Pentagon AI agent leaked network credentials for two months
- An Accenture contractor connected a DOD network holding controlled unclassified information to a personal Claude Code account earlier this year.
- The agent reportedly sent login credentials, passwords and a network map to a website NIST had flagged as high risk, and ran for about two months before being patched.
- Federal rules require contractors to report such incidents within 72 hours, and sources said Accenture did not initially report it, while Accenture disputes the allegations.
- Accenture holds more than $3.5 billion in federal contracts, including roughly $605 million with the DOD.
A US Department of Defense network carrying controlled unclassified information was connected earlier this year to a personal account for Claude Code, Anthropic’s AI coding agent. Wired’s report on the Accenture contractor incident states that the agent was issued a contractor’s login credentials so it could automate coding work on NIPRNet, and that it appears to have sent those credentials, passwords and a map of the network to a third-party website. The National Institute of Standards and Technology had already flagged that site as high risk, because of a vulnerability that let instructions be injected into AI coding tools.
On the accounts given to Wired, the agent ran on the DOD network for about two months before anyone identified and patched the exposure. Federal rules require contractors to report such incidents within 72 hours. Sources told Wired that Accenture did not report this one at first. Accenture says the allegations were independently investigated and found to be without merit, and that it complied with its legal and contractual obligations. It has not identified the investigator, nor disputed that an incident occurred. The Department of Defense declined to comment. Claude is barred from use by DOD staff, which leaves the case sitting in the gap between a prohibited tool and a contractor’s own account.
For universities and research groups running coding agents against institutional systems, the mechanics are familiar and unforgiving. An agent given an account inherits everything that account can reach. Its record of a session may not separate the task it was set from an instruction it encountered in passing. Verifiable use rests on narrow permissions, on retained transcripts, and on a named person answerable for what the tool does on a network. Assessment regimes that ask students to declare AI assistance assume a record exists that can be checked. An agent’s logs are not automatically that record.
Matt Triner of Hunter Strategy, quoted by Wired, describes contractor incentives that discourage prompt reporting and favour speed over security, a problem he says predates AI and has been sharpened by it. Accenture holds more than $3.5 billion in federal contracts, including roughly $605 million with the DOD. What remains unevidenced is whether the 72-hour reporting duty was met in practice, who conducted the review Accenture cites, and whether contract oversight will test these controls rather than accept an assurance that they exist.