Accenture contractor funneled DOD system data through personal Claude Code account
Earlier this year, a contractor employed by Accenture connected a secure centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic’s AI coding agent. The agent then transmitted information about the Department of Defense system, including login credentials, to a high-risk third-party website. The compromised system contains controlled unclassified information (CUI), a category of sensitive data that cannot be released to the public without review. CUI can encompass details about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Security experts warn that if the third-party software was compromised, “there could be somebody out there with the ability to log into a secure environment without anyone knowing. It’s 100 percent a national security threat and could cause irreparable harm.”
A DOD spokesperson told WIRED that the Department does not comment on the status of its networks or systems. An Accenture spokesperson said the allegations were “thoroughly and independently investigated and found to be without merit” and that the company “fully complied with our legal and contractual obligations.” When pressed, Accenture did not clarify who conducted the investigation or dispute that an incident occurred.
The Accenture employee allegedly connected a secure production environment to their personal Claude account to allow the AI agent to write and deploy code. Claude is currently barred from being used by DOD staff. Anthropic directed WIRED to the company’s usage policy, which instructs users not to use its products to “interfere with the operation of military bases and related infrastructure” or to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”
The AI agent ran on the DOD network for two months before the vulnerability was identified and patched. Despite the security risks, Accenture employees did not treat the incident as severe or urgent. DOD employees and federal contractors are required to report any cybersecurity incident within 72 hours of discovery, but sources indicate Accenture did not initially report the breach to the government at all. “We are in a conflict with Iran right now,” the employee noted, “and it’s the worst time to be having this kind of cavalier attitude.”
The coding environment accessed by the contractor operates on the Non-classified Internet Protocol Router Network (NIPRNet), a DOD network used for unclassified information. While the network connects to the internet—contractors and employees can access email and web browsers—it is heavily secured. To automate code writing and cloud server deployment, the contractor provided login credentials to the Claude agent. This gave the agent administrative access and allowed it to bypass security controls enforced through the normal login process. The AI agent, which was not only writing code but also committing it or saving code into the system on the employee’s behalf, needed to connect out to the internet to perform its tasks. In doing so, it appears to have sent the contractor’s login credentials, passwords, and a map of NIPRNet to a third-party website.
WIRED is declining to name the third-party website to protect the system from further vulnerability, but the National Institute of Standards and Technology has previously identified it as high risk because it has a vulnerability that could let hackers inject instructions into an AI coding agent to steal credentials. The system the AI agent accessed contained CUI. “Information from a CUI environment is not supposed to leave that infrastructure,” a source said. “There is no insight about what happened to the information, including the login credentials, after it was sent to [that service], whether it’s been retained.”
Depending on the agency and its work, CUI can include anything from personally identifiable information to proprietary business or contracting information. According to the DOD’s website, CUI can include information on “the securing and safeguarding of explosives, hazardous chemicals, or pipelines,” documentation related to the designs of “military or space equipment or technology,” and “the exact location and quantities of radioactive material.” Distinct from the actual data, a map of it could be incredibly valuable to a hacker. “Once an attacker understands how those things fit together, even if those things are public information, what is sensitive is how we are putting those things together and turning that into actionable intelligence,” says Matt Triner, founder of Hunter Strategy. While a map might not get a hacker into a system, he says, it could help an adversary move faster once they do have access and “help an attacker understand where the crown jewels are.”
Jake Williams, a former NSA hacker and faculty at IANS, an intelligence and security consultancy, says that an AI agent running code in NIPRNet presents a “huge problem, and there are huge national security impacts.” Williams notes that while individual pieces of data or information might be considered CUI, “when that unclassified information is aggregated, that can become classified itself.” For instance, the location of certain hazardous materials might be CUI, as might be information about the vulnerability of the facilities that house them. Combined, however, they could reveal information that would be kept classified.
This is not the only way classified information may have been put at risk. Frequently, tools and code are tested in NIPRNet before being deployed into more sensitive systems like the Secret Internet Protocol Router Network (SIPRNet), the military’s secured network for classified information, and Joint Worldwide Intelligence Communications System (JWICS), a secure intranet for top secret information. Both SIPRNet and JWICS are air gapped, a security measure that means they are not connected to any outside networks. On a practical level, that means SIPRNet and JWICS would be extremely difficult for a hacker to access remotely. But with the login credentials exfiltrated by an AI agent, a hacker could access NIPRNet and insert a backdoor or other malicious code into a tool or system. Without proper review, this code could end up deployed in one of the air-gapped systems. “The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible,” Williams says. Exfiltrating data out of these networks would be difficult, he adds, but malicious code could be used to attack the systems from the inside. “I think the most likely thing would be some kind of distributed denial of service attack.” Triner says that even something more subtle, such as slowing down intelligence operations and activities, could cause damage and make users lose trust in a tool, even once the problem is fixed.
As vibe coding, or prompting an AI assistant to write the code for a product described by an engineer, becomes more common, vetting code is becoming more of a challenge. AI is capable of generating code at a volume that far surpasses human productivity, making it time-consuming and difficult to vet. “When you’re using an agent, you have no idea of the supply chain or even the inference chain of what has ultimately generated the code,” Williams says. “A lot of the code that these LLMs were trained on is itself vulnerable, and they can regurgitate the same kinds of architecture and architectural issues that we see in other code.”
The government does have a way to identify flawed code in NIPRNet. Static Application Security Testing (SAST) scans code for bugs and flaws before allowing it to run. But Williams notes that a hacker-inserted “backdoor is not a vulnerability, even if we may not want it there,” and therefore would likely fly under the radar of SAST’s detection. SAST also does not usually identify structural issues in the logic chain of how code is created.
There’s no indication that hackers were able to get into a classified or top-secret system. Still, Williams says, the incident should raise significant alarms. “Architecturally, any information about NIPR that you can’t see through open-source intelligence, DOD considers a close hold regardless of whether something touches a classified network,” he says.
This is not the first time the DOD has been made vulnerable because of AI-related issues. Last year, ProPublica revealed that Microsoft was using “digital escorts” on its projects with the federal government, wherein American employees with security clearances would be overseeing code written by outsourced workers in China. Experts who spoke to ProPublica said that the program presented a particular security risk because the American employees were often not able to vet the code themselves, leaving openings for malicious code to be inserted unknowingly into government systems.