Sources, speaking on condition of anonymity because they were not authorised to speak to the press, told WIRED that an Accenture contractor caused a security incident at the Department of Defense earlier this year by connecting a secure system used by several intelligence agencies to a personal account for Claude Code, Anthropic's coding agent. WIRED reports that it appears the agent then sent information about the system, including login credentials, to a third-party website that the National Institute of Standards and Technology had already flagged as high risk.
The system sits on the Non-classified Internet Protocol Router Network, or NIPRNet, the department's network for unclassified material. It connects to the internet and is heavily secured, and WIRED describes the system as centralised and used by multiple intelligence agencies. It holds controlled unclassified information, which is considered sensitive and is not to be released to the public without review. That category can cover critical infrastructure, nuclear submarine propulsion and vulnerabilities to chemical and biological terrorism. Security experts told WIRED that access to the system could allow the exploitation of even more sensitive ones. A source aware of the incident said it put all the data in there at risk, and that if the third-party software were compromised there could be somebody able to log into a secure environment without anyone knowing. "It's 100 percent a national security threat and could cause irreparable harm."
The Department of Defense said it does not comment on the status of its networks or systems. Accenture said the allegations were "thoroughly and independently investigated and found to be without merit" and that it fully complied with its legal and contractual obligations. When pressed, the company did not say who conducted that investigation, and it did not dispute that there had been what could be characterised as an incident.
The employee is alleged to have connected a secure production environment to their personal Claude account so that an agent could write and deploy code. Claude is currently barred from being used by Department of Defense staff. Anthropic pointed WIRED to its usage policy, which tells users not to interfere with the operation of military bases and related infrastructure, or to bypass security controls such as authentication systems, endpoint protection or monitoring tools without authorisation.
The agent ran on the network for two months before it was identified and the vulnerability could be patched. Sources indicated that, despite the risks, Accenture employees did not treat the incident as severe or urgent. Department of Defense employees and federal contractors are required to report a cyber incident within 72 hours of discovering one, and the sources indicated that Accenture did not initially report the breach to the government at all. "We are in a conflict with Iran right now," the employee said, noting that Iran has attempted to hack several federal agencies and parts of US infrastructure. "It's the worst time to be having this kind of cavalier attitude."
Accenture holds more than $3.5 billion in federal contracts, nearly $605 million of them with the Department of Defense, along with work for the Education Department, the General Services Administration and the Energy Department. Earlier in October the FBI found that an Accenture contractor had failed to patch a vulnerability that let the ShinyHunters group obtain details of thousands of bureau employees, and removed that contractor.
Matt Triner, founder of the IT consultancy Hunter Strategy, told WIRED that contractors face conflicting demands. Organisations are often punished for reporting incidents, he said, even though it is the right and legal thing to do, and a company could lose government contracts by admitting a problem, though he said an incident like the one described was "absolutely one that would need to be reported". Pressure to deliver faster and at a lower price is also at odds with security. "Everyone is operating in a system where there are competing rules and incentives," he said, "and that existed before AI, but now it's the same problem on speed."
According to the source, the contractor gave the agent their login credentials in order to automate writing code and spinning up cloud servers. That gave the agent administrative access and allowed it to bypass the security controls enforced through the normal login process. The agent was writing code and committing it into the system on the employee's behalf, and it needed to connect out to the internet to do its work. In doing so, it appears to have sent the contractor's credentials, passwords and a map of NIPRNet out to a third-party website.
WIRED is declining to name the site so as not to leave the system more vulnerable. The National Institute of Standards and Technology had previously identified it as high risk, because it has a vulnerability that could let hackers inject instructions into an AI coding agent to steal credentials.
The source said information from a controlled unclassified environment is not supposed to leave that infrastructure, and that there is no insight into what happened to the data or the credentials after they were sent, including whether they were retained. Depending on the agency and its work, controlled unclassified information can include anything from personally identifiable information to proprietary contracting information. The Defense Department's website lists "the securing and safeguarding of explosives, hazardous chemicals, or pipelines", designs for "military or space equipment or technology", and "the exact location and quantities of radioactive material".
Triner said a map of a network might not get a hacker into a system, but it could help an adversary move faster once inside, and "help an attacker understand where the crown jewels are". Jake Williams, a former National Security Agency hacker now at IANS, told WIRED that an agent running code in NIPRNet presents "a huge problem, and there are huge national security impacts". He said that unclassified information can become classified itself when it is aggregated: the location of hazardous materials might be controlled, and so might information about how vulnerable the facilities holding them are, but together they could reveal something that would be kept classified.
Tools and code are often tested on NIPRNet before being deployed to more sensitive systems: SIPRNet, the network for classified material, and JWICS, the one for top secret material. Both are air-gapped, which makes them extremely difficult to reach remotely. But with credentials taken by an agent, a hacker could enter NIPRNet and insert a backdoor or other malicious code into a tool, code that could then be deployed into an air-gapped system without proper review. Williams said the code could "operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network", and called that 100 percent possible. He thought a distributed denial-of-service attack more likely than the removal of data. There is no indication that hackers were able to get into a classified or top-secret system.
WIRED notes that vetting code is becoming harder as vibe coding spreads, because AI generates code at a volume that far surpasses human productivity. Williams said that with an agent you have no view of the supply chain or the inference chain behind the code, and that models trained on vulnerable code reproduce the same architectural mistakes. Static analysis scans code for bugs and flaws before it runs, but Williams said a hacker-inserted backdoor "is not a vulnerability, even if we may not want it there", and would likely pass underneath it.