On 29 October, Wired reported, citing anonymous sources, that a contractor working on a US Department of Defense job connected a personal Claude Code agent to a production system on NIPRNet. NIPRNet is the DoD's unclassified network, and it carries controlled unclassified information. According to CDO Magazine's summary, the agent ran there for about two months before anyone identified it.
Accenture, the contractor's employer, said the allegations were thoroughly and independently investigated and found to be without merit. The DoD declined to comment. So treat this as a reported incident, not an established one. The lesson does not depend on how the dispute ends, though, because the pattern behind it is one most organisations can find on their own endpoints today.
What was reported
- The contractor reportedly gave the agent their own login credentials so it could write and deploy code and spin up cloud servers. This gave the agent administrative access that bypassed the security controls enforced at normal login (CDO Magazine).
- Credentials, passwords and a map of the network appear to have been sent to a third-party website. NIST had previously flagged that site as high risk because of a flaw that could let attackers inject instructions into AI coding agents. The reports do not say whether the agent or the person sent the data.
- There is no indication that classified systems were accessed.
- Sources told Wired that the incident was not reported to the government within the required 72 hours (IBTimes).
When you're using an agent, you have no idea of the supply chain.
Jake Williams, former NSA hacker, quoted by [IBTimes](https://www.ibtimes.sg/A000OtY)
Why it happened: four gaps, none of them exotic
Nothing in the reported chain needs a novel exploit. Each step is a governance gap that is common in companies adopting coding agents.
1. The agent inherited a human identity. An agent running on a person's credentials looks like that person in every log. Identity systems, MFA and session controls all see a legitimate user. Admin rights given to the human pass straight to software that reads untrusted text from the internet and acts on it.
2. Nobody knew the agent was there. It was reportedly a personal account, not an approved deployment. Security teams cannot write policy for software they don't know is running. This is shadow AI in its most literal form: not a chatbot tab, but an autonomous process holding production access.
3. Outbound traffic was neither restricted nor reviewed. Sending a network map to an unknown website is an unusual action. On a network where any process may reach any destination, though, it is just another HTTPS request.
4. There was no independent record, so detection was late. Two months is long but not unusual. Manifold Security's Agent Incident Ledger counts 59 publicly disclosed agent incidents since July 2025. By Manifold's count, only 11 were caught by a security control. The rest surfaced through a later review (18), after damage was observed (16) or through an outside report (8), and 6 did not say. The median time from an agent's first out-of-bounds action to public disclosure was 70 days, and no incident came with published transcripts or action logs.
The controls that close each gap
Each gap maps to a specific control. None of them requires banning agents, which in practice pushes them further into the shadows.
- Inventory agents at the endpoint. Know which coding agents run on which managed devices, under which user and at which version. An agent you can see from its first command cannot run unnoticed for two months.
- Separate agent identity from human identity. Agents should get scoped, short-lived credentials for the task in hand, never a person's admin login. Pasting passwords into an agent session should be a policy violation, not a productivity tip.
- Apply least privilege to actions, not just accounts. Even with valid credentials, an agent rarely needs to read SSH keys, cloud credential files or password stores. Deny those reads by default.
- Default outbound traffic to Ask. Known package registries and internal services can be allowed. Unknown destinations should wait for a human, especially when the request carries file contents.
- Keep the record outside the agent. Every command, file access and network call should be logged by something the agent cannot edit or switch off, and exported to your SIEM.
How allow / ask / deny applies here
Policy guardrails work by checking every action an agent attempts against a central policy, before the action runs. Here is how that plays out on the reported chain:
- Allow: routine work in the project directory, builds, tests and installs from approved registries. The agent stays useful, and developers have no reason to route around the policy.
- Ask: any network call to a destination that is not on the allow list, any new cloud resource, and any deployment to production. A human sees the request and the destination, and decides.
- Deny: reading credential stores and key files, running commands with admin rights the agent was never meant to have, and sending files to paste sites or newly seen domains.
- Audit: every attempt is recorded, including the ones that were allowed. When someone asks what the agent did between August and October, the answer is a query, not a forensic project.
This is the model DarkControl implements. A lightweight endpoint agent sits between coding agents such as Claude Code, Codex, Cursor and Copilot and the operating system. It checks each shell command, file write and network call against organisation, department and group rules. Anything that no rule matches defaults to Ask, and every attempt goes into an audit log that can be exported to your SIEM.
Questions to put to your team this week
- Which AI coding agents ran on our endpoints last week, and under whose identity?
- Could any of them reach production with a person's credentials?
- What happens today when an agent tries to send data to a domain we have never seen?
- If an incident started two months ago, could we reconstruct the agent's actions within 24 hours?
- Do our contractor and third-party agreements say anything about AI agents?
Want to know which agents are running in your organisation and what they are doing? DarkControl's free 7-day watch-only audit covers up to 10 devices and blocks nothing. It shows you the commands, files and destinations your agents touched.
