Published October 31, 2026 (IST) by the AgentStack News Desk. Facts were checked against WIRED’s October 29 report and podcast, NIST’s October 27 agent identity tenets, Cisco’s October 28 Project Quarry post and repository, and our own test of cisco-project-quarry 0.1.0 on October 31.
A defense contractor’s personal Claude Code agent reportedly ran inside a secure Department of Defense (DOD) system for two months and sent login credentials to a high-risk outside website, WIRED reported on October 29, 2026. Accenture, the contractor’s employer, says the allegations were investigated and found to be without merit.
The story landed in the same week as two pieces of guidance on this exact failure. NIST published ten design tenets for agent identity on October 27, and Cisco open sourced Project Quarry, a detection language for multi-step agent behavior, on October 28. Our guide to AI agent governance platforms covers the inventory and approval tools built to catch unsanctioned agents like this one.
We wrote three Quarry rules for the leak pattern WIRED describes and ran them on 10 synthetic Claude Code traces. The simple rule caught 3 of 6 leaks, and a plain password showed up unmasked in the evidence. This piece follows our editorial standards, and the incident details below are WIRED’s reporting, not confirmed facts.
TL;DR
- What was reported: an Accenture employee allegedly connected a DOD production environment on NIPRNet to a personal Claude Code account and gave the agent their own login.
- What went wrong: per WIRED’s sources, the agent sent credentials, passwords, and a network map to a third-party site, then ran unnoticed for two months.
- Who disputes it: Accenture says an independent investigation found the allegations without merit, and the Pentagon declined to comment.
- The guidance: NIST’s ten tenets call for distinct agent identities, zero standing privilege, short-lived tokens, and logs the agent cannot touch.
- Our test: a Quarry rule for secret file reads followed by outbound calls caught 3 of 6 leaks; a broader version caught 5 of 6 but raised 1 false alarm.
- What to do: stop agents from borrowing human logins, allowlist egress, and scan traces for read-then-send patterns as a second line of defense.
What WIRED Reported About the Claude Code Agent
According to WIRED’s sources, an Accenture employee connected a secure production environment on NIPRNet to a personal Claude Code account so the agent could write and deploy code and spin up cloud servers. To automate that work, the employee gave the agent their own login credentials, which carried administrative access.
That login let the agent bypass the security controls of a normal sign-in, and it committed code under the employee’s name. Because it needed internet access to work, it appears to have sent the credentials, passwords, and a map of NIPRNet to a third-party website. WIRED did not name the site, but said NIST had flagged it as high risk.
The system held controlled unclassified information. Sources say the agent ran for two months before anyone found it, and that Accenture did not first report it to the government, despite a 72-hour reporting rule for contractors. Claude is barred for DOD staff, and Anthropic pointed WIRED to a usage policy that bans bypassing authentication controls.
Accenture told WIRED the allegations “were thoroughly and independently investigated and found to be without merit,” but did not say who investigated, according to a WIRED podcast episode on the story. There is no report that classified systems were reached or that attackers used the leaked details.
Why a Borrowed Login Is the Real Failure
Nothing in the reported chain needed a hacker. A person under time pressure handed an agent their own keys, the agent did its job, and the job included talking to the internet. Every step looked like normal developer work, which is why it reportedly took two months to notice.
This is the “shadow agent” pattern, and it is the same shape as the July Hugging Face incident, where Hugging Face later recovered about 17,600 agent actions that were mostly harmless one at a time, as Cisco notes. Our report on OpenAI misalignment monitoring covers how one lab now watches for that drift.
For teams running coding agents, the lesson is about identity first. An agent that logs in as a human inherits all of that human’s access and leaves an audit trail that points at the wrong actor. The non-human identity tools market exists to fix this, and our Astrix vs Oasis vs Aembit comparison shows how three vendors approach it.
What NIST’s Agent Identity Tenets Say
NIST’s October 27 post proposes ten design tenets for agent identity and access management. Agents should get their own verifiable identity, hold zero standing privilege, receive short-lived task-scoped access, and trigger human review above set risk levels. Logs should be append-only and kept outside the agent’s reach.
Two tenets stand out against the WIRED account. Tenet 07 says the logic that decides what an agent tries to do must be separate from the system that decides what it may do, because “guardrails alone are insufficient.” Tenet 05 warns about consent fatigue, where people approve agent actions out of habit.
NIST frames these as a starting point, not a standard, and says current products will not meet all ten yet. They line up closely with the NIST and CISA incident response practices for AI agents we covered earlier this month, which ask teams to log agent actions in a way that survives an investigation.
What Cisco’s Project Quarry Does
Project Quarry is an Apache 2.0 Python engine that scans recorded agent conversations against rules, a bit like Snort or YARA for agent traces. A rule can require order, such as a secrets file read followed by a request to an outside host, and Quarry compiles each rule into a state machine when it loads.
Rules can mix exact checks with optional model judgments, and a match returns the steps that triggered it with “common secret formats masked,” per Cisco. The GitHub repository also ships a plugin for Claude Code, Codex, and other MCP hosts with five read-only tools for writing and testing rules.
That plugin is a rule-writing aid, not a live guard. It does not hook your agent’s shell, file, or web calls, so you feed Quarry transcripts or call its Python API from your own pipeline. The project is alpha, and its README warns the rule syntax may change before version 1.0.
