Cases › operational mistake › LR-2026-0374
Acting CISA director uploaded sensitive government documents to public ChatGPT
Preliminary Why: 1 report: Ars Technica · subject to change · 1 independent report
Status: no action reported
No source states: loss or records, agent tool, could do, deployer.
Severity moderate: data of others (government contract details) was touched, and the scope is bounded to the details in the uploaded files, as stated in the quoted sentence.
The system was the public version of ChatGPT, which the acting head of the US Cybersecurity and Infrastructure Security Agency, Madhu Gottumukkala, used after receiving exclusive permission, although the tool is blocked for most other DHS staff. He uploaded documents marked for official use only. What went wrong was that the uploaded files, though not classified, contained details of government contracts not subject to disclosure, and data entered into the public version of ChatGPT is stated to become the property of OpenAI. Cybersecurity sensors caught the transfers, recording several automatic alerts in August 2025 about confidential information leaving the federal network. He became the subject of an internal investigation, and senior DHS officials are assessing the damage to national security. Calls for disciplinary action have been made, and he remains in office.
What happened
What was done
No source states an action or fix.
Risks
Primary63 incidents
Rising: 5 vs 2.2 a week
Sorted by rule from the case's fields; not yet read from the sources.
Controls
Not yet read for controls. Controls that mitigate the primary risk:
HarnessTool allow-list · Fail-closed defaults · Stop control
ApplicationHuman approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment
Infrastructure / targetSimilar incidents
Evidence
- What set it off misused by a person
No source states: what went wrong, what it reached or did, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.
Show the full account: 5 items from the primary sources
What happened, in order
- 2025-08 Cybersecurity sensors recorded several automatic alerts about the transfer of confidential information outside the federal network.
Not dated in the sources:
- Gottumukkala received exclusive permission to use ChatGPT, which is blocked for other DHS employees.
- Gottumukkala became the subject of an internal investigation.
- High-ranking DHS officials were assessing the damage.
- Gottumukkala remained in office despite criticism and calls for disciplinary action.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
Disclosure date is not stated in the sources (publication dates are not used). The agency's claim that use was short-term and limited is disputed by anonymous sources and is not recorded as fact. The F2 link is judged held because sensors raised alerts, though the upload was not stopped. The H2 link is judged failed because data left the federal network. The sources do not state where the uploaded data went after upload.
LR-2026-0374 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON