CISA Case Renews Scrutiny Of AI Accountability Arabian Post

2026-09-11 02:16:41

(MENAFN- The Arabian Post) clearfix">A US government cybersecurity episode involving ChatGPT is drawing attention to a wider governance problem: organisations are deploying artificial intelligence faster than they are assigning responsibility for what AI systems are allowed to do.

The issue centres on CISA acting director Madhu Gottumukkala, who uploaded sensitive but unclassified government contracting documents to a public version of ChatGPT during July and early August 2025. The activity triggered automated security alerts and a Department of Homeland Security review after material marked for official use only was sent to the service.

CISA said Gottumukkala had received permission to use ChatGPT for a limited period and that Department of Homeland Security safeguards were in place. The agency has not said that classified information was involved, and public accounts of the review have not established that the material was misused. The episode highlighted the difficulty of governing authorised AI use when the person, the data and the tool may each fall under different controls.

<p>That concern has grown as companies move from chatbots that answer questions to agentic systems that can retrieve records, call software tools, send messages and take actions on a user's behalf. CISA and cyber agencies from Australia, Canada, New Zealand and the United Kingdom, together with the US National Security Agency, warned in joint guidance released in May that agentic AI can create privilege, configuration, behavioural, structural and accountability risks.</p><p>Their guidance urges organisations to limit autonomy, avoid access to sensitive information or critical systems, use strong identity controls, maintain monitoring and carry out threat modelling and security assessments. It treats accountability as an operational control rather than merely a policy question because an autonomous system can execute several steps after receiving a single instruction.</p>See also  Iran braces for sweeping US economic offensive <p>Enterprise data suggest those controls remain uneven. IBM's 2026 Cost of a Data Breach research found that about one in five organisations surveyed had suffered an AI-related breach. Among those, 92 per cent lacked proper AI access controls. Fewer than half of organisations were actively securing non-human identities, a category that increasingly includes AI agents operating through applications, APIs and cloud services.</p><p>IBM also found that only 40 per cent of organisations used access controls on AI models and data. Its findings point to a governance problem: an agent can appear in audit records as though it were the user whose credentials it inherited, making it harder to distinguish a person's decision from an autonomous action unless identity and logging systems are designed for that purpose.</p><p>The distinction matters for responsibility. Traditional enterprise controls usually assign access to a named employee, service account or system owner. Agentic AI can blur those boundaries by acting under delegated authority, chaining tasks across services and making intermediate decisions that the original user did not individually approve.</p><p>CISA's guidance recommends that organisations define roles and responsibilities for agentic systems, apply least-privilege access and ensure human oversight is proportionate to the possible impact of an agent's actions. Those measures are intended to preserve a traceable link between an automated action and the human or organisational authority behind it.</p><p>The gap is not limited to government. Businesses using AI for procurement, customer records, financial workflows, software development and internal communications face the same question when an agent sends information to the wrong destination, retrieves material beyond its intended scope or executes a valid instruction in an unsafe context.</p>See also  Mubadala takes minority stake in Luckin Coffee <p>Security specialists argue that AI governance must therefore operate at the transaction level, not only through annual policies or approved-tool lists. That means recording which person authorised an agent, what permissions it held, which data it accessed, what external systems it contacted and whether the action exceeded defined limits.</p><div class='code-block code-block-1'><h2></h2></div>

MENAFN11092026000152002308ID1111653106

Legal Disclaimer:
MENAFN provides the information “as is” without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the provider above.

CISA Case Renews Scrutiny Of AI Accountability Arabian Post

More Story