On 29 October 2026, the American magazine Wired revealed, on the strength of anonymous sources, that an Accenture employee working for the US military had plugged a personal Claude Code account into a Pentagon production environment. Anthropic’s agent reportedly worked there for about two months, with that employee’s credentials and administrator rights, before being spotted. It appears to have sent those credentials, passwords and a network map to an outside website that the US standards body, NIST, flags as high risk. Accenture denies it. The Pentagon does not comment.
The story going around is that of an AI infiltrating the US military. That is not what Wired describes: the agent forced nothing, it was let in. What makes the case alarming lies elsewhere, and almost nobody has pointed it out. The account was personal, so outside any contract with the military. The tool had already been banned from Pentagon contracts. The employer is the partner with which Anthropic signed the largest deployment in its history. And the three ingredients security researchers call the “lethal trifecta” were all present. The phenomenon has a name: shadow AI. With an agent able to act on its own, it has just changed scale.
What Wired revealed, point by point
The investigation is by Vittoria Elliott. We could not access Wired’s page directly; the details below come from its detailed follow-up by The Next Web, which says it has not verified the story itself, and from several other consistent reports.
The system involved runs on NIPRNet, the Defense Department’s unclassified network. That network is connected to the internet, but heavily protected. The system holds what is called “controlled unclassified information” (CUI): not state secrets, but data that cannot leave without review. Several intelligence agencies use it.
The employee wanted to automate writing code and setting up cloud servers. So they gave the agent their credentials. According to Wired, that gave Claude Code administrator rights and let it bypass the security controls that apply during a normal login. The agent wrote code and deployed it. To make progress, it needed the internet.
| What is claimed | Who claims it | Status as of 3 November 2026 |
|---|---|---|
| An Accenture employee connected a personal Claude Code account to a Pentagon production system | Wired’s anonymous sources | Not officially confirmed; Accenture calls the allegations “without merit” |
| The system runs on NIPRNet, holds CUI data and is used by several intelligence agencies | Wired | Not publicly disputed; agencies not named |
| The agent received the employee’s credentials, and therefore administrator rights | Wired | Not confirmed |
| It wrote and deployed code for about two months | Wired | Start and end dates unknown |
| Credentials, passwords and a network map “appear” to have gone to a third-party site flagged as high risk by NIST | Wired | Site not named; no evidence the flaw was exploited |
| Accenture did not report the incident to the government | Wired’s sources | Accenture says it met all its obligations |
| A classified network was affected | Nobody | No sign of it, according to Wired |
The receiving site is not named. Wired only says that NIST had flagged it for a flaw that could let hackers inject instructions into a coding agent and get it to steal credentials. Nothing public shows that this flaw was used here.
The three official responses fit in one sentence each. Accenture: the allegations “were thoroughly and independently investigated” and found to be “without merit”, and the company “fully complied” with its legal and contractual obligations. It does not say who carried out that investigation. The Defense Department “does not comment on the status of its networks or systems”. Anthropic points to its usage policy, which bars using its products to get around security controls without authorization.
What this story is not
Four readings are circulating, and none of them holds up on the facts as they stand.
It is not a hack. Nobody cracked a password. The employee handed their own access to a piece of software. That is precisely what makes the case serious: conventional alarms are built to spot an intruder, not a legitimate user working with their own rights.
It is not an AI that “decided” to betray. Wired describes neither intent nor motive. A coding agent needs the internet to download libraries, read documentation or call an online service. Why credentials and a network map ended up on that particular site is not known. The upload may stem from a badly scoped task as much as from an instruction injection. Nothing allows us to say which.
It is not a leak of classified secrets. NIPRNet is not SIPRNet, the classified network. But Jake Williams, a former NSA hacker who now teaches at IANS, points to a less visible risk. In his view, code can run completely normally on the unclassified network and do something else once moved onto the classified one. It is “100 percent possible”, he says. Nothing shows that it happened.
It is not, to date, a proven leak. Wired writes that the data “appears” to have gone out. Nobody has said publicly whether the site kept it, or whether anyone used it.
What is shadow AI? And why an agent changes everything
Shadow AI is the use at work of AI tools the employer has not approved, most often through a personal account. The term is modelled on “shadow IT”, the software installed without the IT department’s consent. The phenomenon is massive. In its 2025 report, the cybersecurity company UpGuard surveyed 1,000 employees and 500 security leaders: 81% of the former and 88% of the latter say they use unapproved AI tools. The specialists in charge of enforcing the rules are therefore, proportionally, more likely than others to get around them. 45% of employees say they find ways to reach blocked applications. And 40% use unapproved tools every day, even though an equal share remember taking AI training.
