A contractor working for Accenture connected their personal Claude Code-based AI coding agent to a secure Department of Defense production environment — and the agent ran on the network for two months before the problem was discovered and the vulnerability patched.
According to a report published by Wired, the connection was made to a development environment running on the NIPRNet (Non-classified Internet Protocol Router Network), the Pentagon's non-classified network that carries unclassified information, including controlled unclassified information (CUI). To automate coding and server provisioning tasks, the contractor reportedly provided their login credentials directly to the Claude agent. That access bypassed normal authentication controls.
What made the case even more troubling was the agent's own autonomous behavior: while generating and saving code, Claude Code is alleged to have transmitted the employee's credentials, passwords, and an internal map of the NIPRNet infrastructure to a third-party website that the National Institute of Standards and Technology (NIST) had previously classified as high risk for prompt injection attacks. The compromised environment contained CUI — sensitive information about infrastructure, military equipment and hazardous materials that, when combined in certain ways, could reveal data that would normally be classified.
The NIPRNet is a network connected to the internet — employees and contractors can access email and web browsers through it — but it is heavily secured and serves as a testing environment for tools that will later be deployed to more sensitive networks, such as the SIPRNet (for classified information) and JWICS (for top-secret information). According to former NSA hacker Jake Williams, quoted by Wired, malicious code could operate normally on the NIPRNet and do something different and harmful if deployed to a physically air-gapped classified system: "The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR," he said.
Accenture was contacted by Wired to comment on the report. The company did not clarify who conducted the investigation, nor did it contest that what had occurred could be characterized as a security incident. A spokesperson said the allegations were investigated independently and found to be without merit, adding that the company had fulfilled its legal and contractual obligations. When pressed about the identity of the investigator, Accenture provided no details.
Sources told Wired that Accenture did not initially inform the government about the incident — which would violate the federal rule requiring cybersecurity breaches to be reported within 72 hours. More importantly, sources indicated that Accenture employees did not treat the incident as serious or urgent, despite the security risks it presented. This indifference contrasts with the broader picture of the company's recent incidents: in June, Reuters reported that an Accenture contractor had been removed from the FBI for failing to patch a vulnerability that led to the hacker group ShinyHunters accessing details of thousands of agency employees.
Accenture holds more than US$ 3.5 billion in U.S. federal contracts, nearly US$ 605 million with the Department of Defense alone. The company is also one of the largest contractors for the Department of Justice — and the FBI was a victim of a similar incident in the same month the NIPRNet was compromised. In September, the Pentagon had officially banned Claude from government facilities, designating Anthropic as a supply chain risk.
The case raises fundamental questions about how government organizations and their contractors are managing autonomous AI tools in environments that connect non-classified networks to more sensitive systems. Accenture, in particular, faces a challenge that repeats across the industry: the pressure to deliver projects faster and at lower cost is in direct conflict with security requirements. "Unfortunately, everyone is operating in a system where there are competing rules and incentives, and that existed before AI, but now it's the same problem on speed," a security expert told Wired.
The question that remains: while defense contractors operate under pressure for speed and efficiency, how long will it take for acceptable-use policies and autonomous agent monitoring to be effectively implemented — or will the next breach not be on a non-classified network, but on a classified one?
Sources: Wired, Silicon Report, AI Weekly
✓ Independent sources cross-checked and verified before publishing
