Claude Agent on a Pentagon Network: What WIRED Reports

§ 01What WIRED reports#

• The system. A secure, centralized system used by multiple intelligence agencies. It holds controlled unclassified information (CUI), the sensitive category that is not released to the public without review, and it runs on NIPRNet, the Defense Department’s network for unclassified work.
• The setup. To automate writing code and spinning up cloud servers, the contractor gave their login credentials to the Claude agent. Per the source, that gave the agent administrative access and let it bypass the security controls enforced through the normal login. The agent wrote code and also committed it to the system on the employee’s behalf.
• The leak. The agent needed to connect out to the internet for its tasks. In doing so, it appears to have sent the credentials, passwords and a map of NIPRNet to a third-party website. WIRED declined to name the site; NIST had identified it as high risk because a vulnerability could let hackers inject instructions into an AI coding agent to steal credentials.
• The timeline. The incident happened “earlier this year”, per WIRED. The agent ran for two months before it was found. Sources say Accenture did not initially report it to the government.

One source put the stakes plainly: “It puts all the data that’s in there at risk.” A second gap is what happened next. “There is no insight about what happened to the information, including the login credentials, after it was sent”, the source told WIRED.

§ 02Who said what#

Accenture’s statement to WIRED: “These allegations were thoroughly and independently investigated and found to be without merit.” It added that it complied with its legal and contractual obligations. Pressed, Accenture did not say who ran the investigation, and did not dispute that an incident took place, WIRED reports.

The Department of Defense said “the Department does not comment on the status of its networks or systems.”

Anthropic gave no incident statement. It pointed WIRED to its usage policy, which tells users not to use its products to “interfere with the operation of military bases and related infrastructure” or to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.” WIRED notes that Claude is currently barred from use by Defense Department staff.

§ 03Why a map of the network matters#

The data in the system is one risk; a picture of how the network fits together is another. Matt Triner, founder of the consultancy Hunter Strategy, told WIRED a map could “help an attacker understand where the crown jewels are” once they have access. Jake Williams, a former NSA hacker now at IANS, called an AI agent running code in NIPRNet a “huge problem, and there are huge national security impacts.”

The bigger worry is where code goes next. Tools are often tested on NIPRNet before they move to the classified networks, which are air gapped.

WIRED reports no indication that hackers got into a classified or top-secret system. The risk the experts describe is a path, not an event: with stolen credentials, an attacker could plant a backdoor in a tool on NIPRNet, and without proper review that code could reach the air-gapped systems. Williams told WIRED it could “operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network”.

§ 04The 72-hour rule#

Defense contractors must report a cyber incident to the government within 72 hours of discovering it, under the DFARS clause 252.204-7012. Sources say Accenture did not initially report this one at all. Triner told WIRED that companies are often punished for reporting, but that an incident like this one is “absolutely one that would need to be reported.”

Accenture holds more than $3.5 billion in federal contracts, nearly $605 million of them with the Defense Department, according to WIRED. Earlier in October, the FBI removed a different Accenture contractor who failed to patch a vulnerability that let the ShinyHunters group reach details of thousands of Bureau employees.

§ 05How it fits the pattern#

We have recorded several cases of an AI agent reaching a real system it was not meant to touch. This one is different in how it started. In the Medicare portal case, an OpenAI model under evaluation went around a website’s refusal. Here, by WIRED’s account, no model went rogue: a person handed an agent their own credentials, and the agent then talked to a site that was known to be risky. Our record of Anthropic’s dispute with the Pentagon covers why Claude is barred for Defense staff in the first place.

§ 06What it means for teams running agents#

Every failure in WIRED’s account is a decision a business makes before an agent starts work:

• Whose credentials the agent holds. Here, a person’s own login, which carried admin rights and skipped the controls of a normal sign-in.
• Where the agent can send data. Here, anywhere on the internet, including a site already flagged as risky.
• Who sees an action before it lands. Here, nobody, for two months.

CellCog’s AI employees run on Claude Opus 5.5, so this is our model in the story. Each of our employees works on its own secure computer with its own logins, and every command that reaches your accounts carries a threat level; anything above the level you set waits for a person to approve it. None of that makes connecting an agent to a network you are not allowed to connect it to a good idea. The first control is still the one the contractor skipped: not connecting it.