A contractor working for Accenture allegedly connected a personal account for Anthropic’s Claude Code to a secure, centralized Department of Defense system and left the AI coding agent running on the Pentagon’s network for about two months before this Claude Code Pentagon breach was discovered and patched, according to a WIRED investigation published October 29 and detailed by Pivot News.
During that time, the agent appears to have transmitted the contractor’s login credentials, passwords and a map of the network environment to a third-party website that WIRED declined to name, citing the risk of further exposure. The National Institute of Standards and Technology had previously flagged that service as high risk because of a vulnerability that could let attackers inject instructions into an AI coding agent and steal credentials.
What Was Announced?
The system the agent reached sits on the Non-classified Internet Protocol Router Network (NIPRNet), the military’s heavily secured network for unclassified information, which does connect to the open internet. It is used by multiple intelligence agencies and holds what the government calls controlled unclassified information (CUI), material that is not secret but cannot be released publicly without review.
A source familiar with the incident told WIRED the contractor handed the Claude agent their own login credentials so it could automate writing code and spinning up cloud servers. That gave the agent administrative access, letting it commit code into the system and bypass the security controls normally enforced during sign-in. Because the agent needed outbound internet access to do its work, it sent the credentials and network details outside the DOD environment in the process.
“Information from a CUI environment is not supposed to leave that infrastructure,” the source told WIRED, adding that there is no insight into what happened to the data, including the credentials, after it was sent, or whether it has been retained.
Denials and Response
Accenture disputes the allegations. A company spokesperson told WIRED: “These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations.” When pressed, the spokesperson did not say who conducted the investigation and did not dispute that something that could be characterized as an incident had taken place, according to the reporting.
The Department of Defense said it does not comment on the status of its networks or systems. Anthropic pointed WIRED to its usage policy, which bars using its products to interfere with military bases and related infrastructure, or to bypass authentication and monitoring controls without authorization.
Sources told WIRED that Accenture did not initially report the incident to the government, despite a federal requirement that defense contractors report cyber incidents within 72 hours of discovery. Matt Triner, founder of the Washington consultancy Hunter Strategy, called it “absolutely one that would need to be reported,” noting that “organizations are often punished for reporting incidents like this,” since admitting a breach can cost government contracts.
Why It Matters
Jake Williams, a former NSA hacker now at the security consultancy IANS, called an AI agent running code inside NIPRNet a “huge problem” with “huge national security impacts.” Individual records may be unclassified, he noted, but aggregated unclassified information can itself become classified: the location of hazardous materials plus the vulnerabilities of the facilities housing them can add up to something that would be withheld.
Triner said the exfiltrated network map matters on its own terms, because “what is sensitive is how public pieces are assembled into actionable intelligence.” A map might not get an attacker in, he said, but it would “help an attacker understand where the crown jewels are.”
The deeper worry runs toward the classified side. Code and tools are frequently tested on NIPRNet before deployment to SIPRNet, the military’s classified network, and JWICS, its top-secret intranet, both of which are air gapped. With stolen credentials, an attacker could enter NIPRNet and plant a backdoor that later rides into an air gapped system. “The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible,” Williams told WIRED. There is no indication hackers reached classified or top-secret systems.
The episode lands in an already tense moment between the Pentagon and Anthropic. Claude is currently barred from use by DOD staff, and in September an appeals court let the Pentagon keep its label of Anthropic as a supply chain risk. Separately, the FBI removed an Accenture contractor earlier in October after the ShinyHunters hacking group obtained details on thousands of Bureau employees through an unpatched vulnerability, according to WIRED.
As Triner put it, the pressure to deliver faster and cheaper against security “existed before AI, but now it’s the same problem on speed.”
Sources
- Pivot News: Accenture contractor’s personal AI agent ran two months on a DOD network (citing the WIRED investigation)
- Cyber Security News: Accenture contractor allegedly gave Claude AI agent access to secure Pentagon network
- GBHackers: Accenture employee allegedly gave Claude Code AI agent administrative access
