CISA Acting Director Reportedly Uploaded Sensitive Government Documents to Public ChatGPT Instance

Madhu Gottumukkala, acting director of the Cybersecurity and Infrastructure Security Agency (CISA), reportedly uploaded government contracting documents marked "for official use only" into a public version of ChatGPT. The uploads reportedly triggered automated cybersecurity alerts and prompted a Department of Homeland Security review to assess potential exposure of sensitive information.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involved uploading sensitive government contracting documents marked 'for official use only' into a public AI system, creating a risk of unauthorized exposure of non-public sensitive information.

Additional risk subdomains

• 5.1 Overreliance and unsafe use: The acting director inappropriately relied on a public chatbot to process sensitive government documents, bypassing standard security protocols.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The risk was caused by a human decision to upload sensitive documents to a public AI tool, and the potential exposure of data was an unintentional outcome of trying to use the tool for work.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The report describes the use of ChatGPT, which is a chatbot. Under the EU AI Act, chatbots are classified as Limited Risk (Level 3) and are subject to transparency obligations.

AI system and alleged parties

• AI system: ChatGPT (OpenAI)
• AI purpose: Writing Assistant; Question Answering
• Behaviour type: Assistant
• Alleged developer: OpenAI
• Alleged deployer: Madhu Gottumukkala
• Alleged harmed parties: United States Government, United States Department of Homeland Security, National security and intelligence stakeholders, Cybersecurity and Infrastructure Security Agency

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Negligible. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

People affected

• Occurrences reported: 1
• People reportedly exposed: 1

Potential causes

Management

• Leadership Bypass of Policy: Senior official bypassed default block on ChatGPT for personal use.
• Inadequate Oversight of Exception: Management approved the exception without proper risk assessment.

Technology

• Public ChatGPT Version: Public tool shares uploaded data with OpenAI, risking exposure.
• Lack of Local Network Controls: Public version lacked federal network containment features of DHSChat.

Data Inputs

• Sensitive Document Input: Documents marked 'for official use only' were uploaded into the tool.

Human Factors

• User Policy Non-Compliance: Official ignored training on handling sensitive government documents.
• Insistence on Tool Access: Official pressured CISA to grant an exception for public ChatGPT.

Process and Methods

• Inadequate Exception Process: Exception was granted without enforcing secure, isolated AI alternatives.
• Delayed Response to Warnings: Security sensors flagged uploads but did not automatically block them.

Regulatory Environment

• AI Adoption Pressure: Executive order to remove AI barriers pressured rapid tool adoption.

Information quality

• Classification confidence: High
• Reason for confidence: The report clearly outlines the specific actions taken by the CISA acting director, the nature of the documents uploaded, and the security alerts triggered. While the final outcome of the internal review is unknown, the core facts of the AI safety incident are well-documented by multiple sources.
• Ambiguities identified: The exact content of the 'for official use only' contracting documents is not specified, and the final conclusion of the DHS internal review regarding actual security harm remains unclear.
• Alternative interpretations: The incident could be viewed purely as a human policy violation or insider threat rather than an AI safety incident, though the specific data-sharing mechanics of public LLMs are central to the risk.

The acting director of CISA uploaded sensitive, non-public government contracting documents to a public instance of ChatGPT, triggering automated DHS security alerts. While no classified information was exposed, the incident underscores the ongoing, established risk of insider data leakage through public AI tools and the challenges of enforcing AI security policies at high levels of government.

• Overall national security impact: Minor
• Scope: Single nation
• Primary target: United States
• Alleged perpetrator: Madhu Gottumukkala

Threat characteristics

• Imminence: Long-term. The incident has been contained with an internal review, but it highlights an ongoing strategic concern regarding government data leakage through public AI tools.
• Autonomy: Human-controlled. The AI was used as a passive tool to process documents directly uploaded by a human operator, with no autonomous decision-making involved.
• Novelty: Established threat. Data leakage of sensitive information to public LLMs by employees is a well-known and established risk, though notable here due to the official's seniority.

Impact by dimension

• Physical security: Negligible. No physical infrastructure, kinetic systems, or human safety elements were impacted or threatened by this incident.
• Information security: Minor. Sensitive 'for official use only' government contracting documents were uploaded to a public AI tool, risking exposure of non-public data, though no classified information was compromised.
• Sovereignty: Minor. Bypassing of established security protocols by a high-ranking government official highlights internal policy compliance issues but did not disrupt core government functions.
• Economic security: Negligible. No strategic technology, critical supply chains, or financial systems were targeted or compromised in this incident.
• Societal stability: Negligible. The incident was a localized internal government data handling issue with no impact on civil liberties, societal stability, or the general public.