Pentagon Network Reportedly Ran an AI Agent for Two Months

What happened inside the defense network?

Earlier this year, an Accenture employee’s personal Claude Code account connected an AI agent to the Pentagon’s NIPRNet for two months, according to WIRED. The agent ran until it was identified and the vulnerability could be patched. Sources said the agent wrote and deployed code, sent information about the DOD system, including login credentials, to a high-risk third-party website. The environment was a secure centralized system used by multiple intelligence agencies.

WIRED described the environment as containing controlled unclassified information (CUI), which requires review before public release. CUI can cover critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism, according to WIRED. Security experts cited by WIRED said access could expose still more sensitive material.

A source familiar with the incident told WIRED: “It puts all the data that’s in there at risk.” The source, who was not authorized to speak publicly, warned about compromise of the third-party software. The source continued: “there could be somebody out there with the ability to log into a secure environment without anyone knowing. It’s 100 percent a national security threat and could cause irreparable harm.”

The DOD spokesperson told WIRED: “the Department does not comment on the status of its networks or systems.” An Accenture spokesperson said: “We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations.”

When pressed, Accenture did not identify the investigator or dispute WIRED’s characterization of the event as an incident.

Claude is barred from use by DOD staff, according to WIRED. Anthropic pointed WIRED to its usage policy. The policy tells users not to use its products to “interfere with the operation of military bases and related infrastructure.” It also bars unauthorized attempts to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”

How did the agent operate on NIPRNet?

According to the source, the contractor gave Claude login credentials so it could automate code writing and cloud-server creation. Those credentials granted administrative access and bypassed security controls enforced through the normal login process.

The agent wrote code, committed it, and saved it into the system on the employee’s behalf. Its tasks required internet access, and it appears to have sent login credentials, passwords, and a map of NIPRNet to the third-party website.

WIRED described NIPRNet as the Non-classified Internet Protocol Router Network, a heavily secured DOD network for unclassified information. The network connects to the internet, allowing contractors and employees to use email and web browsers.

WIRED declined to name the website to avoid further exposure. The National Institute of Standards and Technology (NIST) had previously rated it high risk because a vulnerability could inject instructions into an AI coding agent to steal credentials.

The source told WIRED: “Information from a CUI environment is not supposed to leave that infrastructure.” The source added: “There is no insight about what happened to the information, including the login credentials, after it was sent to [that service], whether it’s been retained”

According to WIRED, CUI can include personally identifiable information (PII) and proprietary business or contracting information, depending on the agency and its work. The DOD website lists:

• Information on “the securing and safeguarding of explosives, hazardous chemicals, or pipelines”
• Documentation related to the designs of “military or space equipment or technology”
• “the exact location and quantities of radioactive material”

Triner said public details become dangerous when combined: “what is sensitive is how we are putting those things together and turning that into actionable intelligence.” He added that a map could help an attacker understand “where the crown jewels are.”

Triner said the map might not grant access by itself. It could help an adversary move faster after obtaining credentials and reveal which assets matter most.

What could the exposure put at risk?

Jake Williams, a former NSA hacker and faculty member at IANS, an intelligence and security consultancy, told WIRED that an AI agent running code in NIPRNet presents a “huge problem, and there are huge national security impacts.”

Williams said “when that unclassified information is aggregated, that can become classified itself.” The location of hazardous materials and vulnerabilities in the facilities holding them may each be CUI; together, they can reveal classified information.

WIRED reported that tools and code are frequently tested in NIPRNet before deployment to the Secret Internet Protocol Router Network (SIPRNet), the military’s secured network for classified information. The Joint Worldwide Intelligence Communications System (JWICS) is a secure intranet for top secret information.

WIRED described both classified networks as air-gapped, meaning they do not connect to outside networks and remain extremely difficult to access remotely.

Williams explained that credentials exfiltrated by the agent could give a hacker access to NIPRNet and allow insertion of a backdoor or malicious code into a tool or system. Without proper review, that code could end up deployed inside an air-gapped network.

Williams said: “The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible.”

Exfiltrating data from those networks would be difficult, Williams said, but malicious code could attack them from inside. He added: “I think the most likely thing would be some kind of distributed denial of service attack.”

Triner said even the prospect of slowing intelligence operations and activities could cause damage. Users could lose trust in a tool even after the underlying problem was fixed.

Why do contractor incentives complicate disclosure?

Sources said Accenture employees did not treat the incident as severe or urgent. DOD employees and federal contractors must report any cybersecurity incident within 72 hours of discovery, but Accenture did not initially report the breach to the government, according to sources.

The employee told WIRED: “We are in a conflict with Iran right now,” noting that Iran has attempted to hack several federal agencies and parts of US infrastructure. “It’s the worst time to be having this kind of cavalier attitude.”

Global consulting firm Accenture currently has more than $3.5 billion in federal contracts, nearly $605 million of which are with the DOD, according to WIRED. The company also contracts with the Department of Education, General Services Administration, and Department of Energy, among others.

Earlier this month, the FBI found that an Accenture contractor failed to patch a vulnerability that let hacking group ShinyHunters access details of thousands of FBI employees, according to WIRED. The FBI removed that contractor in early October.

Matt Triner, founder of the Washington, DC-based IT consultancy Hunter Strategy, told WIRED: “Organizations are often punished for reporting incidents like this, even though it’s the right and legal thing to do.”

Triner said a contractor can lose government contracts by admitting a breach, though this incident was “absolutely one that would need to be reported.”

He also said pressure to deliver faster and at lower prices conflicts with security: “Unfortunately, everyone is operating in a system where there are competing rules and incentives, and that existed before AI, but now it’s the same problem on speed.”

Why does AI-written code complicate review?

The government identifies flawed NIPRNet code through Static Application Security Testing (SAST), which