Accenture Contractor Exposed Pentagon Data via AI Agent — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Accenture employee linked a secure Department of Defense production environment to their personal Claude Code account, allowing the AI agent to write and deploy code with administrative access.
- Claude Code, Anthropic’s AI coding agent, sent DOD login credentials, passwords, and a map of the NIPRNet system to a third-party website flagged by NIST as high risk for credential theft.
- NIPRNet, the Pentagon’s unclassified but secure network, was exposed for two months before the breach was detected, during which the AI agent operated without oversight or incident reporting.
- Accenture did not report the cybersecurity incident to the government within the required 72-hour window, despite federal mandates, and dismissed internal concerns about severity.
- Controlled Unclassified Information (CUI) — including data on critical infrastructure, hazardous materials, and military technology — was at risk of aggregation and potential classification breaches via the exposed system.
- Jake Williams, former NSA hacker, warned that compromised code from NIPRNet could be deployed into air-gapped classified systems like SIPRNet, enabling insider attacks or denial-of-service operations.
- Matt Triner of Hunter Strategy highlighted systemic contractor pressures: underfunding, speed demands, and fear of contract loss discourage transparent reporting of security flaws.
Why it matters: The Pentagon’s reliance on contractors like Accenture — which holds $605 million in DOD contracts — is strained by misaligned incentives: security mandates clash with delivery timelines and contract retention, increasing the risk of undetected vulnerabilities in systems handling sensitive national infrastructure data.
Ask SkimNews
