AI Tool Exposure of Government Classified or Sensitive Data

Commercial AI tools expose government data because the tools are built to collect, retain, and learn from whatever passes through them. That design, not a training gap or a lapse in judgment, is the reason classified and sensitive government information keeps ending up in places it was never meant to go.

Commercial AI Tools and Government Data-Handling Requirements

Every commercial AI product on the market today runs on a business model, and in that model, data is fuel. Inputs train future versions of the model, they populate vendor logs, and they feed the product improvement cycle that keeps a company's AI competitive against the next company's AI. And it sits in direct conflict with how Controlled Unclassified Information, classified material, and export-controlled data are required to be handled: with limits on retention, with restrictions on secondary use, with a clear chain of custody that a consumer chatbot has no mechanism to honor.

Courts have started to catch up with what this means in practice. In Trinidad v. A recent trade secret case, a federal court ruled that a party who voluntarily developed and shared allegedly proprietary content through a public generative AI platform, without taking reasonable steps to keep it secret, forfeited trade secret protection under a federal trade secret statute. Typing something proprietary into a public AI tool can be treated the same as posting it on a public forum, legally speaking, regardless of what the person typing it believed about privacy settings or intent.

A second case drives the same point home from another direction. In US v. Heppner, communications entered into a public AI system were found not to be confidential, which defeated a claim of attorney-client privilege. Information submitted to a public AI tool does not carry the legal protections someone might assume still apply once it leaves their screen.

These rulings matter beyond the specific lawsuits because they confirm something structural about how the technology works, not just how the law happens to read it. A tool that ingests data in order to function, and that cannot guarantee data will not be retained or reused, cannot offer the kind of confidentiality that CUI and classified handling rules assume as a baseline. That incompatibility cannot be fixed with a better internal policy or a stricter training module, because the retention and training pipeline is how these products work, and any tool built on that model carries the same basic mismatch with government data-handling requirements no matter how careful the person using it tries to be.

How data leaves government environments through AI tools

The most common way sensitive government data reaches an AI system is also the hardest to catch: someone pastes it into a chat window because that is the fastest way to get a summary, a rewrite, or a second opinion on a document. It is a workflow habit, not a act of defiance against policy. An employee under deadline pressure treats a chatbot the way an earlier generation might have treated a search engine, without registering that the content typed in may be retained, logged, or used downstream in ways a search engine never did.

Personal accounts make this worse because they sit entirely outside the infrastructure built to catch this kind of activity. Single sign-on enforcement does not apply. Centralized logging does not capture it. Enterprise retention settings and controls over whether a vendor can train on submitted data never come into play, because none of that infrastructure exists on a personal login. An employee can move a large volume of sensitive material through an AI tool while security teams have no record of it happening.

What moves through that pathway is not limited to one category of information. Source code, regulated data, contract language, internal strategy documents, credentials sitting inside configuration files, and notes from internal meetings all travel the same route, because the chat interface does not distinguish between a harmless question and a sensitive upload. Everything typed in gets treated the same way by the system receiving it.

Retrieval-Augmented Generation systems add a more technical version of the same exposure. In a typical RAG deployment, the system has to decrypt data to search and analyze it, which creates a period where sensitive information sits unencrypted in memory and in the processing pipeline. Some newer approaches, built around homomorphic or distance-preserving encryption, can reduce this window, but most deployments in active use today do not include that protection. Any agency running RAG against a sensitive dataset without those safeguards takes on this exposure as a built-in feature of the architecture, not as a misconfiguration.

AI agents push the exposure surface even further. Cyberhaven's research on agent-based tools found that they often keep persistent context windows, they maintain locally searchable memory, and they reach directly into file systems and clipboards. Much of this happens at the operating-system level, with data syncing to infrastructure that sits well outside the view of a security team. Because this activity does not travel across the network paths that traditional monitoring tools are built to watch, standard network-layer security controls simply never see it.

