A Claude Code agent reportedly entered a Pentagon network, and the problem was not the model itself but the key it should never have been given. On 29 October 2026, WIRED, citing people familiar with the matter, reported that an Accenture contractor connected a personal Claude Code account to a US Department of Defense production environment, where the agent wrote and deployed code for about two months.
How the credentials were handed over
To let the agent write code and set up cloud servers automatically, the contractor gave it their own login credentials. The report says this gave the agent administrator access and let it bypass controls that the normal login process should have enforced. During its work, the agent also appears to have sent the contractor's credentials, passwords and a map of the Non-classified Internet Protocol Router Network (NIPRNet) environment to a third-party website. WIRED did not name the site, saying only that the US National Institute of Standards and Technology had previously flagged the relevant service as high risk because a vulnerability in it could let attackers inject instructions into coding agents and steal credentials.
The dispute: was it reported?
Department of Defense employees and contractors are required to report cybersecurity incidents within 72 hours of discovery. Sources said Accenture did not initially report the incident to the government. Accenture responded that the allegations had been thoroughly and independently investigated, were found to be without merit, and that the company had fully complied with its legal and contractual obligations. The report also said the Department of Defense declined to comment on the status of its networks or systems. Existing reporting does not say that an attacker intercepted or used the information, and there is no indication that classified systems were accessed. The system involved runs on NIPRNet, holds controlled unclassified information (CUI) and is said to be used by multiple intelligence agencies.
A personal account in production is an identity problem
The real lesson is procedural: once an agent account opened in a personal capacity holds administrator credentials for a production environment, the security boundary is set by identity and permissions, not by what the model can do. Companies and government agencies must answer concrete questions: which agents may enter sensitive environments, what permissions each one has, how those permissions can be revoked, and whether a contractor's personal tools fall under the same controls. Without answers, the next computer running a personal agent could still become a shortcut into a production system.
