An employee at consulting firm Accenture allegedly granted a personal Claude Code agent administrative access to the Department of Defense’s unclassified NIPRNet network to write and deploy code. The AI agent, provided by Anthropic, operated on the secure system for 2 months and sent login credentials and a network map used by several intelligence agencies to a third party site that the National Institute of Standards and Technology had flagged as high risk.
Accenture disputes claims that its personnel caused the leak, which was only stopped once the vulnerability was identified and patched. Although government contractors are required to report security breaches within a 72 hour window, sources tell WIRED that Accenture initially failed to notify the government, leading one source to describe the incident as a threat to national security.
