The issue centres on CISA acting director Madhu Gottumukkala, who uploaded sensitive but unclassified government contracting documents to a public version of ChatGPT during July and early August 2025. The activity triggered automated security alerts and a Department of Homeland Security review after material marked for official use only was sent to the service.
CISA said Gottumukkala had received permission to use ChatGPT for a limited period and that Department of Homeland Security safeguards were in place. The agency has not said that classified information was involved, and public accounts of the review have not established that the material was misused. The episode highlighted the difficulty of governing authorised AI use when the person, the data and the tool may each fall under different controls.
That concern has grown as companies move from chatbots that answer questions to agentic systems that can retrieve records, call software tools, send messages and take actions on a user’s behalf. CISA and cyber agencies from Australia, Canada, New Zealand and the United Kingdom, together with the US National Security Agency, warned in joint guidance released in May that agentic AI can create privilege, configuration, behavioural, structural and accountability risks.
Their guidance urges organisations to limit autonomy, avoid access to sensitive information or critical systems, use strong identity controls, maintain monitoring and carry out threat modelling and security assessments. It treats accountability as an operational control rather than merely a policy question because an autonomous system can execute several steps after receiving a single instruction.
Enterprise data suggest those controls remain uneven. IBM’s 2026 Cost of a Data Breach research found that about one in five organisations surveyed had suffered an AI-related breach. Among those, 92 per cent lacked proper AI access controls. Fewer than half of organisations were actively securing non-human identities, a category that increasingly includes AI agents operating through applications, APIs and cloud services.
IBM also found that only 40 per cent of organisations used access controls on AI models and data. Its findings point to a governance problem: an agent can appear in audit records as though it were the user whose credentials it inherited, making it harder to distinguish a person’s decision from an autonomous action unless identity and logging systems are designed for that purpose.
The distinction matters for responsibility. Traditional enterprise controls usually assign access to a named employee, service account or system owner. Agentic AI can blur those boundaries by acting under delegated authority, chaining tasks across services and making intermediate decisions that the original user did not individually approve.
CISA’s guidance recommends that organisations define roles and responsibilities for agentic systems, apply least-privilege access and ensure human oversight is proportionate to the possible impact of an agent’s actions. Those measures are intended to preserve a traceable link between an automated action and the human or organisational authority behind it.
The gap is not limited to government. Businesses using AI for procurement, customer records, financial workflows, software development and internal communications face the same question when an agent sends information to the wrong destination, retrieves material beyond its intended scope or executes a valid instruction in an unsafe context.
Security specialists argue that AI governance must therefore operate at the transaction level, not only through annual policies or approved-tool lists. That means recording which person authorised an agent, what permissions it held, which data it accessed, what external systems it contacted and whether the action exceeded defined limits.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
