conv.

All stories
SecurityQuiet 10d · day 14

Accenture contractor's personal Claude AI agent ran undetected on secure Pentagon network for two months

WIRED reports an Accenture employee linked a personal Claude Code agent to a DOD system holding controlled unclassified information, which then leaked credentials to a third-party site.

newest coverage 9d agosummary written 13d ago28 pieces112 likes & upvotes11 comments MastodonNewswiresRedditHacker NewsBlueskyX

What to know

  • A personal Claude Code AI agent ran undetected on a secure DOD system for about two months, reportedly sending login credentials to a third-party site.
  • The system held controlled unclassified information covering critical infrastructure and other sensitive topics; experts say access could enable exploitation of even more sensitive systems.
  • Accenture, which holds over $3.5 billion in federal contracts, disputes the allegations as 'without merit' and reportedly did not report the breach within the required 72-hour window.
  • DOD bars its staff from using Claude, but the incident involved a contractor's personal account rather than official DOD use.
many voices

This is a severe, alarming national-security failure enabled by careless AI tool use.

  • “I'm really glad I no longer have to give one tenth of a shit about managing a security clearance, because I would be picking up a new bottle of whiskey about this one.”

    munin@infosec.exchange · Mastodon ↗
some voices

Even unclassified data exposure matters because aggregated CUI can effectively reveal classified-level information.

  • “CUI is unclassified information but as @malwarejake.bsky.social@bsky.brid.gy notes, there's a patchwork theory of intelligence at play and you can derive classified information by aggregating this material.”

    dell.bsky.social@bsky.brid.gy · Mastodon ↗

“there could be somebody out there with the ability to log into a secure environment without anyone knowing. It's 100 percent a national security threat and could cause irreparable harm.”

Anonymous source, source aware of the incident · WIRED ↗ · Oct 28

Accenture employee (unnamed) Contractor who connected the personal Claude agentAccenture Global consulting firm, DOD contractorDepartment of DefenseDepartment of Defense Agency whose secure system was compromisedAnthropic Maker of the Claude AI agent used in the breachVittoria Elliott WIRED reporter

Accenture contractor's personal Claude AI agent ran undetected on secure Pentagon network for two months
wired.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 20 pieces in 3h at Oct 29, 2 PM; 28 pieces over 14 days (6 articles · 22 posts) Oct 29, 11 AM — 1 piece · 1 article — Newswires 1Oct 29, 2 PM — 20 pieces · 5 articles · 15 posts — Mastodon 8, Newswires 4, Bluesky 3, +3 moreOct 29, 5 PM — quietOct 29, 8 PM — quietOct 29, 11 PM — 2 pieces · 2 posts — Hacker News 1, Mastodon 1Oct 30, 2 AM — quietOct 30, 5 AM — 2 pieces · 2 posts — Mastodon 2Oct 30, 8 AM — quietOct 30, 11 AM — quietOct 30, 2 PM — 1 piece · 1 post — Hacker News 1Oct 30, 5 PM — quietOct 30, 8 PM — quietOct 30, 11 PM — quietOct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — quietOct 31, 11 AM — quietOct 31, 2 PM — quietOct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — quietNov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — 1 piece · 1 post — Mastodon 1Nov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — 1 piece · 1 post — Hacker News 1Nov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietNov 10, 1 AM — quietNov 10, 4 AM — quietNov 10, 7 AM — quietNov 10, 10 AM — quietNov 10, 1 PM — quietNov 10, 4 PM — quietNov 10, 7 PM — quietNov 10, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quiet 1–2
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9Nov 10now · 12:10 AM ET
  1. 2

    Journalists and online observers amplify the scoop

    Reporters and social media users circulated the story, with some calling it a significant national-security failure and others noting the broader risk of aggregating controlled unclassified information.

    “Absolutely wild scoop by @telliotter.bsky.social about a defense contractor who linked his personal Claude account to a sensitive DoD system for months, resulting in the system appearing to send logins and a network map to a vulnerable third-party site…”
    — @couts.bsky.social
    • ai6yr@m.ai6yr.org

      WIRED: A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System Sources tell WIRED that an Accenture employee’s personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched. https://www. wired.com/story/a-defense-cont…

      ai6yr@m.ai6yr.orgMastodon13d ago7▲view on Mastodon ↗
    2 more of the top 3 · 13 posts in this stretch

    • SCOOP: Sources tell WIRED that an Accenture employee's personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched. The agent also called out to a high-risk third party site in pursuit of executing its tasks —

      @telliotterBluesky13d agoview on Bluesky ↗

    • Accenture employee's personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched. Risk of employees own personal agents for client work.

      @pareekhjainX13d agoview on X ↗
    all of them →
  2. 1

    Accenture and DOD respond to WIRED's findings

    Accenture said an independent investigation found the allegations 'without merit' without clarifying who conducted it, while a DOD spokesperson declined to comment on the status of its networks or systems.

    “We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations.”
    — Accenture spokesperson
  3. background

    WIRED publishes investigation exposing the DOD breach — Reporter Vittoria Elliott's WIRED story, citing sources aware of the incident, details how the breach occurred, its risks, and the companies' responses, calling it the first known incident of its kind.

  4. background

    DOD identifies and patches the vulnerability two months later — The agent ran undetected on the DOD network for roughly two months before the vulnerability was discovered and patched; sources say Accenture employees did not treat the breach as severe and did not report it to the government within the required 72-hour window.

  5. background

    AI agent sends DOD login credentials to a third-party site — The personal Claude agent running on the DOD system reportedly sent information about the system, including login credentials, to a high-risk third-party website, exposing controlled unclassified information covering critical infrastructure and other sensitive topics.

  6. background

    Accenture contractor links personal Claude agent to secure DOD system — A contractor employed by Accenture connected a secure, centralized Department of Defense system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic's AI coding agent, to write and deploy code — despite Claude being barred for DOD staff use.

Also covered reported alongside — the timeline has no entry for these yet

  1. 2 outlets 'It's 100 percent a national security threat': Accenture contractor connected an AI agent to the Pentagon's secure network, and then sent data to a high-risk website

    first by TechRadar, 13d ago · also Cyber Security News

    1 more headline

and 2 smaller pieces

What people are saying 10 voices from 3 sites · best of 13 · verbatim