The Unvetted AI Agent Inside a Pentagon System
An AI agent ran inside a secure Pentagon system for two months before anyone noticed. It worked through a contractor’s login and reached sensitive defense data. The contractor was vetted. The agent was not. Here is what broke, and why.
The Contractor Was Vetted. The Agent Was Not.
An Accenture contractor connected a personal Claude Code account to a secure Defense Department system used by multiple intelligence agencies, and the agent ran there for two months before anyone identified it.
Why it matters
The agent worked through the contractor's access, on a personal account, and no one identified it for two months. The system holds controlled unclassified information, a category that includes naval nuclear propulsion and critical infrastructure security data. WIRED's sources say Accenture staff did not treat the incident as urgent.
By the numbers
2 months - how long the contractor's agent ran on the Defense Department system before anyone identified it.
More than 20% - organizations that reported a breach targeting AI models or applications.
27% - of those breaches traced to compromised APIs, applications, or plug-ins, tied for the most common cause.
18% - organizations that apply AI agents to vulnerability management.
Catch up quick
The old playbook vetted the company, checked the person, and trusted whatever that person touched. An AI agent working under that person's login falls outside that model. The "What is Shadow AI?" brief tracked this gap inside enterprises. This incident moves it inside a defense network.
Between the lines
CMMC certifies the security of contractors' own systems. This agent ran inside a Defense Department system through a contractor's personal account, and the Pentagon's own controls did not flag it for two months. It fell between both sets of checks. Meanwhile, the third-party certification step due November 10, 2026 is suspended.
What to watch
The Pentagon's CMMC task force delivered its recommendations in September. They remain unpublished, and no new date for third-party certification exists. The signal is whether the reformed rules name AI agents directly or leave agent access inside general access control requirements.
Three questions every agency and defense contractor should answer:
Can the organization list every AI agent holding credentials to its systems, including agents on personal accounts?
Does access review treat an agent as a separate identity from the person who connected it?
Who owns the decision to revoke an agent's access, and how fast can that person act?
The bottom line
This incident did not begin with an attacker. It began with an access model that trusts the person and ignores the software acting for them. Vetting the contractor no longer vets the access.
Works Cited
Department of War. “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements.” Office of Industrial Base Growth, 13 July 2026, business.defense.gov/Engage/News/Article/4542563/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/.
Elliott, Vittoria. “A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System.” WIRED, 29 Oct. 2026, www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/.
“IBM Study: One in Four Malicious Breaches Are AI-Enabled, Costing Companies $6 Million on Average.” IBM Newsroom, 29 July 2026, newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average.
National Archives and Records Administration. “CUI Category Marking List.” CUI Registry, www.archives.gov/cui/registry/category-marking-list.html. Accessed 30 Oct. 2026.
Related briefs
- Only 18% of Financial Firms Say They Own Their AI — Only 18% of financial firms say they own their AI, while regulators are twice as likely to say they do. After the FCA flagged firms trusting untested vendor promises, banks face a hard question: who owns a decision nobody can explain?
- Enterprise Risk Intel: 50% of Tested AI Fails in Production — In a survey of 157 enterprise leaders, 50% deployed an AI agent or feature that cleared internal evaluations, only to fail in front of a customer. Static testing evaluates AI tools in isolation, creating a dangerous false sense of readiness. Read why evaluating the tool and its operating environment together is essential for establishing production trust.
- Policy vs. Practice — 98% of surveyed senior AI decision-makers say their organization has formal AI governance policies. 47% say theirs has bypassed the process for urgent deployments. Here is what that means for enterprise buyers.