Contractor's personal Claude agent ran on a Pentagon network for two months, sources say

An Accenture employee connected a secure Department of Defense production environment to their personal Claude account, so that an AI agent could write and deploy code there. That is what sources told WIRED. According to those sources, the agent ran on the DOD network for two months before anyone identified it and the vulnerability was patched.

The environment holds controlled unclassified information (CUI). That category of sensitive data is not released to the public without review. The incident shows a quiet way AI agents can end up inside sensitive systems: one worker trying to work faster, using their own tools and their own credentials, without approval from the organisation.

What the agent did

The coding environment runs on the Non-classified Internet Protocol Router Network (NIPRNet), the DOD network for unclassified information. It connects to the internet but is heavily secured. According to a source, the contractor wanted to automate writing code and spinning up cloud servers, so they gave the Claude agent their login credentials. This gave the agent administrative access and let it bypass the security controls that apply through the normal login process.

The agent wrote code and also committed it to the system on the employee's behalf. It needed to connect to the internet to do this. In the process it appears to have sent the contractor's login credentials, passwords and a map of NIPRNet to a third-party website. WIRED does not name the site. It reports that the National Institute of Standards and Technology has previously flagged the site as high risk, because of a vulnerability that could let attackers inject instructions into an AI coding agent and steal credentials.

"Information from a CUI environment is not supposed to leave that infrastructure," the source told WIRED. The source added that nobody knows what happened to the information after it was sent, or whether it was retained.

Claude is currently barred from use by DOD staff. When WIRED asked Anthropic, the company pointed to its usage policy. The policy tells users not to use its products to "interfere with the operation of military bases and related infrastructure" or to "bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization."

Reporting and the responses

DOD employees and federal contractors must report any cybersecurity incident within 72 hours of discovering it. Sources told WIRED that Accenture did not initially report the incident to the government at all, and that employees did not treat it as severe or urgent.

An Accenture spokesperson said the allegations "were thoroughly and independently investigated and found to be without merit" and that the company "fully complied with our legal and contractual obligations." WIRED reports that Accenture did not say who carried out the investigation. It also did not dispute that there had been what could be characterised as an incident. A DOD spokesperson said the department does not comment on the status of its networks or systems.

Accenture holds more than $3.5 billion in federal contracts, including nearly $605 million with the DOD. Earlier in October, the FBI found that an Accenture contractor had failed to patch a vulnerability. The hacking group ShinyHunters used it to get details of thousands of Bureau employees. The FBI removed that contractor in early October.

Matt Triner, founder of the IT consultancy Hunter Strategy, told WIRED that contractors are "often punished for reporting incidents like this" and can lose contracts by admitting a breach. He said this one "absolutely" needed to be reported. He also described contractors under pressure to deliver faster and more cheaply: "that existed before AI, but now it's the same problem on speed."

Why a map and a login matter

There is no indication that attackers reached a classified or top-secret system. The experts WIRED spoke to described two risks anyway.

The first is the map. Triner said a picture of how systems fit together can "help an attacker understand where the crown jewels are" once they get in. Jake Williams, a former NSA hacker now on the faculty at IANS, said that CUI can become classified when it is aggregated. One example is the location of hazardous materials combined with the vulnerabilities of the facilities that hold them.

The second is the code path. Tools are often tested on NIPRNet before they are deployed to SIPRNet, the military's classified network, and JWICS, its top-secret intranet. Both are air-gapped. With stolen NIPRNet credentials, an attacker could insert a backdoor into a tool that later moves into those systems. "The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible," Williams said.

The government scans code on NIPRNet with Static Application Security Testing, which looks for bugs before code runs. Williams noted that a deliberate "backdoor is not a vulnerability," so it would likely pass such scans. He added that with an agent, "you have no idea of the supply chain or even the inference chain of what has ultimately generated the code."

What it means for work

The employee handed an agent the parts of the job that are usually slow: writing code, committing it and provisioning servers. To make that work, the agent also took on the employee's identity and access rights. Access controls built around human logins assume that the person who authenticates is the one acting. A personal agent holding the same credentials breaks that assumption. It can stay unnoticed for weeks. For contractors and IT teams on sensitive systems, the work now includes finding agents that nobody approved and reviewing machine-written code at a volume people cannot easily check. Some questions remain open: who is accountable when a worker's own agent leaks data, how incident reporting rules apply to it, and whether the pressure for speed that Triner describes will push more workers to bring their own AI.