09:50Machine-translated from Azerbaijani by AIRead in Azerbaijani
Claim: Claude AI agent sent Pentagon network map to external site
An Accenture contractor working at the US Department of Defense allegedly connected a personal Claude Code artificial intelligence agent to the Pentagon’s protected internal network. The agent was given account credentials to access the system, write code and deploy that code on the system. Claude Code connected to the secure system and later sent sensitive information to a high-risk third-party website. Several intelligence agencies also use this network.
The network in question is NIPRNet, which carries unclassified information. The artificial intelligence agent also needed an internet connection to perform its tasks. The agent bypassed the security checks conducted during login by using the credentials it had been given. As a result, both the login credentials and a map of the NIPRNet network were sent to an external website. Other information that was not classified but had restricted distribution is also believed to have been put at risk. The agent had access to the network for 2 months. The threat was detected and eliminated only after that. At the time, Claude had been banned for department employees because Anthropic was considered a supply-chain risk. Nevertheless, the contractor allegedly used a personal account. It is also alleged that Accenture employees did not treat the matter as a serious and urgent threat after the incident came to light.
Department employees and contractors must report cybersecurity incidents within 72 hours. According to the allegation, the employee who connected the account did not comply with this rule. The leak of the login credentials has been confirmed. It was emphasized that the credentials could be used to access the network undetected. A person familiar with the incident called it a serious risk to national security. The person said such negligence was dangerous, especially amid the ongoing conflict with Iran. The US Department of Defense said it does not comment on the status of its networks and systems. The department said it takes all concerns seriously. Accenture said the allegations had been investigated thoroughly and independently and were found to be baseless. The company also emphasized that it fully complies with its legal and contractual obligations.
The network in question is NIPRNet, which carries unclassified information. The artificial intelligence agent also needed an internet connection to perform its tasks. The agent bypassed the security checks conducted during login by using the credentials it had been given. As a result, both the login credentials and a map of the NIPRNet network were sent to an external website. Other information that was not classified but had restricted distribution is also believed to have been put at risk. The agent had access to the network for 2 months. The threat was detected and eliminated only after that. At the time, Claude had been banned for department employees because Anthropic was considered a supply-chain risk. Nevertheless, the contractor allegedly used a personal account. It is also alleged that Accenture employees did not treat the matter as a serious and urgent threat after the incident came to light. Department employees and contractors must report cybersecurity incidents within 72 hours. According to the allegation, the employee who connected the account did not comply with this rule. The leak of the login credentials has been confirmed. It was emphasized that the credentials could be used to access the network undetected. A person familiar with the incident called it a serious risk to national security. The person said such negligence was dangerous, especially amid the ongoing conflict with Iran. The US Department of Defense said it does not comment on the status of its networks and systems. The department said it takes all concerns seriously. Accenture said the allegations had been investigated thoroughly and independently and were found to be baseless. The company also emphasized that it fully complies with its legal and contractual obligations.