Personal AI Agent Operated on Pentagon's Security Network for Two Months

A contract employee at the U.S. Department of Defense connected his personal artificial intelligence agent to the Pentagon's security system, and that agent leaked system information and login credentials externally. This is an incident reported by U.S. IT media Wired on the 31st of last month (local time) citing multiple sources. The employee in question was from global consulting firm Accenture and connected his personal "Claude Code" (Anthropic's AI coding agent) account to a centralized security system used by multiple intelligence agencies. The purpose was to have the code written and deployed by the agent instead.

The weight of information that was exposed is not trivial. According to Wired, the system contained Controlled Unclassified Information (CUI) requiring pre-release review, including nuclear submarine propulsion, critical infrastructure, and chemical and biological terrorism vulnerabilities. One source aware of the incident stated, "All the data in there was at risk" and "If third-party software was compromised, someone outside might be able to log into the security environment without anyone knowing. This is a 100% national security threat and could cause irreversible damage."

What is even more painful is the timeline. This agent operated on the Defense Department's network for two months before being detected. Pentagon employees and federal contractors are obligated to report cyber incidents within 72 hours, but sources said Accenture did not initially report the incident to the government at all. Accenture countered Wired by stating, "The allegations were thoroughly and independently investigated and found to be without merit," but did not disclose who conducted the investigation and did not deny that something noteworthy had occurred. The Pentagon only stated, "We do not comment on network and system status."

The regulations already existed. Pentagon employees' use of Claude was prohibited, and Anthropic's usage policy also prohibits use that bypasses authentication systems and security controls without authorization. What was breached was not the model but people and systems. An employee who connected a personal account to a classified system, and a surveillance system that failed to detect that connection for two months. It is a familiar structure. If the starting point of the Binance incident, recorded as the largest cryptocurrency hack in history, was a single employee's laptop, the starting point of this incident was a single AI agent brought in by an employee. The weakest link is shifting from people to the agents people have brought in.

By nature, AI agents read credentials, execute code, and communicate with external systems. This means that even without being hacked, the design itself could become a data leak pathway. The practical guidelines recommended by the security industry are summarized into three points. First, do not attach personal accounts to agents. A work-isolated account should be created with only the minimum necessary permissions granted. Second, block credential access. Passwords and keys should be kept in a secrets management tool so agents cannot read them in plain text. Third, constantly audit agent activity logs and restrict external communications to an allowlist. This publication, which produces articles using AI agents, also operates its system on the premise of isolated accounts and privilege separation.

Invitation, rather than intrusion, has become the new threat. The questions about security are also changing. Not "who broke in?" but "what have I let in?" The Pentagon's two months is the measure of time that did not answer that question.