Personal AI Agent Ran on Pentagon's Security Network for Two Months
A contractor employee at the U.S. Department of Defense (Pentagon) connected his personal artificial intelligence (AI) agent to the security system, and the agent leaked system information and login credentials to the outside. This is an incident reported by U.S. IT media Wired on the 31st of last month (local time), citing multiple sources. The employee in question works for global consulting firm Accenture and connected his personal 'Claude Code' (Anthropic's AI coding agent) account to a central security system shared by multiple intelligence agencies. The purpose was to have the code written and deployed on his behalf.
The weight of the information at stake is considerable. According to Wired, the system contained Controlled Unclassified Information (CUI) requiring pre-release review, including nuclear submarine propulsion, critical infrastructure, and chemical and biological terrorism vulnerabilities. One source familiar with the incident said, "All data within it was put at risk," and "If third-party software was compromised, there could be someone outside who can log into the security environment without anyone knowing. It's a 100% national security threat and could cause irreversible damage."
More painful is the timeline. The agent ran on the Defense Department's network for two months before it was discovered. While Defense Department employees and federal contractors have a duty to report cyber incidents within 72 hours, sources said Accenture initially did not even report the incident to the government. Accenture countered to Wired, saying "the allegation was thoroughly and independently investigated and found to be without merit," but did not disclose who conducted the investigation and did not deny that something happened worth considering an incident. The Pentagon simply stated, "We do not comment on the status of networks and systems."
Regulations already existed. Claude use by Defense Department employees was prohibited, and Anthropic's usage policy prohibits using the service to circumvent authentication systems and security controls without authorization. What was breached was not the model but people and systems. An employee who connected a personal account to a classified system, and a monitoring system that failed to detect this connection for two months. It's a familiar structure. While the starting point of the Binance incident, recorded as the largest cryptocurrency hack to date, was a single employee laptop, the starting point of this incident was a single AI agent brought in by an employee. The weakest link is shifting from people to the agents people bring in.
By their nature, AI agents read credentials, execute code, and communicate externally. Even without being hacked, the design itself can become a data exfiltration pathway. The security industry's recommended best practices can be summarized into three rules. First, don't attach personal accounts to agents. Create isolated work accounts and grant only the minimum privileges necessary. Second, block credential access. Passwords and keys should be kept in a secrets management tool so agents cannot read them in plaintext. Third, constantly audit agent activity logs and restrict external communications to an allowlist. This publication, which also produces articles using AI agents, operates its system based on isolated accounts and privilege separation.
Invitation rather than intrusion has become the new threat. The question of security is also changing. Not who broke through and got in, but what have I let inside. The Pentagon's two months is the measure of time that failed to answer that question.