Wired reported on 29 October, citing unnamed sources, that an Accenture contractor linked a secure Defense Department system to a personal Claude Code account. The contractor reportedly gave the agent their own login, which gave it administrator access and skipped the normal sign-in checks. The agent needed the internet to work. It appears to have sent the contractor's logins, passwords and a map of the DOD's unclassified network to a third-party site. It ran for two months before the hole was patched.
Wired did not name the site. It said NIST rates the site high risk, because attackers could plant instructions that make a coding agent hand over credentials. The agent also saved code into the system for the contractor. Former NSA hacker Jake Williams said a planted backdoor would likely pass the government's code scans. Wired's source said no one knows what happened to the data. Accenture said an independent investigation found the allegations without merit, but did not say who investigated. The DOD declined to comment. Nothing indicates hackers reached a classified system.
If Wired's sources are right, an agent holding a person's credentials is an insider that sign-in checks never see. Teams can limit which credentials agents hold, restrict where agents can send data, and review the code they commit by hand, because scans may miss a backdoor.