正文 · AI 翻译
On October 30 Beijing time, Wired reported that an Accenture contractor employee was accused of connecting a personal Claude Code account to a secure US Department of Defense system, allowing an AI agent to write and deploy code on the employee's behalf. People familiar with the matter said the agent ran on the department's network for two months before it was discovered and, during that time, apparently sent login credentials, passwords and information about the network's structure to a third-party website that posed a security risk.
Accenture denied the allegations. A company spokesperson said the claims had been thoroughly and independently investigated, found to be without merit, and that the company had fully met its legal and contractual obligations. Wired said Accenture did not specify who conducted the investigation. A Department of Defense spokesperson said the department does not comment on the status of its networks or systems.
According to the report, the employee connected to a centralized system used by multiple intelligence agencies that contained “controlled unclassified information,” or CUI. Although this information is not classified, it is sensitive material that must be protected and cannot be released to the public without review.
People familiar with the matter said the employee gave the Claude agent their login credentials so it could automatically write code and launch cloud servers. This gave the agent administrator access and allowed it to bypass security controls in the normal login process. It also submitted code on the employee's behalf and saved it in the system.
The problem arose as the agent connected to external tools. According to Wired, it appeared to send the employee's login credentials, passwords and information about the structure of US military networks to a third-party website. Wired did not name the website to avoid further increasing the risk to the system. The report said the US National Institute of Standards and Technology had previously flagged the site as high risk because a vulnerability could allow attackers to inject instructions into AI coding agents and steal credentials.
A source familiar with the incident said it is unclear how the information was handled after it was sent or whether the third-party service still retains it. If the service were compromised, attackers might use the credentials to enter the secure environment without being detected.
The coding environment involved ran on the Department of Defense's Non-classified Internet Protocol Router Network, or NIPRNet. The network handles unclassified information and can connect to the internet. Employees and contractors can use it to send and receive email and browse the web, but it remains subject to strict security protections.
The report presented no evidence that hackers had entered the US military's classified or top-secret systems. However, security experts interviewed for the report said the exposure of accounts, code and information about system structures in an unclassified environment could still threaten more sensitive systems.
Jake Williams, a former National Security Agency hacker and an instructor at cybersecurity consultancy IANS, explained that pieces of controlled unclassified information could, when combined, amount to information that should be classified. For example, the location of hazardous materials and weaknesses in the facilities where they are stored might each be unclassified on their own, but together could reveal more sensitive information.
The movement of code between systems is another concern raised by experts. The report said some tools and code are first tested on NIPRNet and then deployed to isolated networks used to handle classified or top-secret information. If attackers used leaked credentials to enter the testing environment, they could plant a backdoor in the code; if a review failed to detect it, the malicious code could then move with the tools into more sensitive systems. This is a potential risk raised by experts; the report did not establish that it has occurred.
Williams said static application security testing used by the government can check code for vulnerabilities, but deliberately planted backdoors might not be identified as vulnerabilities, and logical problems in the code-generation process could also escape detection. AI generates code much faster than humans, adding to the pressure on reviewers.
The discovery and reporting of the incident also drew scrutiny. People familiar with the matter told Wired that, despite the security risk, Accenture employees initially did not regard it as a serious or urgent incident, and the company did not initially report it to the government. Those accounts differ from Accenture's response concerning its investigation findings and fulfillment of its obligations.
Matt Trainer, founder of the Washington IT consultancy Hunter Strategy, said government contractors face conflicting demands. Projects must be delivered faster and at lower cost, while companies that acknowledge security incidents may risk losing contracts. He said the incident described in the report was one that needed to be reported.
According to Wired, Accenture currently holds more than $3.5 billion in US federal government contracts, nearly $605 million of which comes from the Department of Defense. The report also said Claude is currently prohibited for use by Department of Defense personnel. In its response to Wired, Anthropic cited its usage policy, which prohibits bypassing security controls such as authentication, endpoint protection or monitoring without authorization.