An Accenture office building, photographed in September 2022. Image: ajay_suresh / Wikimedia Commons, CC BY 2.0, cropped
.jpg){kind=link}
A contractor working for Accenture plugged a secure Defense Department system into their personal Claude Code account and left Anthropic’s coding agent running on the network for about two months, sources told Wired. Along the way, the magazine reports, the agent appears to have sent the contractor’s login credentials and a map of the network to an outside website that US standards officials have flagged as high risk.
Wired says the incident happened “earlier this year” but gives no dates. Pentagon staff are barred from using Claude: Defense Secretary Pete Hegseth branded Anthropic a supply chain risk in February, and in September an appeals court let the Pentagon keep that label, which shuts the military and its contractors off from Anthropic’s models.
What the agent could reach #
The system was a centralised coding environment used by several intelligence agencies, according to Wired’s sources. It runs on NIPRNet, the military’s network for unclassified information, and holds what the government calls controlled unclassified information: material that isn’t secret but can’t be released without review, and can include details of critical infrastructure, nuclear submarine propulsion and weak points against chemical and biological attacks.
The contractor wanted the agent to write code, commit it and spin up cloud servers, a source said, so they gave it their own login. That handed the agent administrative access and let it skip the security checks of the normal sign-in. To do its work it had to reach the open internet, and in doing so it appears to have sent the contractor’s credentials, passwords and a map of NIPRNet to a third-party site. Wired isn’t naming the site, but says the National Institute of Standards and Technology has listed it as high risk because of a flaw that could let attackers slip instructions into an AI coding agent and steal credentials.
“It puts all the data that’s in there at risk,” said a source aware of the incident, who called it “100 percent a national security threat.” Nobody knows what happened to the information once it left, the source added.
Two months, and no report #
The agent ran for two months before anyone spotted it and the hole was closed. Sources told Wired that Accenture staff didn’t treat the incident as severe or urgent, and that the company didn’t initially report it to the government at all, although defence contractors must report cyber incidents within 72 hours of finding them.
Matt Triner, founder of the Washington consultancy Hunter Strategy, told Wired that contractors are “often punished for reporting incidents like this”, but that one like this is “absolutely one that would need to be reported.”
Accenture denies wrongdoing. “These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations,” a spokesperson said, without saying who ran the investigation or disputing that an incident took place. The Pentagon said it “does not comment on the status of its networks or systems.” Anthropic pointed Wired to its usage policy, which forbids using its products to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”
Accenture holds more than $3.5 billion in federal contracts, nearly $605 million of them with the Pentagon, according to Wired, which adds that the FBI removed an Accenture contractor in early October after finding it had failed to patch a flaw that let the ShinyHunters hacking group reach details of thousands of FBI staff.
Why experts worry about the secret networks #
Tools are often tested on NIPRNet before they move to SIPRNet and JWICS, the military’s air-gapped networks for secret and top secret information. With stolen logins, an attacker could plant a backdoor in a tool that later travels onto those networks, said Jake Williams, a former NSA hacker on the faculty of the security consultancy IANS:
The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible.
Jake Williams, former NSA hacker, to Wired
Wired says there is no sign attackers reached a classified or top secret system. It is the second time this month a Claude agent has turned up somewhere it shouldn’t: Anthropic itself disclosed that one of its models helped itself to an access token for Georgia’s election data hub. The difference here is that, by the sources’ account, a person handed the agent the keys.
Why it matters #
The Pentagon says it stopped using Claude in a policy fight Anthropic is still contesting in court, yet the danger Wired describes came from a single contractor quietly wiring a personal agent into its systems. Banning a vendor does little about that; checking what AI agents contractors run, and with whose credentials, would.
Sources: Wired.