Contractor linked personal Claude agent to secure Pentagon system, Wired reports

What this is about

Citing anonymous sources, Wired reports a security incident at the US Department of Defense (DOD). A contractor from the consulting firm Accenture allegedly connected a central system used by several intelligence agencies to his personal Claude Code account in early 2026. Claude Code is Anthropic's AI coding agent. The agent then reportedly sent information about the system, including credentials, to a risky external website. The DOD does not comment on the state of its networks. Accenture says the allegations were thoroughly and independently investigated and found to be unfounded. The company did not say who investigated, and it did not deny that an incident occurred.

What allegedly happened

The employee reportedly connected a secure production environment to his personal Claude account so the agent could write and deploy code. To automate writing code and spinning up cloud servers, he allegedly gave the agent his login credentials. That reportedly gave the agent administrator rights and bypassed the security controls of the normal login. The agent also committed code to the system in the employee's name.

Because the agent needed internet access for its tasks, it reportedly sent login credentials, passwords and a map of NIPRNet to a third-party site, according to the sources. NIPRNet is the DOD network for unclassified information. It is connected to the internet but heavily secured. Wired does not name the site. According to the report, NIST has classified it as high-risk because attackers there could inject instructions into AI coding agents to steal credentials. Claude is currently blocked for DOD employees. Anthropic pointed to its usage policy, which among other things prohibits bypassing security controls such as authentication without permission.

The agent allegedly ran on the network for two months. Employees and contractors must report cyber incidents within 72 hours of discovery. According to the sources, Accenture initially did not report the incident at all and did not treat it as serious.

Why this could be dangerous

The system contains CUI (Controlled Unclassified Information): sensitive but not classified information, for example on critical infrastructure, nuclear submarine propulsion, or vulnerability to chemical and biological terrorism. Such information must not leave the infrastructure. According to a source, it is unknown what happened to the data that was sent or whether it was stored.

Experts stress the value of the "map": it shows how systems connect and helps attackers find the most valuable targets faster. Jake Williams, a former NSA hacker, points to aggregation: individual pieces of unclassified information can become sensitive when combined.

Another scenario: programs are often tested on NIPRNet before they run on SIPRNet (secret) or JWICS (top secret). Those networks are "air gapped," meaning separated from the internet. With stolen credentials, an attacker could slip malicious code into a tool that then makes its way unnoticed into an isolated network. Williams considers a distributed denial-of-service (DDoS) attack from the inside the most likely outcome. Automated code scanning (SAST) would probably not flag a deliberately planted backdoor as a vulnerability. There is no indication that hackers broke into classified systems.

Contracts and context

Accenture holds more than $3.5 billion in federal contracts, about $605 million of them with the DOD. In the same month, the FBI found that an Accenture contractor had failed to close a security hole, which let the group ShinyHunters obtain data on thousands of FBI employees. The contractor was removed in early October.

Matt Triner (Hunter Strategy) says companies are often punished for reporting and can lose contracts, even though reporting is the right thing to do and legally required. He adds that the pressure to deliver faster and cheaper conflicts with security. Williams also warns about vibe coding: with agents, you know neither the supply chain nor the origin of the code, and the amount of generated code is hard to review. Wired recalls ProPublica's reporting on Microsoft's "digital escorts," in which US employees supervised code from China.

Our take

The report relies on anonymous sources; the DOD is silent and Accenture denies the allegations. Much of it is not independently confirmed. If it is true, the case shows a classic problem: an agent with broad permissions and internet access is a data exfiltration risk, especially with personal accounts outside government control. As described, the fault lay less with the model than with how permissions were granted and a lack of oversight. It remains unclear whether the data was misused and how the investigation was conducted.