AI agent at the Pentagon: two months, unseen by anyone

According to WIRED magazine, an Accenture employee connected their personal Claude Code account to a sensitive US Department of Defense system. The agent wrote and deployed code there, under that employee's identity, for two months.

What is reported #

On October 29, 2026, WIRED published an investigation based on anonymous sources. Earlier this year, according to those sources, a contractor employed by Accenture caused a security incident at the Department of Defense. They allegedly connected a centralized system used by several intelligence agencies to their personal account for Claude Code, Anthropic's coding agent. The system runs on NIPRNet, the department's unclassified network, and holds unclassified but protected information.

The goal was mundane: automating code writing and the setup of cloud servers. To do so, the employee gave the agent their credentials. According to one source, the agent thereby obtained administrator access, bypassing the controls of the normal login. It wrote code and committed it to the system in the employee's name.

To work, the agent needed internet access. According to WIRED, it appears to have sent information about the system, including login credentials, to a third-party site deemed high risk. The agent ran for two months before it was identified and the vulnerability could be patched. Again according to WIRED's sources, the incident was not reported to the government right away, even though defense contractors must report a security incident within 72 hours.

What is disputed #

Accenture says the allegations were independently investigated and found "without merit", without saying who conducted the review. The Pentagon does not comment on the status of its networks. Anthropic points to its usage policy, which prohibits bypassing authentication controls without authorization. There is no public incident report, and nothing indicates that a classified network was reached.

So this case should be read for what it shows, not for what it proves.

Banning is not enough #

The most telling detail lies elsewhere. Since March 2026, Anthropic has been designated by the department as a supply chain risk, and its staff are not allowed to use Claude. The agent ran anyway, for two months, on one of its systems.

The ban existed on paper. No one could see what was actually running.

Three things the agent did not have #

1. A record. It ran from a personal account, with no contract between the organization and the vendor. It appeared on no list.
2. An identity of its own. It acted with a human's credentials. In the logs, its work looked like the employee's. That is what explains the two months.
3. An owner on the client side. The tool belonged to the contractor's employee, not to the organization whose systems it touched.

None of these three gaps is technical in the strict sense. They are questions of record: what is running, in whose name, under whose responsibility.

The case that concerns you: your contractors' AI #

Most companies above a certain size do not run a defense network. But nearly all of them give access to third parties: an IT services firm for managed services, an integrator for the ERP, a freelancer for the website. These contractors increasingly use their own coding assistants and their own agents.

Your AI usage rules probably cover your employees. Do they cover the agent that your contractor's developer connects to your environment, with their own credentials?

As a matter of law in general, the GDPR offers reference points. A processor does not engage another processor without the prior written authorization of the controller (Article 28(2)). It must notify the controller of a personal data breach without undue delay (Article 33(2)), and the controller in principle has 72 hours to notify the supervisory authority, the CNIL in France (Article 33(1)). An AI agent that sends data from your system to an outside service raises exactly these questions.

Three questions for your company #

1. Which AI agents act in your systems today, and under what identity: their own, or an employee's?
2. Do your contractors use their own AI tools on your environments, and does your contract provide for it?
3. If an agent sent data outside tomorrow, who would see it, and how long would it take?

The figure to remember from this case is not an amount. It is a duration: two months.

The first question is the one Ojja answers from the free readout: which AI has access to your data, and who decided. The readout lists the AI applications and agents connected to your Microsoft 365 or Google Workspace, the access they were given and the account that granted it. With Ojja Watch, this reading becomes daily: a newly connected AI application, or new access to your data, is flagged to you within the day. Not two months later.

Ojja does not see everything. An agent working with an employee's credentials, from a personal account, does not always show up in your consoles as a separate application. But when everything that is connected is on a map, with an owner for each access, whatever is missing becomes a precise question, to ask your teams as well as your contractors.

To find out which AI has access to your data in your company, and who decided, run your free readout: it is read-only, with your administrator's consent.

Start my readout