# Check approval before uploading work documents

> The CISA reporting shows why permission to use an AI tool and permission to upload a file differ.

Source: https://fullbytedeveloper.com/blog/sensitive-documents-public-ai-boundaries
Originally posted: 2026-01-29
Published here: 2026-11-06

A February 5, 2026 Senate letter asked CISA's then-acting director about reporting that sensitive contracting documents had been uploaded to public ChatGPT. The letter is evidence of an oversight inquiry and the reported concern; it is not a final investigative finding. [1]

The original post stated the incident more definitively. Keep that distinction when sharing it: reported conduct, questions from investigators and established findings should not become interchangeable.

## Check the file as well as the tool

Before uploading a work document, confirm that its classification and contents are allowed in the specific account and service you plan to use. Permission to access a chatbot does not automatically authorize every document.

Check for customer details, contract terms, credentials and internal-only information. If the task can be completed with a short sanitized example, use that instead of the full file. Ask the document owner when the handling rule is unclear.

If an unintended upload occurs, record what was sent, to which account and when, then follow the organization's incident process. Deleting a chat should not be treated as proof that every copy has disappeared.

## Sources

1. [Senate letter to CISA about ChatGPT](https://www.grassley.senate.gov/imo/media/doc/grassley_to_cisa_-_chatgpt.pdf)

## Original posts

- [Instagram post](https://www.instagram.com/fullbytedeveloper/p/DUGqAjPEnbY/)