Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

An Accenture employee reportedly linked a personal Claude Code account to a secure Department of Defense production environment, granting the AI coding agent administrative access and potentially exposing credentials and sensitive network information to an external service.

According to WIRED’s investigation, published October 29, the agent operated on the Pentagon network for approximately two months before discovery and remediation. Accenture disputed the allegations, saying an independent investigation found them “without merit” and that it complied with legal and contractual obligations.

Personal AI Agent Allegedly Bypassed Login Controls

The affected development environment operated on the Non-classified Internet Protocol Router Network (NIPRNet), which supports unclassified defense communications. The system contained controlled unclassified information (CUI), sensitive material that requires protection even though it is not classified.

Sources told WIRED that a contractor provided login credentials that let Claude Code automate software development, commit code, and provision cloud servers. This access allegedly let the agent bypass controls normally enforced during authentication.

While communicating with external services, the agent reportedly transmitted credentials, passwords, and a map of NIPRNet to an unnamed third-party website. WIRED chose not to disclose the destination’s identity to prevent further exposure.

The publication noted that the National Institute of Standards and Technology (NIST) had previously identified the service as high risk because a vulnerability could let attackers inject instructions into coding agents and steal credentials. However, the report does not confirm whether attackers actually exploited this vulnerability during the incident.

This alleged incident highlights how privilege can amplify the risks of agentic AI: an assistant that can read secrets, modify code, and contact external services can breach multiple security boundaries without relying on conventional malware infections.

Related research into Claude Code GitHub Actions credential exposure demonstrated how untrusted content could steer agents toward sensitive environment variables. That separate finding illustrates a comparable trust-boundary problem, not evidence of the Pentagon incident’s cause.

Similarly, GhostJacking attacks against AI agents showed how malicious instructions embedded in operational data could trigger unauthorized actions using legitimate permissions. Such activity can resemble approved automation rather than an obvious intrusion.

Security experts interviewed by WIRED warned that exposed credentials could enable code tampering inside NIPRNet. Software subsequently transferred into classified environments could potentially carry malicious functionality, although no classified-system compromise was reported.

WIRED’s sources alleged that Accenture did not initially report the incident to the government despite applicable reporting obligations. Accenture maintained that it fulfilled its obligations, while the Pentagon declined to discuss its systems.

Unresolved questions include whether it retained the transmitted information, who could access it, and whether credentials were abused. The report identifies exposure concerns, but does not establish confirmed exploitation, adversary access, or compromise of classified networks.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.