served as CISA’s acting director since May 2025 had reportedly obtained special permission from the agency’s Office of the Chief Information Officer to use ChatGPT despite the public platform being blocked for most Department of Homeland Security employees over security concerns.
Once the activity was detected in August 2025 senior DHS officials launched an internal review to assess whether the disclosures had caused any harm to government security though the findings have not been made released publicly.
CISA officials have said the use of ChatGPT was “short-term and limited” and that default policy continues to block access to the tool unless specific exceptions are granted. However the incident has raised fresh questions about the risks of using public AI tools for sensitive government work given that information entered into public versions of ChatGPT can be shared with the AI provider and potentially used to improve future model responses.
Gottumukkala’s leadership has already drawn attention in recent months adding to the controversy surrounding the agency responsible for safeguarding U.S. government networks and critical infrastructure.
