Earlier this year, a contractor employed by Accenture connected a secure Department of Defense system to their personal account for Claude Code, Anthropic’s AI coding agent. The AI agent accessed a centralized network used by multiple intelligence agencies and transmitted login credentials and other data to a high-risk third-party website.
The compromised system stores controlled unclassified information, or CUI, which can include details on critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Because CUI is sensitive, unauthorized disclosure could enable exploitation of even more classified material, and the network in question operates on the Department’s Non-classified Internet Protocol Router Network (NIPRNet).
Accenture told WIRED that the allegations were investigated independently and found without merit, and that the firm complied with its legal and contractual duties. The company did not disclose who performed the investigation, nor did it dispute that an incident occurred. Federal contractors are required to report cybersecurity events within 72 hours, yet sources say Accenture initially failed to notify the government.
Accenture holds more than $3.5 billion in federal contracts, including roughly $605 million with the Department of Defense, and also works for agencies such as Education, the General Services Administration and Energy. Earlier this month the FBI reported that another Accenture contractor failed to patch a vulnerability that allowed the ShinyHunters group to access employee data, leading to the contractor’s removal in early October. Security analyst Triner said the push for faster, cheaper delivery creates incentives that clash with safety, a tension that predates AI.
To automate code writing and cloud-server provisioning, the employee supplied their NIPRNet credentials to the Claude agent, granting it administrative rights that bypassed normal login controls. The AI needed outbound internet access to function, and in doing so it transmitted the contractor’s usernames, passwords and a network map to the identified high-risk site, which NIST has flagged for a flaw that could let attackers inject instructions into coding agents.
If a malicious actor obtained the leaked credentials, they could infiltrate NIPRNet, plant backdoors or malicious code, and potentially have that code migrate into air-gapped environments such as SIPRNet or JWICS, where it could execute undetected. Experts Williams and Triner warned that such code might trigger denial-of-service attacks or subtly degrade intelligence operations, and that static application security testing often misses deliberately inserted backdoors, making detection difficult.