Pentagon Security Breach: Banned Claude Code Agent Leaked Credentials for Two Months

On October 30 (Beijing Time), according to a report by Wired magazine, an Accenture contractor employee allegedly connected their personal Claude Code account to the U.S. Department of Defense’s secure systems, allowing an AI agent to write and deploy code on their behalf. Sources indicate that the agent operated within DoD networks for two months before being detected. During this period, it reportedly sent login credentials, passwords, and network architecture information to a third-party website with known security vulnerabilities.

Accenture denied the allegations. A company spokesperson stated that the claims had been thoroughly investigated by an independent party and found to be unsubstantiated, affirming that the company fully complied with its legal and contractual obligations. Wired noted that Accenture did not provide further details on who conducted the investigation. A Department of Defense spokesperson declined to comment on the status of its networks or systems.

According to reports, the employee accessed a centralized system used by multiple intelligence agencies, which stores "Controlled Unclassified Information" (CUI). Although not classified as secret, CUI is considered sensitive material requiring protection and cannot be released to the public without review.

Sources say the employee provided their login credentials to the Claude agent to enable automated code writing and cloud server provisioning. This granted the agent administrative access privileges, allowing it to bypass standard security controls in the login process. The agent also submitted code on the employee’s behalf and saved it into the system.

The issue arose when the agent connected to external tools. According to Wired, it appears to have transmitted the employee’s login credentials, passwords, and U.S. military network structure information to a third-party website. To avoid increasing system risk, Wired withheld the name of the site. The report noted that the National Institute of Standards and Technology (NIST) had previously flagged the site as high-risk due to a vulnerability that could allow attackers to inject instructions into AI coding agents, potentially leading to credential theft.

A source familiar with the incident stated that it remains unclear how the leaked information was handled after transmission or whether it is still retained by the third-party service. If the service were compromised, attackers could use these credentials to infiltrate secure environments undetected.

The programming environment involved operates on NIPRNet, the Department of Defense’s Non-classified Internet Protocol Router Network. This network handles unclassified information and has internet connectivity, allowing employees and contractors to send emails and browse the web, albeit under strict security protections.

There is no evidence suggesting hackers accessed classified or top-secret U.S. military systems. However, interviewed security experts argue that the leakage of accounts, code, and system architecture information from unclassified environments could still threaten more sensitive systems.

Jack Williams, a former NSA hacker and instructor at cybersecurity consultancy IANS, explained that while individual pieces of Controlled Unclassified Information may seem benign, aggregated data can constitute content warranting classification. For example, the location of hazardous materials and weaknesses in storage facilities might each be unclassified individually, but combined, they could expose highly sensitive information.

Code flow represents another concern for experts. Reports indicate that some tools and code are first tested on NIPRNet before deployment to isolated networks handling classified or top-secret information. If attackers use leaked credentials to enter the testing environment, they could implant backdoors in the code. If reviews fail to detect these malicious elements, the compromised code could migrate with the tools into more sensitive systems. Experts highlight this as a potential risk; however, the report confirms no such incidents have occurred.

Williams noted that static application security testing (SAST) used by the government can identify code vulnerabilities, but intentionally implanted backdoors may not be recognized as vulnerabilities. Additionally, logical flaws introduced during AI code generation might evade detection. The speed at which AI generates code far exceeds human capacity, placing additional pressure on review processes.

The discovery and reporting process of the incident has also come under scrutiny. Sources told Wired that despite the security risks, Accenture employees initially did not treat the matter as serious or urgent, and the company did not immediately report it to the government. These accounts conflict with Accenture’s response regarding the investigation results and compliance status.

Matt Trier, founder of Washington-based IT consultancy Hunter Strategy, believes government contractors face conflicting demands. On one hand, projects require faster delivery and lower costs; on the other, acknowledging security incidents risks losing contracts. He stated that the events described in the report constitute situations requiring mandatory reporting.

According to Wired, Accenture currently holds over $3.5 billion in U.S. federal government contracts, with nearly $605 million coming from the Department of Defense. The report also noted that Claude is currently banned for use by DoD personnel. In response to Wired, Anthropic cited its usage policy, which prohibits unauthorized bypassing of authentication, endpoint protection, or monitoring security controls.