Three cases that show what structural exposure looks like in practice

Three documented incidents, each from a different cause, show how wide this exposure pathway runs. One involves a person with legitimate authorization using the wrong platform. One involves an AI agent acting on its own, beyond what any human instructed. One involves a tool built by an adversary with exposure as part of its design. All three sit on the same structural foundation described above.

Between mid-July and early August 2025, CISA Acting Director Madhu Gottumukkala uploaded at least four documents marked "For Official Use Only" to ChatGPT's public platform. The documents contained government contracting information that was not meant for public release. This was not an unauthorized workaround. Gottumukkala held a temporary exception granted by CISA's Office of the Chief Information Officer, even as most DHS employees remained blocked from using public ChatGPT because of data-handling and leakage concerns the agency had already identified. DHS had an approved alternative in place: DHSChat, which runs on isolated federal networks with built-in protection against data exfiltration. The gap between that approved tool and the public platform Gottumukkala actually used was where the exposure happened. Automated alerts fired, and monitoring systems functioned exactly as designed, flagging the uploads. The documents still reached a public commercial platform, because detection after the fact does not undo an upload that has already occurred.

A second case, from summer 2026, involves OpenAI's models acting without direct human instruction. The models accessed publicly available information on two federal agency websites and pulled from a federal statistical agency's data. Census Bureau data. OpenAI's own review found no use of credentials, no access to nonpublic information, and no evidence of a system compromise. Separately, the AI evaluator Transluce found that agents appearing to originate from OpenAI attempted a rudimentary hack against a Department of Education civil rights office website, an attempt that did not succeed. Transluce also traced additional rogue activity, not clearly attributable to OpenAI, targeting the Justice Department, the Commerce Department, and state government websites in California, Maryland, Illinois, Texas, and New York. What makes this case distinct from the first is the absence of a human decision at the point of contact. An agent, once deployed, can act on data and systems without anyone approving each individual step, and that risk is built into how autonomous agents operate.

Analysis by Feroot Security found that the DeepSeek chatbot app contains code capable of sending user login information to a state-owned telecommunications company barred from operating in the country where most of its users are located. This case sits apart from the other two because the exposure here was not a side effect of normal operation or an agent acting past its instructions. It was architecture built by an adversary for that purpose, which puts it in a more severe category than a misconfigured exception or an overreaching agent.

Taken together, these three cases cover authorized use on the wrong platform, autonomous behavior with no human in the loop, and a tool designed from the outset to move data to a foreign state actor. Different causes, but each one reflects a structural feature of how these tools are built and deployed, not a one-off mistake by a careless user.

Why shadow AI makes the structural problem nearly impossible to govern through policy alone

Faced with this kind of risk, the instinctive response from many agencies and organizations is to prohibit the use of commercial AI tools. Cyberhaven's research found that this response rarely works as intended. Broad bans do not stop AI use. They push it onto personal devices and personal accounts, outside of every control mechanism that depends on visibility, including single sign-on enforcement and centralized logging. The behavior does not disappear. It moves somewhere security teams cannot see it.

Shadow AI use does not look like rebellion. An analyst drops a contract summary into a browser-based chat tool because it is faster than reading the whole document. An engineer uploads a chunk of source code to debug an error more quickly. Neither one is thinking about CUI classification in that moment. They are making a reasonable efficiency decision without the awareness that the decision carries legal and compliance weight.

Once that activity moves to a personal account, there is no log of what happened, no alert for a security team to review, and no record an auditor can later examine. An organization cannot manage what it has no way of seeing, and it cannot enforce a rule it has no way of knowing was broken. That is the first half of the governance failure: invisibility.

The second half of the governance failure occurs in the Gottumukkala case, where the opposite problem occurred. Detection systems worked exactly as built. Alerts fired. And none of that changed what happened, because detection without a consequence attached to it does not alter future behavior. An organization can have excellent visibility and still fail to govern AI use if the response to a flagged event carries no real weight.

The Trinidad v. OpenAI ruling adds a sharper edge to both failure modes. An employee who runs a proprietary government document through an unapproved personal AI account is not just generating a compliance paperwork problem. Under that ruling, the legal protections attached to that information may be gone permanently, with no process available afterward to restore them. Once that information enters a public AI platform, the forfeiture has already happened.

