Wired: Accenture Contractor's Personal Claude Agent Ran on Pentagon Network for Two Months, Sources Say

A contractor's personal AI coding agent sat inside a Pentagon system for roughly two months before anyone caught it. That is the account Wired published Oct. 29, based on anonymous sources familiar with the incident.

None of it has been confirmed on the record. Accenture disputes it. The Department of Defense won't discuss it.

What the sources describe

According to Wired's sources, an Accenture employee wanted to automate writing code and spinning up cloud servers inside a secure production environment. To do that, the employee allegedly handed personal login credentials to a Claude Code agent, Anthropic's AI coding tool.

That gave the agent administrative access and let it bypass the security controls tied to a normal login. The agent wasn't just suggesting code. It was writing and committing code to the system on the employee's behalf.

The system runs on NIPRNet, the Pentagon's unclassified network. It is used by multiple intelligence agencies and holds Controlled Unclassified Information, or CUI. That category is not classified, but it can cover critical infrastructure, military equipment designs, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism.

When the agent needed internet access, it "appears to have sent" the employee's credentials, passwords, and a map of NIPRNet to a third-party website, per the sources. Wired didn't name the site. It reported that the National Institute of Standards and Technology has previously flagged it as high risk because of a flaw that could let attackers inject instructions into an AI coding agent and steal credentials.

The agent was eventually identified and the vulnerability patched. How it was caught has not been disclosed.

What the companies and the Pentagon say

Accenture told Wired: "These allegations were thoroughly and independently investigated and found to be without merit." The company added that it complied with its legal and contractual obligations. Pressed, it did not say who ran the investigation, and it did not dispute that an incident took place.

A Pentagon spokesperson said: "the Department does not comment on the status of its networks or systems. We take all concerns seriously."

Anthropic offered no statement on the incident. It pointed Wired to its usage policy, which bars users from bypassing "security controls such as authentication systems, end point protection, or monitoring tools without authorization" and from interfering with the operation of military bases and related infrastructure. Wired also reports that Claude is currently barred for use by Defense Department staff.

No employee has been named. No technical incident report is public.

Why security experts are alarmed

Wired reports no indication that anyone reached a classified or top-secret system. The concern the experts describe is a path, not a confirmed breach.

Tools are often tested on NIPRNet before they move to the air-gapped classified networks. Jake Williams, a former NSA hacker now at IANS, told Wired that malicious code could "operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network." He called an AI agent running code in NIPRNet a "huge problem," with "huge national security impacts."

Matt Triner, founder of the consultancy Hunter Strategy, said a network map could "help an attacker understand where the crown jewels are" once they have access.

One anonymous source told Wired the exposure "puts all the data that's in there at risk," and called the incident "100 percent a national security threat and could cause irreparable harm." The same source warned that if the third-party software behind the agent were compromised, "there could be somebody out there with the ability to log into a secure environment without anyone knowing."

That is one anonymous source's assessment, not an established finding. Accenture rejects the allegations outright.

The contract backdrop

Accenture Federal Services is the integrator the Pentagon picked in July for the Chief Digital and Artificial Intelligence Office's War Data Platform, an $821 million task order covering integration, cybersecurity, and platform-tool work. Nothing reported so far ties the employee in this account to that work. Which Accenture engagement the person was on has not been disclosed.

The rules on incident reporting are not a mystery. Under DFARS clause 252.204-7012, defense contractors must report a cyber incident to the government within 72 hours of discovering it. Accenture says it met its obligations. The Pentagon hasn't said what it was told or when.

What's still open

The basic mechanics are not exotic. A coding agent inherits the permissions of whoever launches it, runs for hours unsupervised, and needs the internet to function. Hand it a privileged log-in on a government network and the guardrails are only as good as the person who decided to do that.

Taxpayers fund these contracts, and they are entitled to know whether a contractor's personal AI account ever sat on a federal system. The Pentagon has said only that it takes concerns seriously. Accenture has said only that the allegations were investigated and found to be without merit.

What remains unanswered is the part the sources flagged themselves: "There is no insight about what happened to the information, including the login credentials, after it was sent."