The centralized system contains controlled unclassified information (CUI), which is considered sensitive and not to be released to the public without review. CUI can include information about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Additionally, security experts say, access to the system could allow for the exploitation of even more sensitive ones.
If the third-party software was compromised, “there could be somebody out there with the ability to log into a secure environment without anyone knowing. It’s 100 percent a national security threat and could cause irreparable harm.” A DOD spokesperson tells WIRED that “the Department does not comment on the status of its networks or systems.” “We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit.
We fully complied with our legal and contractual obligations,” an Accenture spokesperson tells WIRED. When pressed, Accenture didn’t offer clarification on who conducted the investigation, or dispute that had been what could be characterized as an incident. The Accenture employee is alleged to have connected a secure production environment to their personal Claude account so as to allow an AI agent to write and deploy code.
Claude is currently barred from being used by DOD staff. (Anthropic directed WIRED to the company’s usage policy, which instructs users not to use its products to “interfere with the operation of military bases and related infrastructure” or to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”) The Accenture employee’s AI agent ran on the DOD network for two months before it was identified and the vulnerability could be patched. Sources indicate that despite the security risks posed by the AI coding agent, Accenture employees did not treat the incident as severe or urgent. DOD employees and federal contractors are required to report any cybersecurity incident within 72 hours of its discovery, but sources indicate Accenture did not initially report the breach to the government at all.
Are you a current or former government employee who wants to talk about what's happening? We'd like to hear from you. Using a nonwork phone or computer, contact the reporters securely on Signal at velliott88.18.
Accenture currently has more than $3.5 billion in contracts with the federal government, nearly $605 million of which are with the DOD. The company also contracts with other federal agencies, such as the Department of Education, the General Services Administration, and the Department of Energy, among others. Earlier this month, the Federal Bureau of Investigation found that an Accenture contractor failed to patch a vulnerability that led to the hacking group ShinyHunters getting access to the details of thousands of the Bureau’s employees.
Extract — continue reading at the source.