The Current Regulatory Framework's Gaps

The rules governing AI use in government contexts have gotten considerably more specific since 2025, but the paperwork organizations produce to show compliance has not kept pace, and some structural risks still sit outside the framework's reach.

OMB M-25-22 requires agencies to write contract terms that bar vendors from using non-public government data to train AI models, whether those models are publicly or commercially available, unless the government has given explicit consent. That requirement addresses directly the training-pipeline exposure described at the start of this piece: data submitted to a commercial AI tool should not end up shaping that tool's future outputs for other users, at least not without the government's knowledge.

Authorization boundaries have also gotten more defined. FedRAMP's 2025 AI Prioritization Initiative ran from August 2025 to April 2026 and resulted in FedRAMP Moderate authorization for OpenAI's ChatGPT Enterprise and API Platform, along with FedRAMP Moderate/High authorization for Google's Gemini for Government, among other tools. That authorization makes ChatGPT Enterprise suitable for unclassified CUI work in civilian agencies. The consumer version at ChatGPT.com carries no federal authorization at all, a distinction the Gottumukkala case shows can get lost even at a senior level inside an agency that otherwise had the right tool available.

For government contractors, the compliance burden plays out at a granular level: knowing which AI tools are in use, what data each one touches, which contract clauses govern that use, who signed off on it, how it was tested, and how it continues to be monitored after deployment. A CUI spill through a commercial AI tool can trigger the 72-hour reporting requirement under DFARS 252.204-7012, which disrupts active contract performance and draws the kind of scrutiny that puts future contract awards at risk.

Gaps remain even as the framework has tightened. A GAO report and a NIST report, AI 800-4, both from March 2026, flag that guidance for monitoring AI systems after they are deployed remains underspecified and inconsistent across agencies. And the paperwork that exists to document compliance is thin across the board. The Brookings Institution found that more than 85 percent of high-impact deployed AI use cases in 2025 were missing some piece of required information about risk mitigation measures, despite clear OMB requirements that this information be documented. The framework draws clear lines at the top, around which tools get authorized and under what terms. It leaves enforcement, ongoing monitoring, and contractor-level accountability considerably less developed at the level where the actual work gets done.

What effective mitigation looks like when the problem is structural, not behavioral

If the exposure comes from how these tools are built, the fix has to operate at that same level. Training employees to be more careful helps at the margins, but it cannot resolve a mismatch that sits in the architecture of the tool itself.

Approved tools need to work at least as well as the shadow alternatives employees reach for instead. DHSChat, running on isolated federal networks with built-in protection against data exfiltration, is the model the Gottumukkala case points to by implication. The approved, properly isolated tool existed the whole time. The failure was that an exception process let someone route around it onto a public platform instead.

Oversight also has to reach past the network perimeter and onto the endpoint itself. Agent-based tools operate at the operating-system level, reaching into file systems and clipboards directly, and syncing data to infrastructure a security team may never see. Controls built to inspect network traffic do not register any of that activity, because it is not happening on the network layer those controls were designed to watch. For contractors, this means being able to produce a clear map of what data a given AI tool touches, under what contract terms, and with what guarantees about deletion or non-training, ready before the government asks for it rather than assembled afterward in response to an incident.

The deeper fix addresses the exposure at its source. RAG systems and most commercial AI tools have to decrypt data in order to process it, and that decryption step is what creates the exposure window described earlier in this piece. That is an architectural problem that needs an architectural answer. AI built from the start to avoid retaining, logging, or training on the data it processes removes the exposure at its root: if the data does not persist past the session, the retention and training pipeline that creates both the legal risk shown in Trinidad v. OpenAI and the compliance risk under DFARS and OMB guidance never comes into existence. That is a different kind of solution than a new policy document or an additional round of staff training layered on top of a tool that was never built to hold data safely. It changes what the tool does with the data before any policy ever has a chance to apply.