Accenture Claude Agent Exposed DOD Credentials: Report

An Accenture employee connected a secure Department of Defense (DOD) system used by several intelligence agencies to their personal Claude Code account, letting Anthropic’s AI coding agent run on a Pentagon network for about two months before it was identified and the gap was closed, WIRED reported on 29 October 2026.

According to the publication’s sources, the agent appears to have sent the contractor’s login credentials, passwords, and a map of the network to a third-party website that the National Institute of Standards and Technology (NIST) had already flagged as high risk.

The affected environment runs on the Non-classified Internet Protocol Router Network (NIPRNet), the DOD’s network for unclassified traffic. It is internet-connected so staff can reach email and the web, but it is heavily secured, and the centralized system involved holds controlled unclassified information (CUI) — sensitive material that cannot be released publicly without review and, depending on the agency, can cover critical infrastructure, weapons and equipment designs, or the location of radioactive material.

Per WIRED’s source, the contractor handed their credentials to the Claude agent so it could automate writing code and spinning up cloud servers. That gave the agent administrative access and let it bypass the security controls that the normal login process enforces.

Because the agent was also committing code into the system on the employee’s behalf, it needed to reach out to the internet, and that is where the credentials and network map appear to have left the environment.

WIRED withheld the name of the third-party site to avoid exposing the system further. NIST had previously marked it high risk because of a flaw that could let attackers inject instructions into an AI coding agent — a technique known as prompt injection — in order to steal credentials. The source said there is no visibility into whether the service kept the data, calling the exposure “100 percent a national security threat.”

Accenture Says Claims Were Investigated

An Accenture spokesperson told WIRED the allegations were “thoroughly and independently investigated and found to be without merit,” and that the company met its legal and contractual obligations. When pressed, Accenture did not say who carried out that investigation, and did not dispute that the episode amounted to an incident. A DOD spokesperson declined to discuss the status of its networks or systems.

Sources told WIRED that Accenture staff did not treat the incident as severe or urgent and that the company did not initially report it to the government at all. DOD employees and federal contractors must report cybersecurity incidents within 72 hours of discovery.

Matt Triner, founder of Washington-based IT consultancy Hunter Strategy, said the case is “absolutely one that would need to be reported,” while noting that contractors often fear losing government work by admitting a breach.

Anthropic directed WIRED to its usage policy, which prohibits using its products to interfere with military infrastructure or to bypass authentication, endpoint protection, or monitoring controls without authorization.

Claude is also off-limits for Pentagon work more broadly: the Pentagon designated Anthropic a supply-chain risk in March 2026, a label that requires defense contractors to certify they do not use Claude in their DOD work. WIRED did not say when in 2026 the agent was active, so it is not clear whether the access began before or after that designation took effect.

Why A NIPRNet Foothold Matters

Jake Williams, a former NSA hacker and IANS faculty member, told WIRED that individually unclassified pieces of CUI can become classified once aggregated, and that the bigger risk lies downstream. Tools and code are often tested on NIPRNet before being moved into the air-gapped SIPRNet, which carries secret-level data, and JWICS, the top-secret intranet.

An attacker holding stolen NIPRNet credentials could plant a backdoor that later travels into those isolated networks. “The code could operate completely normally in NIPR and do something malicious” once inside SIPRNet, Williams said.

Williams added that the DOD’s Static Application Security Testing (SAST) scans are built to catch bugs, not deliberately inserted backdoors, which are not technically vulnerabilities. A map of the network is valuable on its own, Triner said, because it shows an intruder where the most sensitive assets sit. There is no indication that attackers reached any classified or top-secret system.

The report lands weeks after the FBI removed an Accenture contractor in early October 2026 over a missed Oracle PeopleSoft patch that let the ShinyHunters group into the bureau’s jobs portal and expose details on thousands of employees. Accenture holds more than $3.5 billion in federal contracts, nearly $605 million of them with the DOD, according to WIRED.

Key questions remain unanswered: whether the third-party service retained the credentials or network map, whether anyone has used them, who conducted Accenture’s investigation, and whether the incident was ever formally reported to the DOD. Neither Accenture nor the Pentagon has addressed those points publicly.