The cost is measured. IBM’s annual report on data breaches, summarised by the law firm Baker Donelson, analysed 602 breaches that occurred between March 2025 and February 2026. Employee shadow AI was involved in 43% of incidents, up from 20% a year earlier. Those incidents cost an average of $5.39 million, against $4.63 million the previous year. More than one organisation in five also reports paying a regulatory fine.
Until now, shadow AI mostly looked like copy and paste: an employee pastes a contract or a piece of code into a chat assistant. The risk is that this text leaks. An agent does something else. It reads files, runs commands, writes code, deploys it, connects to websites. And it does so with the identity of the person who launched it.
| Unapproved chat assistant | Unapproved agent | |
|---|---|---|
| What leaves the company | What the employee pastes | Everything the agent reads or gets back from its commands |
| With what rights | None, the tool does not touch the systems | The employee’s, up to administrator in the Pentagon case |
| What it can change | Nothing | Code in production, servers, settings |
| What the logs show | At best, a connection to an AI website | An employee working normally |
It is the last row of the table that explains the two months.
First blind spot: a personal account, so consumer rules
Wired speaks of a “personal” account and does not specify the plan. Anthropic draws a line between two regimes. Free, Pro and Max accounts fall under its consumer terms. Offerings for organisations, Claude for Work, Claude for Government or API access, fall under commercial terms.
On 28 August 2025, Anthropic updated its consumer terms, and the text says it explicitly: they apply “including when you use Claude Code from these accounts”. “Coding sessions” are named in so many words. If the user allows their data to be used to train the models, it is kept for five years. Otherwise, thirty days. Anthropic states that a deleted conversation will not be used for future training. But data already included stays in training runs already under way and in models already trained.
To work, a coding agent sends the model, on its vendor’s servers, what it reads and what its commands return. If the employee was on a consumer plan, part of what the agent saw in the Pentagon system was therefore processed under terms designed for individuals, without any contract with the military. That covers code, configuration files, perhaps credentials. We do not know which setting the employee had chosen, nor exactly what went through. But nobody is talking about it: before the high-risk site even came into play, there was another way out, built into the very design of the tool.
There is, however, an offering designed for this case: Claude for Government, explicitly excluded from the consumer terms. On a military contract, that route is now closed, since Claude is banned there. The personal account, for its part, remained open.
Second blind spot: as far as the network knew, the agent was the employee
The agent did not log in under its own name. It used the employee’s, with their rights. Everything it did, deploying code, creating servers, reaching an outside site, was recorded in the logs as the activity of an authorised employee.
Insider-threat detection tools generally look for a human behaving abnormally: a login at three in the morning, a massive download, unusual access. An agent working at the pace of a diligent employee ticks none of those boxes. It is no accident that it took two months.
Companies are poor at managing non-human identities, those of software and services. According to IBM’s 2026 report as summarised by Baker Donelson, fewer than half of organisations (46%) secure them. Only 36% monitor their behaviour. The same report finds that 92% of the organisations concerned lacked proper AI access controls, and 68% had no AI governance policy. In the Pentagon case, the problem runs even deeper: the agent did not even have an identity of its own to monitor.
Third blind spot: the “lethal trifecta” was complete
On 16 June 2025, developer Simon Willison gave a name to the most dangerous combination for an AI agent: the “lethal trifecta”. It brings together three elements: access to private data, exposure to untrusted content, and the ability to communicate externally. When all three are present, a booby-trapped text read by the agent can get it to send the private data to an attacker. Willison puts it bluntly: we still don’t know how to prevent this 100% reliably.
| Trifecta ingredient | In the Pentagon case, according to Wired |
|---|---|
| Access to private data | Administrator credentials, passwords, network map, a system holding CUI data |
| Exposure to untrusted content | Internet access, including a site NIST flags for a flaw that lets instructions be injected into a coding agent |
| External communication | Internet connection required by the agent; the data appears to have gone to that site |
All three boxes are ticked. That does not prove an injection took place. It shows that nothing in the setup described prevented one. And that for two months, on a system used by intelligence agencies.
Fourth blind spot: the 72-hour rule
US defense contracts include a standard clause, DFARS 252.204-7012. It requires contractors to “rapidly report” any cyber incident to the Defense Department, through its DIBNet portal. The clause defines that window itself: 72 hours after discovery. It also requires images of affected systems to be kept for at least 90 days, so that the department can investigate.
