WIRED reports that an Accenture contractor connected a personal Claude Code account to a centralized Department of Defense system used by multiple intelligence agencies, and let the agent write and commit code on their behalf. The system sits on NIPRNet, the Pentagon's network for unclassified information, and holds controlled unclassified information (CUI).

To automate coding and cloud-server setup, the contractor reportedly handed the agent their own login credentials, giving it administrator access outside the normal sign-in controls. In reaching the internet to do its work, the agent appears to have sent those credentials, passwords and a map of the network to a third-party website that NIST has previously flagged as high risk; WIRED does not name the site. The agent ran for about two months before it was identified.

Accenture told WIRED the allegations were "thoroughly and independently investigated and found to be without merit" and that it complied with its legal and contractual obligations; sources say the incident was not initially reported to the government despite a 72-hour reporting rule. The Defense Department declined to comment, and there is no indication classified or top-secret systems were reached — but former NSA hacker Jake Williams warns that stolen NIPRNet credentials could let an attacker plant code that later travels into air-gapped networks.