Accenture Contractor Linked to AI Security Breach on DOD Network

An employee of global consulting firm Accenture allegedly connected a personal account for Claude Code, an AI coding agent from Anthropic, to a secure Department of Defense (DOD) production environment, as first reported by Wired. The vulnerability reportedly remained unpatched while the agent operated on the DOD network for two months.

According to sources cited by Wired, the contractor provided the AI agent with login credentials to automate the writing and deployment of code. This granted the agent administrative access to a centralized system used by multiple intelligence agencies, allowing it to bypass standard security controls. The agent then allegedly sent system data, including login credentials, to a high-risk third-party website.

The affected system operates on the Non-classified Internet Protocol Router Network (NIPRNet) and contains controlled unclassified information (CUI). Wired notes that CUI can include data on nuclear submarine propulsion, critical infrastructure, and vulnerabilities to biological and chemical terrorism.

Sources indicate that Accenture did not initially report the breach to the government, despite federal requirements to report cybersecurity incidents within 72 hours. Accenture currently holds over $3.5 billion in federal contracts, with nearly $605 million tied to the DOD.

In response to the reporting, an Accenture spokesperson stated that the allegations were independently investigated and found to be without merit, adding that the company complied with all legal and contractual obligations. A DOD spokesperson declined to comment on the status of its systems, stating only that the department takes all concerns seriously. Anthropic directed Wired to its usage policy, which prohibits using its products to bypass security controls or interfere with military infrastructure.