A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System

Earlier this year, a contractor employed by global consulting firm Accenture caused a security incident at the Department of Defense by connecting a secure centralized system to their personal Claude Code account, Anthropic's AI coding agent. The agent then sent information about the DOD system, including login credentials, to a high-risk third-party website.

Sensitive Information at Risk

The centralized system contains controlled unclassified information (CUI), which is considered sensitive and not to be released to the public without review. CUI can include information about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism.

Security experts note that access to this system could allow for the exploitation of even more sensitive ones. The vulnerability remained on the network for two months before it was identified and patched.

It puts all the data that's in there at risk. If the third-party software was compromised, there could be somebody out there with the ability to log into a secure environment without anyone knowing. It's 100 percent a national security threat and could cause irreparable harm.

Company Response

A DOD spokesperson declined to comment on the status of its networks or systems. Accenture stated that "these allegations were thoroughly and independently investigated and found to be without merit" but did not offer clarification on who conducted the investigation or dispute that an incident occurred.

Sources indicate that despite the security risks, Accenture employees did not treat the incident as severe or urgent. Federal contractors are required to report cybersecurity incidents within 72 hours, but Accenture did not initially report this breach to the government.

"We are in a conflict with Iran right now," said the employee, noting Iran's attempts to hack federal agencies and US infrastructure. "It's the worst time to be having this kind of cavalier attitude."

Broader Concerns

Accenture currently holds more than $3.5 billion in federal contracts, with $605 million from the DOD. The company also works with other agencies including the Department of Education, General Services Administration, and Department of Energy.

Earlier this month, the FBI removed an Accenture contractor after a vulnerability led to the hacking group ShinyHunters accessing details of thousands of Bureau employees. The incident raises questions about cybersecurity practices among government contractors during heightened national security concerns.