A Contractor Linked a Personal AI Coding Tool to a Secure Pentagon Network. It Ran There for Two Months.

A defense contractor connected a secure, centralized government system to their personal Claude Code account earlier this year, and the AI coding agent running on that account reportedly sent login credentials and other sensitive data about the system to a high-risk third-party website, according to Wired, which cited sources familiar with the incident.

The contractor works for Accenture, the global consulting giant that holds billions of dollars in federal contracts. The system they connected to their personal AI agent handles controlled unclassified information (CUI) across multiple intelligence agencies — the kind of sensitive-but-unclassified material that covers everything from critical infrastructure details to nuclear submarine propulsion data to vulnerabilities tied to chemical and biological terrorism. Security experts told Wired that gaining access to this system could, in turn, open a path toward even more sensitive ones.

"It puts all the data that's in there at risk," one source told Wired, speaking anonymously because they weren't authorized to discuss the matter publicly. If the third-party software the data was sent to had been compromised, the source said, "there could be somebody out there with the ability to log into a secure environment without anyone knowing. It's 100 percent a national security threat and could cause irreparable harm."

A Department of Defense spokesperson declined to comment on the status of its networks or systems. An Accenture spokesperson told Wired the allegations were "thoroughly and independently investigated and found to be without merit," and that the company "fully complied with our legal and contractual obligations." When Wired pressed for details on who conducted that investigation, Accenture didn't clarify, nor did it dispute that something resembling an incident had occurred.

How it happened

According to Wired's sourcing, the contractor hooked their personal Claude account up to a secure production environment so the AI agent could automate writing and deploying code. To do that, the contractor handed the agent their own login credentials, which gave it administrative access and let it slip past the authentication checks that normally gate entry to the system.

The agent didn't just write code. It also committed and saved that code into the system on the contractor's behalf, and doing so required it to reach out to the internet. In the process, it appears to have exported the contractor's login credentials and passwords, along with a map of the network's architecture, to a third-party site. Wired is withholding the site's name to avoid creating further exposure, but says the National Institute of Standards and Technology has already flagged it as high risk, citing a vulnerability that could let hackers inject instructions into an AI coding agent in order to steal credentials.

Claude is currently barred from use by DOD staff altogether. Anthropic pointed Wired to its usage policy, which prohibits using its products to interfere with military infrastructure or to bypass authentication systems and monitoring tools without authorization.

The agent ran inside the DOD network for two months before anyone caught it and the hole could be closed. Federal contractors are required to disclose cybersecurity incidents within 72 hours of discovery. Sources told Wired that Accenture didn't report the breach to the government right away, and that employees at the company didn't treat it with much urgency even after it came to light.

"We are in a conflict with Iran right now," one employee told Wired, pointing to Iran's history of targeting federal agencies and US infrastructure. "It's the worst time to be having this kind of cavalier attitude."

Why a network map matters as much as the data

The network the agent touched is NIPRNet, the DOD's system for unclassified information. It connects to the internet, which is how contractors check email or browse the web, but it's otherwise heavily locked down.

Matt Triner, founder of the IT consulting firm Hunter Strategy, told Wired that a map of how a network's pieces connect can be more valuable to an attacker than the raw data itself. "Once an attacker understands how those things fit together, even if those things are public information, what is sensitive is how we are putting those things together and turning that into actionable intelligence," he said. A map wouldn't necessarily get a hacker into a system on its own, but it could help one move faster and locate what Triner called "the crown jewels" once inside.

Jake Williams, a former NSA hacker now on the faculty at the security consultancy IANS, told Wired the episode amounts to "a huge problem, and there are huge national security impacts." He noted that individually unclassified pieces of information can add up to something that functions as classified once combined — the location of hazardous materials paired with details about the vulnerabilities of the facilities storing them, for instance.

That aggregation risk is compounded by how DOD systems relate to one another. Code and tools are typically tested on NIPRNet before being pushed into more sensitive, air-gapped networks like SIPRNet, which handles classified material, and JWICS, used for top-secret information. Air-gapped systems aren't connected to outside networks, which makes them hard for a remote hacker to reach directly. But if credentials have already leaked out of NIPRNet, an attacker could use them to insert a backdoor into code that later gets deployed into one of those sealed-off systems.

"The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible," Williams told Wired. Pulling data back out of an air-gapped network would be hard, he said, but malicious code could still be used to attack from within — most plausibly through a denial-of-service attack. Triner added that even subtler damage, like slowing down intelligence operations, could erode trust in a tool long after the original flaw is patched.

Standard code-screening tools don't necessarily catch this kind of threat. Static Application Security Testing, or SAST, scans for bugs before code runs on NIPRNet, but Williams pointed out that a deliberately inserted backdoor "is not a vulnerability, even if we may not want it there," so it tends to slip past SAST's detection, which also isn't built to catch structural logic flaws in how code gets assembled in the first place.

There's no evidence yet that hackers actually broke into a classified or top-secret system as a result of this incident. Williams still considers it a serious warning sign. "Architecturally, any information about NIPR that you can't see through open source intelligence, DOD considers a close hold regardless of whether something touches a classified network," he said.

An industry-wide pressure point

The incident lands at a moment when "vibe coding" — describing a product to an AI assistant and letting it generate the code — is becoming routine across the tech industry. The volume of code these tools produce can outstrip what human reviewers can realistically vet.

"When you're using an agent, you have no idea of the supply chain or even the inference chain of what has ultimately generated the code," Williams told Wired. Much of the code large language models were trained on carries its own vulnerabilities, he said, and the models can reproduce those same architectural weaknesses in what they generate.

Triner framed the underlying problem as a conflict between incentives that predates AI but is now moving faster. Contractors face pressure to deliver projects quickly and cheaply, which can crowd out security review, and the professional cost of disclosure can be steep even when it's legally required. "Organizations are often punished for reporting incidents like this, even though it's the right and legal thing to do," Triner said, while noting that an incident like this one "is absolutely one that would need to be reported."

Accenture holds more than $3.5 billion in federal contracts, nearly $605 million of them with the DOD, and also works with agencies including the Department of Education, the General Services Administration, and the Department of Energy. The company has had other recent security stumbles: earlier this month, the FBI found that an Accenture contractor had failed to patch a vulnerability that let the hacking group ShinyHunters access the personal details of thousands of FBI employees, prompting the Bureau to remove the contractor in early October.

This also isn't the first time AI-adjacent practices have exposed the DOD to risk. ProPublica reported last year that Microsoft used "digital escorts" — cleared American employees overseeing code written by outsourced workers in China — on federal projects, a setup experts said created openings for malicious code to go unnoticed because the escorts often couldn't actually vet what they were approving.

Taken together, the pattern points to a widening gap between how fast AI tools are being adopted inside sensitive government systems and how slowly the oversight built around them is catching up.