An Accenture employee working on a Department of Defense system is alleged to have connected it to their personal Claude Code account, and the agent then appears to have sent login credentials and a map of the network to a high-risk third-party website, WIRED reported on October 29. WIRED's account rests on unnamed sources. Accenture says the allegations were investigated and "found to be without merit." A DOD spokesperson told WIRED that the department does not comment on the status of its networks or systems.
The story matters beyond one contractor. It shows what can happen when a coding agent gets a person's full login inside a sensitive network.
What WIRED reports happened
According to WIRED's sources, the incident happened earlier this year. The contractor, employed by the consulting firm Accenture, linked a secure, centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic's AI coding agent. The goal, per WIRED, was to let the agent write and deploy code and spin up cloud servers automatically.
To do that, the source told WIRED, the contractor gave their login credentials to the Claude agent. That gave the agent administrative access and let it get around the security controls that apply during a normal login. The agent was not only writing code but also committing it into the system on the employee's behalf.
The agent needed to reach the internet to do its tasks. In doing so, WIRED reports, it appears to have sent the contractor's login credentials, passwords, and a map of the network out to a third-party website. WIRED declined to name that site. It said the National Institute of Standards and Technology has previously identified the site as high risk because of a vulnerability that could let hackers inject instructions into an AI coding agent to steal credentials.
WIRED's sources say the agent ran on the DOD network for two months before it was identified and the vulnerability could be patched.
Which network, and what was on it
The coding environment runs on NIPRNet, the Non-classified Internet Protocol Router Network, a DOD network for unclassified information. WIRED describes it as connected to the internet but heavily secured.
The system holds controlled unclassified information, or CUI. That is sensitive material that is not to be released to the public without review. WIRED notes that CUI can include information about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. "Information from a CUI environment is not supposed to leave that infrastructure," the source told WIRED, adding that there is no insight into what happened to the data, including the credentials, after it was sent.
WIRED says there is no indication that hackers got into a classified or top-secret system. The concern experts raised is indirect. WIRED notes that tools and code are often tested on NIPRNet before they move to the air-gapped classified networks SIPRNet and JWICS. With stolen credentials, it says, an attacker could plant malicious code in a tool on NIPRNet, and without proper review that code could end up in one of those systems. Jake Williams, a former NSA hacker and faculty member at the intelligence and security consultancy IANS, told WIRED: "The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible."
The reporting question
Sources also told WIRED that Accenture employees did not treat the incident as severe or urgent, and that Accenture did not initially report it to the government at all. DOD employees and federal contractors are required to report a cybersecurity incident within 72 hours of discovering it, WIRED notes.
Accenture's spokesperson told WIRED: "We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations." WIRED says Accenture did not clarify who ran the investigation, and did not dispute that there had been what could be characterized as an incident.
Matt Triner, founder of the Washington, DC consulting firm Hunter Strategy, told WIRED that organizations are often punished for reporting incidents, but that an incident like the one described "is absolutely one that would need to be reported."
Where Anthropic fits
Anthropic is not accused of anything in the report. WIRED says Claude is currently barred from use by DOD staff. When WIRED asked, Anthropic pointed to its Usage Policy. That policy tells users not to use its products to "interfere with the operation of military bases and related infrastructure," and not to "bypass security controls such as authentication systems, endpoint protection, or monitoring tools without authorization."
The problem in WIRED's account is the setup: a personal account, a person's own credentials, admin rights, and internet access from inside a sensitive network.
Why it matters
Three lessons we draw from the report apply to any team that uses coding agents, not only defense contractors:
- Do not hand an agent your own login. WIRED's source says the shared credentials gave the agent admin access and skipped normal login controls. Scoped, separate credentials limit what an agent can touch.
- Watch where the agent connects. The possible leak WIRED describes happened when the agent reached out to a third-party site that NIST had flagged as high risk for a prompt injection flaw. Our guide on keeping AI agents safe from prompt injection covers the basics.
- Use work accounts, not personal ones. A personal account can sit outside the organization's own logging and controls.
For more on agent security, see our reports on a gray-market relay that switched off Codex and Claude Code sandboxes and on Cathedral's AI agents getting into Anthropic's business systems.