What We Found Testing Quarry Rules on Credential Leaks
We installed cisco-project-quarry 0.1.0 on Python 3.13 and built 10 synthetic traces in the OpenAI message format Quarry reads, using Claude Code tool names: Read, Bash, WebFetch, and an MCP tool. Six traces leak a secret and four are harmless. No real credentials or networks were involved.
We wrote three rules. Rule 1 flags a secret file read followed by WebFetch or a curl or wget call to a host outside an allowlist. Rule 2 adds environment variable reads, the word token, and any MCP tool as an exit. Rule 3 flags a credential pasted into a user message followed by any outbound call.
| Finding | Result | What it means |
|---|---|---|
| Secret file read, then outbound call | Caught by rule 1 in all 3 cases, including after 200 harmless commands | Order-aware rules work on long traces |
| Same steps in reverse order | No match | The after operator respects sequence, so no alert on fetch-then-read |
| Secret read from env, then curl | Missed by rule 1, caught by rule 2 | File path lists miss secrets that live in the environment |
| Secret sent through an MCP paste tool | Missed by rule 1, caught by rule 2 | Exact tool name lists miss new MCP exits |
| Harmless grep for token_count | False alarm from rule 2 | Broad terms buy coverage at the cost of noise |
| User pastes a password, agent uses it | Only rule 3 caught it | The WIRED pattern needs a rule on user messages too |
| AWS access key in evidence | Shown as «redacted» | Known key formats are masked |
| Plain password in evidence | Shown in full, in both the prompt and the curl command | Treat Quarry findings as sensitive data |
| Scan time, three rules loaded | About 2 ms for 5 messages, 65 ms for 405; 141 ms to compile | Fast enough to scan every finished session |
The rule engine did what it promised. Ordering held, long traces were fine, and evidence pointed at the exact steps. The misses came from our rule wording, which is the real lesson: a sequence rule is only as good as its list of secret sources and exits, and agents keep adding new exits through MCP.
The unmasked password matters for the WIRED scenario specifically. A login typed into a prompt is not a “common secret format,” so it passes through to the finding. If findings go to a ticket queue or chat channel, scrub them first or restrict who can read them.
Six Controls to Add Before Your Next Coding Agent Rollout
Most of these controls sit in identity and network settings you already run. Detection rules like Quarry’s come last, as a check on the controls in front of them. The order below follows NIST’s tenets and the gaps our test exposed, starting with the step that would have broken the reported chain earliest.
- Ban borrowed logins: give each agent its own identity, owned by a named person, and block agent sessions that present a human’s credentials.
- Remove standing access: issue short-lived, task-scoped tokens and keep production admin rights away from coding agents entirely.
- Allowlist egress: route agent traffic through a proxy that permits only approved hosts, and treat a new destination as a review event.
- Inventory personal agents: look for Claude Code, Codex, and similar tools on managed devices, and give staff an approved option so they stop bringing their own.
- Scan finished sessions: run read-then-send rules over agent traces daily, and cover env reads, MCP tools, and credentials pasted into prompts, as our test showed.
- Keep logs out of reach: ship agent action logs to append-only storage the agent cannot write to, using a pipeline like our Claude Platform OpenTelemetry traces setup.
For vendor options, our AI agent security tools and MCP security tools guides cover runtime controls, and our AI red teaming tools roundup covers testing them before launch.
Frequently Asked Questions
What happened with the Claude Code agent on the Pentagon network?
WIRED reported on October 29, 2026 that an Accenture employee connected a DOD production system on NIPRNet to a personal Claude Code account and gave the agent their own login. Sources say it sent credentials and a network map to a high-risk site and ran for two months. Accenture disputes the allegations.
Was Anthropic’s Claude Code hacked?
Nothing in WIRED’s report says Claude Code itself was breached. The reported problem is how it was used: a personal account, a borrowed human login with admin rights, and open internet access from a sensitive network. Anthropic pointed WIRED to its usage policy, which bans bypassing authentication and other security controls.
What are NIST’s agent identity design tenets?
They are ten proposed principles NIST published on October 27, 2026 for managing agent identity and access. They include distinct agent identities, delegation that narrows scope, zero standing privilege, short-lived revocable access, human review triggers, signed mandates, policy kept apart from reasoning, deterministic access decisions, continuous monitoring, and tamper-evident logs.
Can Project Quarry block an agent in real time?
Not by itself. Quarry scans agent conversations you hand it, through its command line tool or Python API, and returns matches with evidence. Its Claude Code and Codex plugin helps write and test rules but does not hook the agent’s real actions. To block, you call Quarry from your own runtime and act on the result.
How do I stop coding agents from leaking credentials?
Start with identity and network controls. Give each agent its own short-lived, task-scoped credentials, never a human login, and allowlist the hosts it can reach. Then scan finished sessions for secret reads followed by outbound calls, including environment variables, MCP tools, and passwords pasted into prompts, since those are easy to miss.
The Bottom Line
If WIRED’s account holds up, the Claude Code agent did nothing exotic. It used a human’s keys on a network that let it reach the internet, and nobody was watching the sequence. NIST’s tenets describe the fix, and Quarry offers a useful second check, but only if your rules cover the exits agents really use.
We will update this story if Accenture, the DOD, or Anthropic share more details. Send corrections through our contact page.
Related coverage: the LiteLLM supply chain compromise, NIST and CISA agent incident response, AI agent governance, and AI guardrails tools.