Claude agent ran on Pentagon network for months

An Accenture employee's personal Claude agent operated inside a Department of Defense network for about two months before it was discovered and the underlying vulnerability was addressed, according to WIRED. The incident involved a defense contractor giving a personal AI agent access to a secure Pentagon system, according to sources. While details about exactly what the agent could reach and what data it processed remain limited, the episode has drawn attention to a fast-growing security problem: personal AI tools can be connected to powerful systems with little centralized oversight. The event is notable less because of a specific breach and more because of what it reveals about visibility. AI agents are designed to take actions, retrieve information and work across applications. Those capabilities are useful in ordinary office settings, but they become risky in classified or sensitive environments where access controls and audit trails are supposed to be strict. A personal agent introduced by an individual employee can potentially bypass assumptions about which software is approved, what it is allowed to do and who is watching it. It also highlights the difficulty of detecting unauthorized agent activity. Unlike a conventional application installed on a laptop, an AI agent may interact with multiple services, generate requests that look routine and operate intermittently. Security teams need new methods for inventorying agents, monitoring their behavior and tying their actions back to a responsible human. Patching one vulnerability after discovery is necessary, but it does not solve the broader governance gap. The Pentagon incident will likely intensify scrutiny of how AI tools are procured and deployed across government and defense contractors. It may push agencies to require explicit approval for AI agents, stronger segmentation between personal and mission systems, and continuous logging of agent actions. For companies building AI products, the lesson is that safety and security cannot stop at the model layer. The surrounding permissions, integrations and deployment practices matter just as much, especially when consumer-style tools are used in high-stakes settings.