Accenture Contractor Allegedly Gave Claude AI Agent Access to Secure Pentagon Network - CyberSecurityNews

The employee connected a personal account for Anthropic's Claude Code to a production environment on the nonclassified Internet Protocol Router Network (NIPRNet), which connects to the internet while supporting protected government work. According to WIRED's investigation published October 29, the system serves multiple intelligence agencies and holds Controlled Unclassified Information (CUI), which requires protection against unauthorized release despite not being classified.

Security Breach Details

The contractor shared login credentials so the AI agent could automate coding and cloud server setup, granting it administrator rights and allowing it to bypass normal login controls. During its operation, the agent allegedly transmitted passwords, login details, and a map of NIPRNet to a third-party website, though WIRED withheld the site's name. NIST had previously identified a high-risk weakness that could let attackers inject instructions into AI coding agents to steal credentials, though the report doesn't confirm this weakness was exploited.

Accenture's Response

Accenture disputes the allegations, stating they were "thoroughly and independently investigated and found to be without merit." The company claims it met its legal and contractual obligations but didn't identify the investigator. The Pentagon declined to discuss its network status. WIRED also reported disputed claims that Accenture didn't initially notify the government. The company holds federal contracts above $3.5 billion, including nearly $605 million with the Defense Department.