An AI agent ran loose inside a Pentagon network for two months

An Accenture employee working as a US Department of Defense contractor connected their personal Claude Code account to a secure Pentagon system. It is a centralized platform used by several intelligence agencies, and it holds controlled unclassified information, data that is not supposed to leave that environment without review.

The idea was simple and very human: let an AI agent write the code, commit it to the system and spin up cloud servers on its own. To make that work, the contractor handed the agent their login credentials. That gave Claude administrative access and let it skip the security checks of the normal login process.

The agent needed internet access to do its job. According to sources, it appears to have sent the credentials, passwords and a map of NIPRNet, the Defense Department's unclassified but heavily secured network, to a third party website. The site is not named, but the US standards agency NIST has flagged it as high risk because a flaw there lets attackers inject instructions into an AI coding agent and steal credentials. Nobody knows what happened to the data after that.

The agent ran inside the system for about two months before it was found and the hole was patched. Pentagon contractors must report cyber incidents within 72 hours, yet sources say Accenture did not initially report it at all and did not treat it as urgent. The incident itself happened earlier this year and only came to light now.

Accenture says the allegations were independently investigated and found to be without merit. It would not say who investigated or deny that an incident took place. The Pentagon declined to comment. Anthropic pointed to its usage policy, which bans using Claude to interfere with military infrastructure or bypass authentication. Pentagon staff are already barred from using Claude.

Hackers spend years trying to break into Defense Department networks. Here a contractor opened the door themselves and let an AI walk in. The agent did exactly what it was asked, and that is the scary part.