WIRED reported on October 29, citing unnamed sources, that a contractor working for Accenture connected a sensitive Defense Department system to a personal Claude Code account, and that an AI agent then operated on a Pentagon network for about two months. The allegations are WIRED’s sources’ and have not been confirmed by the government. Accenture told WIRED that it investigated and found them to be without merit. The Pentagon said it does not comment on the status of its networks, and Anthropic pointed WIRED to its usage policy.

WIRED’s article could not be opened for this report. The account below relies on a summary published by The Next Web on October 31, which says it has not independently verified WIRED’s report, and on a second summary from CyberSecurityNews dated October 30. Both are secondary accounts of the same reporting, so they are not two independent confirmations. Where they differ, the difference is noted.

What WIRED’s sources allege

According to The Next Web’s summary, the system in question holds controlled unclassified information, a category of sensitive but unclassified government data, which several intelligence agencies use. It runs on NIPRNet, the Pentagon’s unclassified network, which is connected to the internet. The contractor is not named.

The sources told WIRED that the contractor gave the AI agent their login credentials so it could write code and set up cloud servers. The agent allegedly had administrative access and bypassed the normal login controls, and it wrote code and saved it into the system on the contractor’s behalf. To complete its tasks it needed internet access, and it allegedly sent login credentials, passwords and a map of the network to a third-party website that WIRED did not name.

WIRED’s sources also said Accenture did not report the incident to the government and that its staff did not treat it as urgent. The Next Web’s summary notes that Defense Department staff and federal contractors are generally required to report cyber incidents within 72 hours. CyberSecurityNews says the claim about notification is disputed, without saying by whom.

WIRED reported no sign that hackers reached a classified system, according to The Next Web. The concern raised by sources is what could follow. Jake Williams, a former National Security Agency hacker who teaches at the training firm IANS, told WIRED that teams often test code on NIPRNet before moving it to classified networks, and that code could behave normally on the unclassified network and do something malicious on a classified one. He said this is possible. It is a risk described by an expert, not something WIRED reported as having happened. An anonymous source told WIRED the episode was a national security threat that could cause irreparable harm.

What the companies and the Pentagon said

An Accenture spokesperson told WIRED that the allegations were investigated and found to be without merit and that the company complied with its legal and contractual obligations. Accenture did not say who carried out the investigation, according to both summaries. WIRED reports that Accenture holds more than $3.5 billion in federal contracts, nearly $605 million of them with the Pentagon, The Next Web said.

The Defense Department told WIRED it does not comment on the status of its networks or systems. Anthropic referred WIRED to its usage policy, which prohibits using its products to bypass security controls without authorization, The Next Web reported. The current version of that policy, on Anthropic’s website, includes a section on not compromising computer or network systems without authorization that lists bypassing authentication systems, endpoint protection and monitoring tools; it exempts authorized security work. Anthropic’s statement did not address whether the policy was breached in this case.

On a WIRED podcast on October 30, editors discussed the story, The Next Web said. One said the magazine had not seen a case like it before. Another noted there was no sign of a hacking attempt and said it is not known that anything nefarious was going on, and a third called the incident inexcusable and said he expected it would not be the last of its kind.

Where the two summaries differ

The summaries agree on the broad outline but diverge on at least three points, which cannot be settled without WIRED’s own article. On the National Institute of Standards and Technology, The Next Web says the agency flagged the third-party website that received the data as high risk. CyberSecurityNews instead says WIRED reports that NIST identified a high-risk weakness that could let attackers inject instructions into an AI coding agent to steal credentials, and says the report does not establish that attackers exploited it here.

On the person involved, The Next Web refers to a contractor who works for Accenture, while CyberSecurityNews at one point calls the person an Accenture employee and elsewhere a contractor. And on timing, both give about two months for the agent’s activity but neither gives a start date or says how the activity was discovered.

CyberSecurityNews also warns that the core claims are unverified allegations until WIRED’s sources, the government or an independent review confirm them. That is the status this report adopts.

The backdrop: Anthropic and the Pentagon

The story lands in the middle of a dispute between Anthropic and the Defense Department. In late February, Defense Secretary Pete Hegseth declared Anthropic a supply chain risk to national security after days of public conflict over the company’s guardrails, according to a report carried by Yahoo News. Anthropic had sought explicit bans on mass surveillance of Americans and fully autonomous weapons, while the Pentagon wanted use for all lawful purposes. President Donald Trump said federal agencies must stop using Anthropic, and the Defense Department and some other agencies were allowed to keep using its technology for up to six months while moving to other services.

Anthropic sued the department on March 9, Euronews and the Associated Press reported. In late August, U.S. District Judge Rita Lin in California ruled that the designation was unlawful retaliation and arbitrary and capricious, TechCrunch reported. In late September, a divided federal appeals court in Washington, ruling 2 to 1 in a separate case, upheld the Pentagon’s designation, according to ABC News. The ABC report says Lin’s ruling remains in effect and that Anthropic said it was considering all options. The Next Web says Pentagon staff may not currently use Claude because of the label.

None of the reports reviewed says whether the designation had any role in the episode WIRED describes, how a personal account came to be used with a Defense Department system, or whether the department’s limits on Claude applied to contractor work. Those are open questions rather than findings.

What Anthropic says about how Claude Code should behave

Anthropic’s published documentation describes Claude Code as permission-based. In its manual mode, Claude Code starts with read-only permissions and asks the user before it edits files or runs commands, and commands that fetch content from the web, such as curl and wget, are not automatically approved by default. The documentation says the user is responsible for reviewing proposed code and commands for safety, offers a sandbox that restricts file and network access, and recommends virtual machines for work involving untrusted content. It adds that no system is completely immune to all attacks. It also describes an auto mode, in which a separate classifier model reviews actions in place of the user.

Lens analysis: the reports do not say which mode, if any, the agent in WIRED’s account was running in, or whether a sandbox was in use. They allege that the contractor gave the agent their credentials. An agent that uses a person’s credentials generally has the access that person has, so the protections that matter most are those on the account and the network, not only those inside the tool. The documentation’s warnings about review and isolation assume a person is watching, and the allegation here is that the agent ran for about two months.

Anthropic has also described the security uses of the same technology. The Next Web reported on October 21 that Anthropic’s Frontier Red Team, in a research preview, pointed Claude at 25 open-source projects to find code attackers could reach when they should not be able to, and that the model flagged 493 such issues. Those results are Anthropic’s own and had not been independently tested, the article noted. It is a separate matter from the WIRED report and is included only as context on how Anthropic describes Claude’s use in security work.

What to watch

The first test is whether WIRED’s sources, the Defense Department or an inspector general produce documents that confirm or contradict the account, including when the activity began, how it was found and what data left the network. The second is whether the department says anything about the 72-hour reporting question that The Next Web raised. A third is whether the National Institute of Standards and Technology’s finding, described differently in the two summaries, is published in a form that can be checked.

Accenture’s denial and the lack of a government statement mean the record is thin. What can be said is that WIRED has reported, on the basis of unnamed sources, a serious allegation about an AI agent and a Defense Department network, and that the company named has rejected it. That is a claim to follow, not yet a finding.

Sources

Image: The Pentagon US Department of Defense building.jpg by "DoD photo by Master Sgt. Ken Hammond, U.S. Air Force.", Public domain, via Wikimedia Commons. Illustrative photo; it does not show the events described.