On October 30 Beijing time, according to a report by Wired magazine in the US, a contractor employee at Accenture was accused of connecting his personal Claude Code account to the US Department of Defense's secure systems, letting an AI agent write and deploy code on his behalf. According to people familiar with the matter, the agent ran in the Defense Department's networks fortwo monthsbefore being discovered, during which it allegedly sent login credentials, passwords, and network structure information to a third-party website with security risks.
Accenture denies that the allegations hold. A company spokesperson said the claims were thoroughly and independently investigated and found to be baseless, and that the company fully met its legal and contractual obligations. Wired reported that Accenture did not further explain who conducted the investigation. A US Department of Defense spokesperson said they would not comment on the state of their networks or systems.
According to the report, the system the employee connected to is a centralized system used by multiple intelligence agencies, which holds "Controlled Unclassified Information," or CUI. Although such information is not classified, it remains sensitive material requiring protection and may not be released to the public without review.
According to people familiar with the matter, the employee handed his login credentials to the Claude agent so that the AI could automatically write code and launch cloud servers. This gave the agent administrator access and the ability to bypass security controls in the normal login process. It also submitted code on the employee's behalf, saving the code into the system.
The problem arose during the process of the agent connecting to external tools. According to Wired, it apparently sent the employee's login credentials, passwords, and information on the US military's network structure to a third-party website. To avoid further increasing system risk, Wired did not disclose the website's name. The report noted that the US National Institute of Standards and Technology had previously flagged it as high-risk because a vulnerability could allow attackers to inject instructions into AI coding agents and thereby steal credentials.
A source familiar with the incident said it is currently unclear how the information was handled after being sent, and whether it is still retained by the third-party service. If the relevant service were compromised, attackers could use these credentials to enter secure environments without being detected.
The coding environment involved ran on the US Department of Defense's unclassified Non-classified Internet Protocol Router Network, NIPRNet. This network is used to handle unclassified information and can connect to the internet; employees and contractors can send and receive email and use browsers through it, but it is still under strict security protection.
The report found no evidence that hackers have entered the US military's classified or top-secret systems. However, security experts interviewed believe that the outflow of accounts, code, and system structure information from an unclassified environment could still threaten more sensitive systems.
Jake Williams, a former NSA hacker and faculty member at the cybersecurity advisory firm IANS, explained that data that individually counts as controlled unclassified information may, when aggregated, form content that should be classified. For example, the location of hazardous materials and the weaknesses of the facilities storing them may each be unclassified information, but combined they could expose more sensitive information.
The flow of code is another pathway of concern to experts. The report notes that some tools and code are first tested in NIPRNet and then deployed to isolated networks used to handle classified or top-secret information. If attackers use leaked credentials to enter the testing environment, they could plant backdoors in the code; if review fails to catch them, the malicious code could enter more sensitive systems along with the tools. This is a potential risk raised by experts; the report did not confirm that such a scenario has occurred.
Williams said the static application security testing used by the government can check code for vulnerabilities, but deliberately planted backdoors may not be identified as vulnerabilities, and logic flaws in the code-generation process may also evade detection. AI-generated code is produced far faster than by humans, further increasing the pressure on review.
The discovery and reporting of the incident have also come under scrutiny. People familiar with the matter told Wired that despite the security risks, Accenture employees initially did not treat the matter as serious or urgent, and the company initially did not report it to the government. These claims conflict with Accenture's statements about the investigation's findings and its fulfillment of obligations.
Matt Trina, founder of the Washington IT consulting firm Hunter Strategy, believes that government contractors face conflicting demands. On one hand, projects need faster delivery and lower costs; on the other, admitting a security incident could put companies at risk of losing contracts. He said the incident described in the report falls into the category that requires reporting.
According to Wired, Accenture currently holds more than 3.5 billion US dollars in US federal government contracts, of which nearly 605 million US dollars come from the Department of Defense. The report also noted that Claude is currently banned from use by Department of Defense personnel. In response to Wired, Anthropic cited its usage policy, which prohibits unauthorized circumvention of security controls such as authentication, endpoint protection, or monitoring.