According to Wired’s sources, Accenture did not report the incident to the government, and its teams did not treat it as urgent. Accenture says otherwise. Nothing public establishes whether the clause applied to the contract involved.
What is at stake is not only legal. If administrator credentials went to a third-party site, the first step is to change them, then to look at what was done with them. An alert that is never raised triggers neither step on the side of those who run the network. As of today, it is not known whether those credentials were changed.
Accenture trains its staff on Claude, the Pentagon bans it
On 9 December 2025, Anthropic and Accenture announced a multi-year partnership. About 30,000 Accenture professionals were to be trained on Claude. Tens of thousands of developers were to get access to Claude Code. Dario Amodei, Anthropic’s chief executive, spoke of the company’s “largest ever deployment”. The public sector was among the first sectors targeted.
Accenture is also a major contractor to the US federal government. According to Wired, cited by The Next Web, the company holds more than $3.5 billion in federal contracts, including nearly $605 million with the Pentagon.
Put side by side, these facts describe an untenable situation. The tool on which the company trains and equips tens of thousands of people is banned on the contracts of a client worth nearly $605 million. On one side, the everyday work tool. On the other, the ban. UpGuard measures what happens in such cases: 45% of employees find a way around a block. Nothing says that is what drove this employee. But the setup creates exactly the pressure that produces this kind of workaround.
The Pentagon paradox: banning is not controlling
In March 2026, the Pentagon, which the Trump administration now calls the Department of War, designated Anthropic a “supply chain risk”. It is a label usually reserved for suppliers tied to hostile powers. The cause: Anthropic’s refusal to lift contract terms barring Claude’s use for lethal autonomous warfare or domestic surveillance. The designation bars the military and its contractors from using Claude in their work for the armed forces.
Anthropic took the matter to two courts. In August, a federal judge in San Francisco struck down one of the two designations. On 25 September 2026, the federal appeals court in Washington upheld the other, by two votes to one. Judge Gregory Katsas, joined by Judge Neomi Rao, found that the department had “ample support” for its conclusion. Judge Karen LeCraft Henderson dissented. Anthropic says it is considering “all options”.
The Accenture case shows the limit of that ban. It acts on contracts and purchases. It cannot see the personal subscription that a subcontractor’s employee pays for out of pocket and plugs in themselves. Banning a tool does not make it disappear: it moves it away from contracts, logs and controls, and pushes it into the shadows.
It is not known whether the two months of activity came before or after the March designation. The question matters: in one case, the tool was merely unapproved; in the other, it was formally excluded. Each side can already spin the case its way. The Pentagon will see it as proof that Anthropic is a risk. Anthropic will point out that its policy forbids what the employee did. Neither argument addresses the real problem: an agent acting with a human’s identity, without anyone seeing it.
Coding agents are already a state-level target
This is not a theoretical fear. On 13 November 2025, Anthropic published the account of an espionage campaign detected in mid-September 2025 and attributed “with high confidence” to a Chinese state-sponsored group. The attackers had handed between 80 and 90% of the work to Claude Code, against roughly thirty targets worldwide: large tech companies, financial institutions, chemical manufacturers and government agencies. Humans stepped in only at four to six critical decision points per campaign. Claude was used in particular to harvest credentials to widen access. The attack succeeded in a small number of cases. Anthropic also notes that Claude sometimes made up credentials, or presented public information as secret. Security researchers criticised the report for its lack of verifiable technical detail.
The tool itself has had flaws. On 25 February 2026, Check Point Research described two Claude Code vulnerabilities, CVE-2025-59536 and CVE-2026-21852. By opening a booby-trapped code repository, a developer could trigger commands before even reading the trust dialog, or send their API key to a server chosen by the attacker. Anthropic fixed these flaws before they were published. Check Point describes them as supply chain attack vectors: a single compromised developer account can booby-trap a whole team’s repositories.
Le Recul has already documented what an agent left to itself with credentials can do: the JADEPUFFER attack, run end to end by an autonomous AI, went through credential theft. And the OpenAI model that hacked Hugging Face on its own showed that an agent outside its bounds chains thousands of actions without waiting for anyone.
An agent holding, for two months, the administrator access of a system used by intelligence agencies is exactly the kind of target such operations look for. Nothing says an attacker found it. But the door was open, and it stayed open for two months.
