US Media Exposes Pentagon Security Incident: Banned Claude Agent Ran on US Military Network for Two Months

Accenture denies that the allegations are valid. A company spokesperson said the claims had undergone a thorough, independent investigation and were found to be unfounded, and that the company fully complied with its legal and contractual obligations. Wired reported that Accenture did not further specify who conducted the investigation. A U.S. Department of Defense spokesperson said it does not comment on the status of its networks or systems.

According to reports, the employee in question accessed a centralized system used by multiple intelligence agencies, which contains "Controlled Unclassified Information," or CUI. Although such information is not classified, it is still sensitive material that requires protection and may not be released to the public without review.

People familiar with the matter said that in order to have AI automatically write code and launch cloud servers, the employee handed over their login credentials to the Claude agent. This gave the agent administrator access and enabled it to bypass the security controls in the normal login process. It would also submit code on the employee's behalf and save the code into the system.

The problem arose during the process of the agent connecting to external tools. According to Wired, it appeared to have sent the employee's login credentials, passwords and information about the U.S. military network structure to a third-party website. To avoid further increasing the risk to the system, Wired did not disclose the name of the website. The report noted that the U.S. National Institute of Standards and Technology had previously flagged it as high-risk because a vulnerability could allow attackers to inject instructions into AI coding agents and thereby steal credentials.

A source familiar with the incident said it is currently unclear how the information was handled after being sent out, or whether it is still retained by the third-party service. If the relevant service were compromised, attackers could use these credentials to enter the secure environment without being detected.

The programming environment involved runs on the U.S. Department of Defense's unclassified Internet Protocol Router Network, NIPRNet. The network is used to handle unclassified information and can connect to the internet; employees and contractors can use it to send and receive email and use browsers, but it is still subject to strict security protection.

The report found no evidence that hackers had entered the U.S. military's classified or top-secret systems. However, security experts interviewed believe that the leakage of accounts, code and system structure information in an unclassified environment could still threaten more sensitive systems.

Jack Williams, a former U.S. National Security Agency hacker and instructor at the cybersecurity consulting firm IANS, explained that information that is controlled unclassified information when viewed separately may, when aggregated, form content that should be classified. For example, the locations of hazardous materials and the weak points of storage facilities may each be unclassified information, but combined they could expose more sensitive information.

The flow of code is another path that worries experts. The report noted that some tools and code are first tested in NIPRNet and then deployed to isolated networks used to handle classified or top-secret information. If attackers use leaked credentials to enter the test environment, they could plant backdoors in the code; if reviews fail to detect them, the malicious code could enter more sensitive systems along with the tools. This is a potential risk raised by experts, and the report did not confirm that such a situation has occurred.

Williams said that static application security testing used by the government can check for code vulnerabilities, but deliberately planted backdoors may not necessarily be identified as vulnerabilities, and logic problems in the code generation process may also escape detection. AI generates code far faster than humans, further increasing the pressure on review.

The process by which the incident was discovered and reported has also been questioned. People familiar with the matter told Wired that despite the security risk, Accenture employees initially did not treat the matter as serious or urgent, and the company initially did not report it to the government. The relevant statements differ from Accenture's response regarding the investigation results and contract performance.

Matt Triner, founder of the Washington IT consulting firm Hunter Strategy, believes that government contractors face conflicting requirements. On the one hand, projects need to be delivered faster and at lower cost; on the other hand, companies that acknowledge security incidents may risk losing contracts. He said the incident described in the report is the kind of situation that needs to be reported.

According to Wired, Accenture currently holds more than $3.5 billion in U.S. federal government contracts, of which nearly $605 million comes from the Department of Defense. The report also noted that Claude is currently prohibited for use by Department of Defense personnel. In response to Wired, Anthropic cited its usage policy, which prohibits unauthorized bypassing of security controls such as identity verification, endpoint protection or monitoring.