A February 5, 2026 oversight letter from Sen. Chuck Grassley (R-IA) to Madhu Gottumukkala, Acting Director of the Cybersecurity and Infrastructure Security Agency (CISA), seeking records and explanation after Politico reported that Gottumukkala had uploaded sensitive federal documents to a public instance of ChatGPT. The letter set a February 19, 2026 response deadline.
- Sender: Sen. Chuck Grassley (R-IA)
- Recipient: Madhu Gottumukkala, Acting Director, Cybersecurity and Infrastructure Security Agency (CISA)
- Date: February 5, 2026
- Response deadline: February 19, 2026
Triggering incident
Politico reported in late January 2026 that Gottumukkala had uploaded at least four documents marked "for official use only" to a public instance of ChatGPT the prior summer. According to the reporting, CISA was generally blocked from accessing ChatGPT on government networks and devices, and Gottumukkala had obtained special access not available to other CISA staff.
Letter requests
Grassley asks CISA to:
- Confirm the accuracy of the Politico allegations.
- Explain the rationale behind Gottumukkala's request for permission to use public ChatGPT.
- Produce all records related to the approval of that request.
- Describe what CISA considered "short-term and limited" about the use.
Context
CISA is the federal agency responsible for US cybersecurity. The letter frames the upload of documents marked for official use only by a sitting CISA Acting Director as an example of the data-exfiltration concerns associated with consumer LLM use in government, of the kind flagged in GAO-25-107172 — Generative AI's Environmental and Human Effects and AI Compliance Industry / Regulatory Fragmentation, and connects to OpenAI Files–style and Sycophancy and Hallucination concerns about federal adoption of consumer LLMs.
The episode sits alongside the White House AI Action Plan's push for federal AI adoption (America's AI Action Plan), and Grassley's inquiry bears on whether that adoption proceeds through controlled or audited LLM deployments, such as those routed through GSA OneGov Program and USAi Platform (August 2025).
Relationships
- supports: Planned Government AI Procurement, AI Compliance Industry / Regulatory Fragmentation, AI and Cybersecurity.
- contradicts: America's AI Action Plan unrestricted-adoption framing.
- related: GSA OneGov Program and USAi Platform (August 2025), planned CISA — Cybersecurity and Infrastructure Security Agency (AI Deployer), planned Sen. Chuck Grassley.