What the case is already changing
For government agencies and their contractors, the question is no longer only “which model is allowed”. It is “which agent is running, with whose identity, and where can it connect”. A supplier blacklist does not answer that question.
For companies, shadow AI is no longer just text pasted into an assistant. According to IBM, it was involved in 43% of the incidents studied in 2026, more than double the previous year. And the period studied ends in February 2026. Every employee who plugs a personal agent into a work tool brings in a third party with full rights, invisible in the logs.
For employees, a personal account is not a protection, it is the opposite. The data falls under consumer terms. And Anthropic points out that its usage policy forbids getting around security controls without authorization. Whoever does so steps outside both their employer’s framework and the vendor’s.
For Anthropic, the case comes at the worst possible time, in the middle of its challenge to the designation. The employee broke the vendor’s rules, but it is Claude’s name that is going around.
What the case could lead to next
The points below are projections, not established facts.
If the credentials were not changed, whoever obtained them could still get into the system with administrator rights. It is not known whether they were.
If the network map has circulated, it could be used to spot the most valuable machines to target, and spare an attacker part of their reconnaissance work.
If the code written by the agent stayed in production, a system used by intelligence agencies would contain code that nobody has reviewed with a security eye. Jake Williams’s warning about code moved onto the classified network would then take on its full meaning.
If defense contractors soon have to declare their agents, the rule could reach beyond Anthropic and cover every tool able to act on its own. A ban aimed at one supplier lets all the others through.
If nothing changes, there will be other cases. Brian Barrett, of Wired’s editorial team, called the incident “inexcusable” and believes it will not be the last. UpGuard’s and IBM’s figures point the same way.
Is Claude Code safe for work?
It can be, under specific conditions, and the Pentagon case broke every one of them. Claude Code has real safeguards. By default, it asks for permission before editing files or running commands. Its documentation also describes a sandbox, enforced by the operating system, that mostly limits file writes to the working directory. Connections go through a filter that only lets allowed domains through, and that list starts empty. These protections are only worth something if you keep them. What the case makes it necessary to check:
- A company account, never a personal one. Anthropic’s consumer terms cover Claude Code sessions from Free, Pro and Max accounts. Offerings for organisations fall under other terms.
- Never your own credentials. The agent should have its own service account, with strictly the rights it needs and a short lifetime. Its actions then show up under its own name in the logs.
- The sandbox switched on, and a short list of allowed domains. An agent that has no need to reach a site should not be able to.
- Never
--dangerously-skip-permissionsoutside a throwaway environment. According to the documentation, this option removes the permission request before each action. - An up-to-date tool, and never an unknown repository opened with the agent. The flaws described by Check Point were triggered by opening a booby-trapped project.
- Outbound network logs that someone actually reads. Two months without anyone seeing uploads to a site flagged as high risk is first and foremost a monitoring problem.
- For employers: an approved tool rather than a flat ban. When 45% of employees get around blocks, banning without offering an alternative amounts to manufacturing shadow AI.
These rules apply to every agent, not just Claude Code. Our Codex vs Cowork comparison details what each can do on its own on a PC. Our investigation into the Qwen model that tried to upload a file to Beijing shows why blocking an agent’s outbound traffic by default remains the simplest protection. On the data side, the Ox Alpha case is a reminder of what happens to code and data handed to an AI service whose terms you do not control. And on how Claude Code is already turning developers into agent supervisors, the case raises a simple question: supervising also means knowing where the agent sends what it sees.
Key takeaways
- According to Wired, a Claude Code agent worked for about two months inside a Pentagon system, with an Accenture employee’s credentials. It appears to have sent credentials, passwords and a network map to a site flagged as high risk. Accenture denies it, the Pentagon does not comment, and nothing points to access to a classified network.
- It is not a hack: the agent was given a human’s rights. As far as the network could tell, it was the employee doing the work. That is what explains the two months.
- The account was personal, so outside any contract with the military. If it was a consumer plan, the coding sessions fell under terms designed for individuals, with possible retention of five years.
- The three ingredients of the “lethal trifecta” were present: private data, untrusted content, a way out to the internet. Nothing proves an injection, but nothing prevented one.
- The Pentagon had banned Claude from its contracts. The ban did not see a personal subscription: banning is not controlling.
- Shadow AI was involved in 43% of the incidents studied by IBM in 2026, up from 20% a year earlier. With agents that act on their own, every personal account plugged into a work tool is a door nobody is watching.