WIRED: an Accenture contractor connected a DOD system to a personal Claude Code account

Your AI and this story

Key facts

• Source: WIRED (Vittoria Elliott, Oct 29, 2026, 2:39 pm ET), based on sources who requested anonymity; no document was published and the incident date is given only as ‘earlier this year’
• System: a secure centralized coding/production environment used by multiple intelligence agencies, hosted on NIPRNet (the DOD’s unclassified but heavily secured network) and containing controlled unclassified information (CUI)
• What the contractor allegedly did: connected the environment to their personal Claude Code account so an agent could write, commit and deploy code and spin up cloud servers, and gave the agent their login credentials, which gave it administrative access and bypassed the normal login controls (per WIRED’s source)
• Exposure: the agent needed outbound internet access and ‘appears to have sent the contractor’s login credentials, passwords, and a map of NIPRNet out to a third party website’. WIRED does not name the site; it says NIST has flagged it as high risk because of a flaw that could let attackers inject instructions into a coding agent to steal credentials
• Duration: the agent ran on the DOD network for two months before it was identified and the vulnerability patched. Sources say Accenture staff did not treat it as urgent and did not initially report it, although DOD contractors must report cyber incidents within 72 hours
• Accenture: ‘We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations.’ It did not say who investigated, and did not dispute that there had been what could be called an incident (WIRED)
• DOD: ‘the Department does not comment on the status of its networks or systems.’ Claude is currently barred for DOD staff (see the supply-chain-risk designation entries). Anthropic pointed WIRED to its usage policy, which bars using its products to ‘interfere with the operation of military bases and related infrastructure’ or to ‘bypass security controls ... without authorization’
• No evidence of access to classified networks: WIRED says there is no indication that hackers reached a classified or top-secret system. Experts quoted (Jake Williams, former NSA, IANS; Matt Triner, Hunter Strategy) say stolen NIPRNet credentials could let an attacker plant code that is later promoted to air-gapped SIPRNet or JWICS systems, and that a network map shows ‘where the crown jewels are’