Cybersecurity and Infrastructure Security Agency
Incident posture
Linked entities
- Victim
- Cybersecurity and Infrastructure Security Agency
- Threat actors
- 0 actors
- Sources
- 1 source
Timeline
Summary
The Cybersecurity and Infrastructure Security Agency's acting director uploaded sensitive government contracting documents marked for official use only to a public version of ChatGPT despite the tool being blocked for most Department of Homeland Security employees. Security sensors detected the uploads, generating alerts that prompted an internal assessment involving department officials and agency leaders, and a spokesperson later said the use had been approved as a short‑term limited exception under existing safeguards.
Motives
Detailed motive labels are available to members.
TTPs
Detailed technique labels are available to members.
Description
Madhu Gottumukkala, who had been serving as the acting director of the Cybersecurity and Infrastructure Security Agency since May 2025, uploaded at least four documents marked "for official use only" to the public version of OpenAI’s ChatGPT platform between mid‑July and early August 2025. The uploads occurred after Gottumukkala had personally requested special permission to use ChatGPT shortly after joining the agency. At that time, the public ChatGPT service was blocked for most Department of Homeland Security employees due to concerns that sensitive information could be retained outside federal networks. The documents contained contracting information that was not intended for public release.
Cybersecurity sensors detected the upload activity in early August, producing several security alerts during the first week of detection. The alerts triggered an internal assessment conducted by the Department of Homeland Security. The assessment involved the then‑acting general counsel Joseph Mazzara, the DHS chief information officer Antoine McCord, CISA’s chief information officer Robert Costello, and CISA’s chief counsel Spencer Fisher. The outcome of that assessment has not been disclosed publicly.
A CISA spokesperson, Marci McCarthy, confirmed that Gottumukkala had received approval to use ChatGPT under existing DHS safeguards. She described the usage as short‑term and limited. McCarthy stated that the acting director last used the tool in mid‑July 2025 under an authorized temporary exception. She also noted that CISA’s default policy continues to block ChatGPT access unless a specific exception is granted.
Sources
Sources available to members: 1 source.