Rogue AI Agent on US DoD Network

The system operated on the Non-classified Internet Protocol Router Network (NIPRNet), a DoD network used for unclassified information and contained controlled unclassified information (CUI).

According to the report, the agent ran on the DoD network for about two months before the issue was identified and the vulnerability could be patched. During that period, it appears to have sent the contractor’s credentials, passwords and a map of the NIPRNet environment to a third-party website that the National Institute of Standards and Technology had previously identified as high risk because of a vulnerability that could let attackers inject instructions into AI coding agents.

To automate coding and cloud-server tasks, the contractor gave the agent their login credentials. That gave it administrative access and allowed it to bypass security controls enforced through the normal login process.

The defense contractor involved, Accenture, so far denies the allegations.

Assessment

Any assessment at this stage must be qualified by the fact that so far, the accused party, Accenture, has denied the allegations.

The core of the problem this time appears to be that US Department of Defense has officially declared Claude Code a supply-chain risk, rather than that the agent did anything harmful. This also means that when the contractor allegedly introduced the Claude agent onto the system it would communicate with Antrophic’s servers, which in itself would represent a security violation.

The fact that the network in question didn’t contain any classified information doesn’t mean that there was no security incident. Non-classified information can still be deemed sensitive and subject to rules for dissemination.

The contractor in question also appears to have held a high-trust administration account that allowed him to introduce the agent. This may also help explain why it took so long for the incident to be discovered.

Regardless of whether this incident happened exactly as initially reported or not, the most important takeaway from this incident is the security risks involved in widespread use of “Shadow AI”. Undocumented use of AI agents in environments. Introducing AI agents should have the same strict policies and vetting as any other software application introduced.

References

[1] https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/
[2] https://www.cnbc.com/2026/09/25/pentagon-anthropic-ai-risk-appeals-court.html