Accenture employee allegedly gave an AI agent access to a secure DOD environment
According to sources cited by WIRED, an Accenture employee connected a personal Claude account to a DOD production environment containing sensitive information. The agent reportedly operated there for two months. Accenture says the allegations are unfounded.
According to sources cited by WIRED, an Accenture employee connected a personal Claude account to a secure DOD production environment so that an AI agent could write and deploy code. The environment operates on NIPRNet and contains CUI, meaning sensitive unclassified information whose disclosure is controlled.
According to a source, the employee gave the agent their login credentials, granting it administrator access and allowing it to bypass standard login controls. The agent reportedly operated on the network for two months before the vulnerability was discovered and fixed. According to the account in WIRED, it appears to have sent login credentials, passwords and a map of NIPRNet to an external service. The available information does not establish whether anyone misused this data.
Sources cited by WIRED also claim that Accenture initially failed to report the incident to the government, even though, according to the article, DOD employees and federal contractors are required to report cyber incidents within 72 hours of discovery. Accenture said an independent investigation found the allegations to be unfounded and that it had met all its legal and contractual obligations. It did not specify who conducted the investigation. A DOD representative declined to comment on the state of the networks and systems.
Why it matters
If the reported actions are confirmed, an external AI agent gained the ability to make changes to a production environment containing sensitive information through an employee's permissions. For operators of such systems, key considerations include the scope of agent access, controls on data transfers to external services and compliance with incident reporting deadlines.
Relevant practical impact
What this means
For a business
For contractors working in the DOD environment, the allegations concern both the protection of privileged access and compliance with the requirement to report cyber incidents within 72 hours. Claims by sources that the incident went unreported conflict with the statement from Accenture that it met all its obligations.
Risks and complianceCheck the original
Event sources
only one source so far · 1 publisher, 1 independent. We count feeds from the same owner only once.