US media reports Accenture employee connected personal Claude Code to Pentagon systems; agent ran for two months before being discovered

2026-10-30 13:32 Phoenix Tech - Yu Lei

English text is being prepared.

Beijing time October 30, according to a report by the U.S. magazine Wired, a contractor employee at Accenture is alleged to have connected a personal Claude Code account to a U.S. Department of Defense security system, letting an AI agent write and deploy code on their behalf. People familiar with the matter said the agent ran on the Department of Defense network for two months before being discovered, during which it is suspected of sending login credentials, passwords and network structure information to a third-party website with security risks.

Accenture denies the allegations. A company spokesperson said the claims had undergone a thorough, independent investigation and were found to be unfounded, and that the company fully complied with its legal and contractual obligations. Wired said Accenture did not further specify who conducted the investigation. A U.S. Department of Defense spokesperson said they do not comment on the status of its networks or systems.

According to the report, the employee connected to a centralized system used by multiple intelligence agencies, which holds "Controlled Unclassified Information," or CUI. Although such information is not classified, it is still sensitive material that requires protection and may not be released to the public without review.

People familiar with the matter said that in order to have the AI automatically write code and launch cloud servers, the employee handed over their login credentials to the Claude agent. This gave the agent administrator access and enabled it to bypass security controls in the normal login process. It would also submit code on the employee's behalf and save the code into the system.

The problem arose when the agent connected to external tools. According to Wired, it appears to have sent the employee's login credentials, passwords and information about U.S. military network structure to a third-party website. To avoid further increasing system risk, Wired did not disclose the name of the website. The report noted that the U.S. National Institute of Standards and Technology had previously flagged it as high risk because a vulnerability could allow attackers to inject instructions into AI coding agents and thereby steal credentials.

A source familiar with the incident said it is currently unclear how the information was handled after being sent out, or whether it is still retained by the third-party service. If the relevant service were compromised, attackers could use the credentials to enter the secure environment without being detected.

The coding environment involved ran on the U.S. Department of Defense's unclassified Internet Protocol Router Network, NIPRNet. The network is used to handle unclassified information and can connect to the internet; employees and contractors can use it to send and receive email and use browsers, but it is still subject to strict security protection.

The report found no evidence that hackers had entered the U.S. military's classified or top-secret systems. However, security experts interviewed believe that the leakage of accounts, code and system structure information in an unclassified environment could still threaten more sensitive systems.

Jack Williams, a former U.S. National Security Agency hacker and instructor at the cybersecurity consulting firm IANS, explained that information that is Controlled Unclassified Information when viewed individually may, when aggregated, form content that should be classified. For example, the location of hazardous materials and the weak points of storage facilities may each be unclassified information, but combined they could expose more sensitive information.

Code flow is another path that experts worry about. The report noted that some tools and code are first tested in NIPRNet and then deployed to isolated networks used to handle classified or top-secret information. If attackers use leaked credentials to enter the test environment, they could plant backdoors in the code; if reviews fail to detect them, malicious code could enter more sensitive systems along with the tools. This is a potential risk raised by experts, and the report did not confirm that such a situation has occurred.

Williams said that static application security testing used by the government can check for code vulnerabilities, but deliberately planted backdoors may not necessarily be identified as vulnerabilities, and logic problems in the code generation process may also escape detection. AI generates code far faster than humans, further increasing review pressure.

The process by which the incident was discovered and reported has also been questioned. People familiar with the matter told Wired that despite the security risk, Accenture employees initially did not treat the matter as serious or urgent, and the company initially did not report it to the government. The claims differ from Accenture's response regarding the investigation results and contract performance.

Matt Tyner, founder of the Washington IT consulting firm Hunter Strategy, believes government contractors face conflicting requirements. On the one hand, projects need faster delivery and lower costs; on the other hand, companies that acknowledge security incidents may risk losing contracts. He said the incident described in the report is the kind of situation that needs to be reported.

According to Wired, Accenture currently holds more than $3.5 billion in U.S. federal government contracts, of which nearly $605 million comes from the Department of Defense. The report also noted that Claude is currently prohibited for use by Department of Defense personnel. In response to Wired, Anthropic cited its usage policy, which prohibits unauthorized bypassing of security controls such as identity verification, endpoint protection or monitoring.