A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System

LoaderSave StorySave this storyCommentLoaderSave StorySave this storyEarlier this year, sources tell WIRED, a contractor caused a security incident at the Department of Defense by connecting a secure centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic’s AI coding agent. It appears that the agent used by the contractor, who is employed by the global consulting firm Accenture, then sent information about the DOD system, including login credentials, to a high-risk, third-party website.

The centralized system contains controlled unclassified information (CUI), which is considered sensitive and not to be released to the public without review. CUI can include information about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Additionally, security experts say, access to the system could allow for the exploitation of even more sensitive ones.

“It puts all the data that’s in there at risk,” says a source aware of the incident, who requested anonymity as they were not authorized to speak to the press. If the third-party software was compromised, “there could be somebody out there with the ability to log into a secure environment without anyone knowing. It’s 100 percent a national security threat and could cause irreparable harm.”

A DOD spokesperson tells WIRED that “the Department does not comment on the status of its networks or systems.”

“We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations,” an Accenture spokesperson tells WIRED. When pressed, Accenture didn’t offer clarification on who conducted the investigation, or dispute that there had been what could be characterized as an incident.

The Accenture employee is alleged to have connected a secure production environment to their personal Claude account so as to allow an AI agent to write and deploy code. Claude is currently barred from being used by DOD staff. (Anthropic directed WIRED to the company’s usage policy, which instructs users not to use its products to “interfere with the operation of military bases and related infrastructure” or to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”)

The Accenture employee’s AI agent ran on the DOD network for two months before it was identified and the vulnerability could be patched. Sources indicate that despite the security risks posed by the AI coding agent, Accenture employees did not treat the incident as severe or urgent. DOD employees and federal contractors are required to report any cybersecurity incident within 72 hours of its discovery, but sources indicate Accenture did not initially report the breach to the government at all.

“We are in a conflict with Iran right now,” says the employee, noting that Iran has attempted to hack several federal agencies and parts of US infrastructure. “It’s the worst time to be having this kind of cavalier attitude.”

Accenture currently has more than $3.5 billion in contracts with the federal government, nearly $605 million of which are with the DOD. The company also contracts with other federal agencies, such as the Department of Education, the General Services Administration, and the Department of Energy, among others. Earlier this month, the Federal Bureau of Investigation found that an Accenture contractor failed to patch a vulnerability that led to the hacking group ShinyHunters getting access to the details of thousands of the Bureau’s employees. The FBI removed that contractor in early October.

Matt Triner, founder of Hunter Strategy, a Washington, DC-based IT consulting company, says that the issue exemplifies the conflicting demands government contractors face more broadly. “Organizations are often punished for reporting incidents like this, even though it’s the right and legal thing to do,” says Triner. In many cases, he says, a company could lose government contracts by admitting they’ve had a security breach, though he says that an incident like the one described is “absolutely one that would need to be reported.”

Triner also notes that the increasing pressure on contractors to deliver projects faster and at a lower price point is at odds with prioritizing safety and security. “Unfortunately, everyone is operating in a system where there are competing rules and incentives, and that existed before AI, but now it’s the same problem on speed,” says Triner.

The coding environment accessed by the Accenture contractor is run on the Non-classified Internet Protocol Router Network (NIPRNet), a DOD network used for unclassified information. While it does connect to the internet—contractors and employees can access their emails and web browsers through the network—it is heavily secured.

According to the source, in order to automate the process of writing code and spinning up cloud servers, the contractor gave their login credentials to the Claude agent. This gave the agent administrative access and allowed it to bypass the security controls enforced through the normal login process. The AI agent—which was not only writing code but also committing it or saving the code into the system on behalf of the Accenture employee—needed to connect out to the internet to perform its tasks. In doing so, it appears to have sent the contractor’s login credentials, passwords, and a map of NIPRNet out to a third-party website.

WIRED is declining to name the third-party website so as to protect the system from further vulnerability, but the National Institute of Standards and Technology has previously identified it as high risk because it has a vulnerability that could let hackers inject instructions into an AI coding agent to steal credentials.

The system the AI agent accessed contained CUI. “Information from a CUI environment is not supposed to leave that infrastructure,” says the source. “There is no insight about what happened to the information, including the login credentials, after it was sent to [that service], whether it’s been retained”