Accenture contractor tied Pentagon intelligence system to personal Claude Code account

A defense contractor employed by Accenture tied a U.S. Department of Defense intelligence system to a personal Claude Code account in early 2026, putting an artificial intelligence (AI) agent inside a Pentagon network that handles controlled unclassified information for multiple intelligence agencies.

Claude Code is Anthropic’s AI coding agent. The contractor gave the agent login credentials, granting administrative access and letting it bypass normal security controls. The agent used the credentials to automate coding and cloud-server setup, saving code into the system under the employee’s identity. It remained inside the secure Pentagon environment for about two months.

The agent sent login credentials, passwords and a map of the NIPRNet network to a third-party website flagged by NIST as high risk. NIPRNet is the Pentagon’s network for unclassified information that connects to the internet while maintaining heavy security. NIST warned that a flaw at the site could let hackers direct an AI coding agent to steal credentials. Security observers do not know the exact transmission mechanism, and the reporting does not confirm that attackers exploited the identified flaw.

Controlled unclassified information is not classified, yet it must still be protected from unauthorized release. On NIPRNet it covers material involving military technology, critical infrastructure and national security topics. Defense Department examples include explosives, hazardous chemicals, pipelines, military or space equipment, and exact locations and quantities of radioactive material.

Software is often tested on NIPRNet before deployment to SIPRNet and JWICS, air-gapped networks for classified and top-secret information. Combining separate unclassified details can produce information sensitive enough to warrant classification, and a network map can show an intruder which systems are valuable.

Jake Williams, a former NSA hacker, warned that stolen credentials could let attackers change software developed on NIPRNet before it reaches more sensitive networks. A hidden backdoor could travel with approved code, appearing normal on NIPRNet while acting maliciously elsewhere. Williams said ordinary security scanning cannot catch a deliberately inserted backdoor because it is not a vulnerability in the usual sense. He described this as a possible route rather than a confirmed outcome.

A security expert described the incident as a national security threat and warned of irreparable harm if attackers compromised the third-party software. The expert emphasized the danger of unauthorized access to secure environments. Zoë Schiffer said no evidence showed a hacking attempt and characterized the contractor’s goal as writing and deploying code with Claude.

No evidence shows hackers accessed classified or top-secret systems, though the risk of credential theft and unauthorized access remains a concern. The Defense Department and Accenture declined to comment on the status of their networks or systems, and neither party provided further details on the incident.

Accenture disputes the allegations. The company says an independent investigation found the claims without merit and that it complied with legal and contractual obligations. It declined to name the investigator or the firm that performed the review. The denial rests on an internal review, yet the company did not identify who carried it out.

Initial reporting of the incident did not come from the Defense Department. The reporting also says Accenture did not first notify the government and that company staff did not regard the event as urgent, despite a 72-hour reporting requirement for Defense Department employees and federal contractors. Accenture disputes the characterization that it failed to notify the government.

Accenture holds more than $3.5 billion in federal contracts, including nearly $605 million with the Defense Department. The Defense Department has labeled Anthropic a supply chain risk, resulting in a current prohibition on Pentagon staff using Claude. Anthropic’s usage policy prohibits using its products to bypass security controls without authorization.

In October 2026, the FBI removed an Accenture contractor after a breach traced to an unpatched system, a separate earlier incident involving Accenture and federal systems. Separately, an October report said Accenture caps employee spending on Claude at $29 per month.

Cyber Security News reports that limiting permissions, using short-lived credentials and restricting network access can reduce the chance that routine AI tool use leaks secrets. These measures focus on what agents can reach and how long credentials remain valid. Security observers say the exact transmission mechanism is unknown, and the scenario resembles indirect prompt injection, in which hidden commands trick an agent.

The incident underscores risks associated with AI-assisted coding in government environments. It involves an insider who connected a multi-agency intelligence system to a personal coding-agent account, creating an unauthorized channel into sensitive government systems.