Highlights
- Acting director requested special ChatGPT access whilst tool remained blocked for other DHS employees.
- Multiple security warnings flagged in first week of August after sensitive contracting documents uploaded.
- Internal review launched to assess potential harm to government security from exposures.
Security warnings triggered
While none of the files were classified, the material included CISA contracting documents marked "for official use only," a government designation for sensitive information not intended for public release, the four officials said.
Cybersecurity sensors at CISA flagged the uploads in August, with one official specifying there were multiple warnings in the first week of August alone.
Senior DHS officials subsequently led an internal review to assess potential harm to government security from the exposures, though it remains unclear what the review concluded.
Any material uploaded into the public version of ChatGPT is shared with owner OpenAI, meaning it can be used to help answer prompts from other users.
OpenAI has said the application has more than 700 million total active users. In a statement, CISA's director of Public Affairs Marci McCarthy said Gottumukkala "was granted permission to use ChatGPT with DHS controls in place," and that "this use was short-term and limited."
The statement added "acting director Dr Madhu Gottumukkala last used ChatGPT in mid-July 2025 under an authorised temporary exception granted to some employees."
Troubled leadership tenure
According to DHS policy, security officials are supposed to investigate any exposure of official use documents and determine the appropriateness of administrative or disciplinary action.
Following the detection, Gottumukkala met with senior DHS officials to review what he uploaded, with the department's then-acting general counsel Joseph Mazzara and chief information officer Antoine McCord involved in assessing potential harm.
Gottumukkala has helmed CISA in an acting capacity since May, when he was appointed by DHS secretary Kristi Noem.
His tenure has been troubled, including at least six career staff placed on leave this summer after he failed a counterintelligence polygraph examination.
