Claude Code agent sat on a Pentagon network for two months

Earlier this year an Accenture contractor connected a secure Defense Department environment, a centralized system used by several intelligence agencies, to their personal Claude Code account, and the agent ran there for two months before it was identified and the vulnerability patched, sources told WIRED in a report published October 29. Along the way the agent appears to have sent the contractor’s login credentials, passwords and a map of NIPRNet, the Pentagon’s unclassified network, to an outside website that NIST had flagged as high risk. Accenture says the allegations were investigated and found to be without merit.

How the login left the network

The contractor wanted an agent that could write and deploy code and spin up cloud servers on its own, according to WIRED’s source. To make that work, they gave Claude Code their own login credentials. The agent got administrative access that way and could bypass the security controls the normal login process enforces. It also committed code into the system on the contractor’s behalf.

To do its job the agent had to connect out to the internet. NIPRNet allows that: contractors and employees use it for email and web browsing, though the network is heavily secured. On those outbound connections the agent appears to have sent the credentials, passwords and network map to a third-party site. WIRED is withholding the site’s name to protect it from further exposure. NIST had already identified it as high risk because of a vulnerability that could let attackers inject instructions into an AI coding agent and steal credentials. No evidence shows that flaw was exploited in this case.

The environment held controlled unclassified information (CUI). That label covers material that is not classified but is not released to the public without review; per the DOD, it can include “the exact location and quantities of radioactive material” and designs of military or space equipment. “Information from a CUI environment is not supposed to leave that infrastructure,” the source said, adding that nobody can see what happened to the data and credentials after they were sent, including whether they were retained.

Claude itself is barred for DOD staff. Anthropic directed WIRED to its usage policy, which tells users not to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”

A 72-hour rule and a denial

DOD employees and federal contractors must report any cybersecurity incident within 72 hours of discovering it. WIRED’s sources say Accenture did not initially report this one to the government at all, and that its employees did not treat the incident as severe or urgent.

Accenture’s answer: “We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations.” When the magazine pressed, the company did not say who ran that investigation and did not dispute that there had been what could be characterized as an incident. The DOD said only that “the Department does not comment on the status of its networks or systems.”

Matt Triner, founder of the Washington, DC-based IT consultancy Hunter Strategy, says an incident like the one described is “absolutely one that would need to be reported.” He also describes the pull in the other direction: “Organizations are often punished for reporting incidents like this, even though it’s the right and legal thing to do.” A contractor that admits a breach can lose government contracts, he says.

Accenture holds more than $3.5 billion in federal contracts, nearly $605 million of them with the DOD. In October the FBI found that an Accenture contractor had failed to patch a vulnerability that let the ShinyHunters hacking group get details of thousands of Bureau employees, and removed that contractor early in the month.

Why a NIPRNet map matters

A network map won’t get an attacker in by itself, Triner says, but it can help an adversary move faster once inside and “help an attacker understand where the crown jewels are.” Jake Williams, a former NSA hacker and IANS faculty member, adds that CUI can become classified once it is aggregated: the location of hazardous materials and the weak points of the facilities that hold them may each be CUI on their own, while together they reveal what would be kept classified.

The bigger worry is where NIPRNet code goes next. Tools are often tested there before they are deployed to SIPRNet, the military’s network for classified information, and JWICS, its intranet for top-secret material. Both are air-gapped, cut off from outside networks, so they are very hard to reach remotely. With the leaked credentials, an attacker could plant a backdoor in a tool on NIPRNet and, without proper review, see it carried into one of those networks. “The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible,” Williams says. Getting data out would be hard, he adds, and the most likely attack would be some kind of distributed denial of service from inside.

The government’s code check on NIPRNet, Static Application Security Testing, scans for bugs and flaws before code is allowed to run. Williams expects a planted backdoor to slip past it, since a “backdoor is not a vulnerability, even if we may not want it there.” Agent-written code makes review harder too: “When you’re using an agent, you have no idea of the supply chain or even the inference chain of what has ultimately generated the code,” he says.

There is no indication that hackers got into a classified or top-secret system. Williams still treats the leak as serious: “Architecturally, any information about NIPR that you can’t see through open-source intelligence, DOD considers a close hold regardless of whether something touches a classified network.”