A contractor working for Accenture connected a secure Department of Defense network to their personal account for Claude Code, an AI coding tool from Anthropic. The agent subsequently sent login credentials and system details to a high-risk website.
The network in question hosts controlled unclassified information (CUI). This data covers critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Experts warn that access to this system could allow attackers to compromise even more sensitive environments.
One source, who asked not to be named because they were not authorised to speak to the press, said the incident puts all data at risk. If the third-party software was compromised, an attacker could log into a secure environment without anyone knowing. This is a national security threat that could cause irreparable harm.
A Department of Defense spokesperson told WIRED that the Department does not comment on the status of its networks or systems. An Accenture spokesperson stated that the allegations were thoroughly and independently investigated and found to be without merit. They claimed full compliance with legal and contractual obligations. When asked who conducted the investigation or if they disputed the characterisation of an incident, Accenture offered no clarification.
The Accenture employee is alleged to have connected a secure production environment to their personal Claude account to allow an AI agent to write and deploy code. Claude is currently barred from use by DOD staff. Anthropic’s usage policy instructs users not to use its products to interfere with the operation of military bases or bypass security controls such as authentication systems, endpoint protection, or monitoring tools without authorisation.
The AI agent ran on the DOD network for two months before identification and patching. Sources indicate that despite the security risks, Accenture employees did not treat the incident as severe or urgent. Federal contractors are required to report any cybersecurity incident within 72 hours of discovery, but sources say Accenture did not initially report the breach to the government.
The employee noted that the United States is in a conflict with Iran, which has attempted to hack several federal agencies and parts of US infrastructure. The employee described the incident as having a cavalier attitude at the worst possible time.
Accenture currently holds more than $3.5 billion in contracts with the federal government. Nearly $605 million of this is with the Department of Defense. The company also contracts with other agencies, including the Department of Education, the General Services Administration, and the Department of Energy. Earlier this month, the Federal Bureau of Investigation found that an Accenture contractor failed to patch a vulnerability that allowed the hacking group ShinyHunters to access details of thousands of Bureau employees. The FBI removed that contractor in early October.
Matt Triner, founder of Hunter Strategy, a Washington, DC-based IT consulting company, says the issue exemplifies conflicting demands government contractors face. He notes that organisations are often punished for reporting incidents, even though it is the right and legal thing to do. In many cases, a company could lose government contracts by admitting a security breach. Triner says an incident like this is absolutely one that would need to be reported.
Triner also notes that increasing pressure to deliver projects faster and at lower prices is at odds with prioritising safety and security. He says everyone operates in a system with competing rules and incentives, a problem that existed before AI but now manifests on speed.
The coding environment accessed by the contractor runs on the Non-classified Internet Protocol Router Network (NIPRNet). This is a DOD network used for unclassified information. While it connects to the internet allowing access to emails and web browsers, it is heavily secured.
To automate writing code and spinning up cloud servers, the contractor gave their login credentials to the Claude agent. This granted the agent administrative access and allowed it to bypass security controls enforced through the normal login process. The AI agent, which wrote and saved code on behalf of the employee, needed to connect out to the internet to perform its tasks. In doing so, it appears to have sent the contractor’s login credentials, passwords, and a map of NIPRNet to a third-party website.
WIRED is declining to name the third-party website to protect the system from further vulnerability. The National Institute of Standards and Technology (NIST) has previously identified it as high risk because it has a vulnerability that could let hackers inject instructions into an AI coding agent to steal credentials.
The system the AI agent accessed contained CUI. Information from a CUI environment is not supposed to leave that infrastructure. There is no insight into what happened to the information, including the login credentials, after it was sent to the service, or whether it has been retained.
Depending on the agency and its work, CUI can include anything from personally identifiable information (PII) to proprietary business or contracting information. According to the DOD’s website, CUI can include information on the securing and safeguarding of explosives, hazardous chemicals, or pipelines. It also includes documentation related to the designs of military or space equipment or technology, and the exact location and quantities of radioactive material.
Distinct from the actual data, a map of it could be incredibly valuable to a hacker. Once an attacker understands how things fit together, even if the things themselves are public information, what is sensitive is how they are put together and turned into actionable intelligence. Triner says this is what matters.
While a map might not get a hacker into a system, it could help an adversary move faster once they have access. It helps an attacker understand where the crown jewels are.
Jake Williams, a former NSA hacker and faculty at IANS, an intelligence and security consultancy, says an AI agent running code in NIPRNet presents a huge problem with huge national security impacts.
Williams notes that while individual pieces of data or information might be considered CUI, when that unclassified information is aggregated, it can become classified itself. For instance, the location of certain hazardous materials might be CUI, as might information about the vulnerability of the facilities that house them. Combined, however, they could reveal information that would be kept classified.
This is not the only way classified information may have been put at risk. Frequently, tools and code are tested in NIPRNet before being deployed into more sensitive systems like the Secret Internet Protocol Router Network (SIPRNet) and the Joint Worldwide Intelligence Communications System (JWICS). Both SIPRNet and JWICS are air gapped, a security measure meaning they are not connected to any outside networks. On a practical level, that means SIPRNet and JWICS would be extremely difficult for a hacker to access remotely.
But with the login credentials exfiltrated by an AI agent, a hacker could access NIPRNet and insert a backdoor or other malicious code into a tool or system. Without proper review, this code could end up deployed in one of the air gapped systems.
The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, which is 100 percent possible. Exfiltrating data out of these networks would be difficult, but malicious code could be used to attack the systems from the inside. Williams says the most likely thing would be some kind of distributed denial of service attack.
Triner says that even something more subtle, such as slowing down intelligence operations and activities, could cause damage and make users lose trust in a tool, even once the problem is fixed.
As vibe coding, or prompting an AI assistant to write the code for a product described by an engineer, becomes more common, vetting code is becoming more of a challenge. AI is capable of generating code at a volume that far surpasses human productivity, making it time consuming and difficult to vet.
When you are using an agent, you have no idea of the supply chain or even the inference chain of what has ultimately generated the code. A lot of the code that these LLMs were trained on is itself vulnerable, and they can regurgitate the same kinds of architecture and architectural issues seen in other code. Williams says this is a significant concern.
The government does have a way to identify flawed code in NIPRNet. Static Application Security Testing (SAST) scans code for bugs and flaws before allowing it to run. But Williams notes that a hacker-inserted backdoor is not a vulnerability, even if it is unwanted, and therefore would likely fly under the radar of SAST’s detection. SAST also does not usually identify structural issues in the logic chain of how code is created.
There is no indication that hackers were able to get into a classified or top secret system. Still, Williams says the incident should raise significant alarms. Architecturally, any information about NIPR that you cannot see through open source intelligence, the DOD considers a close hold regardless of whether something touches a classified network.
This is not the first time the DOD has been made vulnerable because of AI-related issues. Last year, ProPublica revealed that Microsoft was using digital escorts on its projects with the federal government. American employees with security clearances would oversee code written by outsourced workers in China. Experts who spoke to ProPublica said the program presented a particular security risk because the American employees were often not able to vet the code themselves, leaving openings for malicious code to be inserted unknowingly into government systems.
What it means
The incident highlights the difficulty of securing networks when AI agents are given administrative access and the ability to connect to the internet. Standard security scans may miss malicious code inserted by an attacker if that code functions normally within the unclassified network. The risk extends beyond data theft to potential compromise of air-gapped classified systems through code deployment.
