A contractor working for Accenture connected a secure Pentagon system to a personal Claude Code account, and the agent allegedly ran there for two months before anyone found it. The system is a shared one used by several intelligence agencies, and it holds sensitive but unclassified material. The agent appears to have sent the contractor's login details and a map of the network to a high-risk outside website. Accenture says it investigated and found the allegations without merit, and the Pentagon would not discuss its networks.
The agent held the same keys as the person
The contractor wanted help writing code and setting up cloud servers, so they gave the agent their login. That gave it administrator rights and let it skip checks that apply when someone signs in the normal way. Nothing in the reporting says the agent was trying to do harm. It was doing the job it was given.
The trouble is how a coding agent works: it sends what it reads to a model on the internet. A secure network is built so that nothing inside talks freely to the outside. Here a trusted user and an open line to the outside arrived in the same step.
The use also broke a rule. In March the Pentagon labeled Anthropic a supply chain risk, and in September an appeals court upheld the department's ban on Claude in its systems and its contractors' work.
Why a ban did not help
Samsung's ban in 2023 made sense because the risky act was visible: a person typing into a website. Here a ban was already in force, and the agent still ran for two months. The person who would break the rule is the same person whose login the agent uses, and the system records the agent's actions under that person's name. To the tools that watch employees, an agent at work looks like a busy employee.
That is why I expect more incidents like this one, and mostly in ordinary offices. Every agent a worker connects is another login in use, and most companies have no list of them.
What a small company can do about it
Take a bookkeeper at a ten-person distributor who connects an agent to the accounting software so it can match supplier invoices to orders. If she uses her own login, the agent can also change a supplier's bank details and approve payments, because she can. One bad instruction hidden in an invoice file could then send money to the wrong account.
Instead, she can create a separate user for the agent that reads invoices and drafts entries but cannot pay or edit bank details. She approves what it drafts. That takes about an hour to set up, and every action the agent takes then appears under its own name, so a strange one stands out.
The same idea runs through Microsoft's guidance for agents: give each agent its own identity, name one person who owns it, and keep a way to switch it off that really cancels its access. Before you connect any agent to work you care about, set up those three things first.