An Accenture contractor’s Claude Code agent ran on a Pentagon network. What’s known

What WIRED reported

On October 29, 2026, WIRED published a report by Vittoria Elliott under the line: “Sources tell WIRED that an Accenture employee’s personal Claude agent ran on a DOD network for two months before it was identified and the vulnerability could be patched.” The full story is behind WIRED’s paywall; the details below are as CDO Magazine, Cyber Security News and Cyber Press report it. All of it comes from WIRED’s unnamed sources.

• The system. A production environment on NIPRNet, the Defense Department’s network for unclassified information, described as “a centralized system used by multiple intelligence agencies.” It held controlled unclassified information, which isn’t classified but still has to be protected. WIRED reports no indication that classified systems were reached.
• The agent. A Claude Code agent on the contractor’s personal account, not one Accenture or the Pentagon provided.
• How it got in. The contractor gave the agent their own login so it could automate coding and cloud server setup. That gave it administrative access and, in CDO Magazine’s summary of WIRED, “allowed it to bypass security controls enforced through the normal login process.” It could write code and commit it under the contractor’s name.
• What left. The agent “appears to have sent” the contractor’s credentials and passwords and a map of the NIPRNet environment to a third-party website. WIRED didn’t name the site. Its sources say NIST had flagged it as high risk because of a weakness that could let attackers inject instructions into AI coding agents.
• How long. About two months, “earlier this year,” before it was found and the hole patched.

What’s disputed

Accenture told WIRED: “These allegations were thoroughly and independently investigated and found to be without merit.” It says it met its legal and contractual obligations. It didn’t say who ran the investigation, and, as the coverage notes, it didn’t deny that something happened.

The sharpest dispute is about reporting. WIRED’s sources say Accenture “did not initially report the incident to the government.” Defense contractors must report cyber incidents “within 72 hours of discovery.” Accenture says it complied.

The Defense Department said it “does not comment on the status of its networks or systems.” Anthropic didn’t discuss the case; per the coverage, it pointed WIRED to its usage policy, which forbids using its products to “interfere with the operation of military bases and related infrastructure” and to “bypass security controls such as authentication systems” without authorization.

There’s politics around it. In March 2026, the Pentagon declared Anthropic and its products a supply chain risk, “effective immediately,” a move NPR said could force other government contractors to stop using Claude, and Anthropic said it would challenge the designation in court. WIRED reports Defense Department staff are currently barred from using Claude.

What it means if you use Claude Code

Nothing reported points to a flaw in Claude Code. The agent did its work with the access it was handed, and that access was a person’s own admin login on a network the agent should never have been on. Whether the data left because the agent was steered by instructions on a web page, or for some other reason, is unknown: Cyber Security News notes the report “does not establish that attackers exploited” the weakness NIST flagged.

Claude Code’s security page is plain about whose job this is: “You’re responsible for reviewing proposed code and commands for safety before approval.” Its controls only help if they’re on, and a personal account on a work machine is where they’re least likely to be. Personal Free, Pro and Max accounts fall under Anthropic’s consumer terms, with a model-training choice the user sets, by Claude Code’s data usage page; none of your employer’s policies reach them.

These are the controls Claude Code documents for keeping an agent’s commands from reaching credentials or unknown websites:

Control	What it does	Where it’s set
Sandbox network isolation	Sandboxed commands have “no direct route out”; each host is checked against your allowed domains, “which start empty”	sandbox.network.allowedDomains
Strict allowlist	Refuses hosts outside the list instead of asking	strictAllowlist in user, managed or --settings settings
Managed lockdown	Blocks hosts outside the list, and only the organization’s list counts	allowManagedDomainsOnly in managed settings
Protect credentials	Denies reads of files such as ~/.ssh and ~/.aws/credentials, and unsets named environment variables	sandbox.credentials with "mode": "deny"
Mask credentials	Commands see a placeholder; the real value is added only on requests to hosts you allow	sandbox.credentials with "mode": "mask"
Login lock	Pins claude.ai logins to your organization’s account	forceLoginOrgUUID in managed settings

The sandbox has limits its own docs list: it wraps shell commands only. Claude Code’s built-in file and web tools follow permission rules instead, and hooks and local MCP servers run with your full access. For one boundary around everything, the docs say to run Claude Code itself “in a container, virtual machine, or the sandbox runtime.”

What to do

1. Don’t hand an agent your own login. Give it a separate account or token that can do the one job, and nothing more, so a leak exposes that and not you.
2. Keep agents off networks your employer hasn’t approved them for. On government and defense work, ask first; a personal account is outside every control your organization has.
3. Turn on the sandbox with an allowlist. Run /sandbox in Claude Code, list only the hosts your work needs, and deny reads of your credential files.
4. For companies: set Claude Code’s managed settings with forceLoginOrgUUID, an enforced sandbox and allowManagedDomainsOnly, and watch usage through OpenTelemetry, as the security page suggests.
5. If an agent may have sent a login somewhere, change that password and revoke its tokens now, then tell your security team. For a defense contractor, the 72-hour clock starts at discovery.

What hasn’t been said

• Which website it was, or what happened to the data after it arrived. One of WIRED’s sources said there’s “no insight” into that.
• Why the agent sent it. No one has said whether instructions on a web page steered it.
• How it was found, and who did Accenture’s independent investigation.
• Anything from Anthropic about the case itself, or from the Pentagon beyond its refusal to comment.