An employee of the international consulting company Accenture, which works with the US Department of Defense, allegedly connected the personal account of Claude Code to a secure Pentagon system. The AI agent gained access to internal information and probably transferred passwords to a third-party site. The agent's work went unnoticed for about two months.
An employee of the international consulting company Accenture, which works with the US Department of Defense, allegedly connected the personal account of Claude Code to a secure Pentagon system. The AI agent gained access to internal information and probably transferred passwords to a third-party site. The agent's work went unnoticed for about two months.
This is reported by WIRED, citing sources familiar with the incident.
According to the publication, the employee wanted to simplify his work: to instruct Claude Code to write the program code, save changes and launch cloud servers. To do this, he gave the AI agent his own login data. So the agent received administrator rights.
The AI assistant needed internet access to perform its tasks. That's when it allegedly passed logins, passwords, and the Pentagon's internal network diagram to a third-party site.
The site had previously come to the attention of the US National Institute of Standards and Technology. Experts warned that its vulnerability could allow attackers to feed malicious instructions to AI agents and steal credentials.
The AI worked on the NIPRNet network. This is a protected network of the US Department of Defense, where unclassified but sensitive information is stored. For example, information about military equipment, critical infrastructure and its protection. In addition, programs that are first tested on NIPRNet can later be used in more secure military networks. And attackers could use stolen passwords to replace the program code and leave malicious commands hidden in it.
However, there is no confirmation yet that hackers actually gained access to secret systems.
The AI agent was operating on the network for about two months before it was discovered and the vulnerability was fixed, WIRED’s sources told me. They also claim that Accenture initially failed to notify U.S. authorities about the incident, even though U.S. Defense Department contractors are required to report such incidents within 72 hours of discovery.
Accenture denies the allegations. The company said it conducted an independent investigation that found no evidence of the claims and had complied with all legal and contractual obligations. The Pentagon declined to comment.
Earlier, dev.ua reported that hackers infected an update to the popular AI tool LiteLLM with a virus that stole passwords and other confidential data. The developers suggested that the attackers could have gained access to the system through the leak of secret keys in Claude Code responses.
