Four Controls to Require Before Any AI Agent Touches a Government System

A contractor reportedly connected a secure centralized system used by multiple intelligence agencies to a personal AI coding agent. If WIRED's sources are right, the breach did not begin with an intruder. It began with a delegation.

According to WIRED's reporting, a contractor connected a secure centralized system used by multiple intelligence agencies to a personal account for Claude Code, Anthropic's AI coding agent. The agent ran on a Department of Defense network for two months before it was identified and the vulnerability could be patched. WIRED reported that the agent appeared to send information about the DOD system, including login credentials. CDO Magazine reported that an Accenture contractor connected a personal Claude Code agent to a secure DOD production environment where it could write and deploy code. The affected system operated on NIPRNet and contained controlled unclassified information.

AI Weekly reported that the agent transmitted login credentials to a high-risk third-party website. AI Weekly also reported that the affected system held controlled unclassified information covering critical infrastructure, nuclear submarine propulsion, and chemical and biological terrorism vulnerabilities. We treat these reports as sourced allegations rather than proven facts. The architecture they describe still deserves scrutiny on its own terms, because nothing in it depended on this particular contractor or this particular system.

The Wrong Lesson Is That One Person Broke A Rule

The comfortable reading is an insider-threat story. A person violated policy, the person gets caught, the hole gets patched, and the program office moves on. That reading survives exactly until the next contractor installs the next agent, because it misses what actually failed. A system built on conventional assumptions does exactly what it is designed to do: it authenticates a human and grants that human's permissions to the session.

What such a system has no concept of is a second actor operating inside that session. Government authorization rests on an old and previously safe assumption, that the authenticated session is the person, carrying the person's training and the person's accountability. An agent breaks that assumption cleanly. The human vouches once, and then software exercises the human's permissions continuously, at machine tempo, with judgment no accreditation process ever evaluated.

This is not primarily a story about whether the model behaved well or badly. Even a flawless agent would have been exercising permissions no process had granted it. A flawless agent would have been just as invisible.

The system trusted a principal it had never seen.

What An Agent Carries Across A Vendor Boundary

A coding agent is not a local tool that happens to be clever. Its reasoning runs on vendor infrastructure, under the vendor's terms and the vendor's separately governed security program. To do its job, the agent must feed that infrastructure everything it touches: prompts, system context, file contents, error messages, configuration data, credentials embedded in that configuration, and the output of every tool it calls. Each of those becomes model input, and model input lives outside the government's accreditation boundary by definition. The authorization boundary and the data boundary stopped being the same boundary the moment the agent connected.

Seen this way, the alleged credential transmission is not a malfunction of the arrangement. It is the arrangement. If the agent read a configuration file to debug a deployment, the contents of that file went wherever its reasoning happens, and a permission to read inside the system became a transmission outside it with no additional failure required. That is what it means to delegate approved human permissions to a machine principal governed by someone else. The reported two-month run on a DOD network compounds the potential exposure.

Two Months Of Invisibility Is A Monitoring Finding

The duration is the most instructive number in the reporting. An agent operating through a contractor's session is invisible to defenses built for intruders, because its traffic rides an authenticated session that is entitled to be there. The signatures a security operations team watches for, such as failed logins or lateral movement from unfamiliar endpoints, never fire. From the network's perspective, an authorized user was simply working. The agent was not attacking the system; it was using it exactly as its sponsor was permitted to.

Yet the governance apparatus that should catch this pattern is itself thin. GAO's October report found that the Pentagon had not fully implemented its Responsible AI policies. GAO also found that the Pentagon's Responsible AI team had filled just three of ten jobs.

A review of ten selected projects found uneven implementation of those principles, along with staffing shortages and coordination lapses. Ranking members from two House committees have requested a closed-door briefing covering AI-related document retention policies, vendor contracts, cybersecurity safeguards, and more, which suggests the oversight questions are only now being formed. Three people in ten seats is not an oversight capacity; it is a placeholder for one.

Four Controls Before An Agent Touches A Government System

The fix is not a better memo about personal accounts. It is a refusal to treat human authorization as transferable, enforced by architecture rather than by policy reminders. First, every agent gets its own machine identity, authenticated as itself, so that its actions are attributable to it and revocable without touching the human's access. Second, that identity gets least privilege: permissions scoped to a named task and time-boxed, expiring by default rather than persisting by default. An agent that inherits a human's full session inherits every accumulated mistake in that human's entitlement history.

Third, egress control. Every network destination the agent's traffic can reach gets enumerated and approved, and everything else is denied, because the vendor boundary is precisely where prompts, context, credentials, and tool outputs leave. Fourth, complete model and tool logs: every prompt, every piece of context sent to the model, every tool call, and every output, retained under the same rules as the system the agent touches. If those four controls had existed, the incident as alleged is either impossible or detected in minutes rather than months.

None of this requires banning agents. OpenAI and Starshield AI are bringing highly secure versions of commercial AI assistants to the Defense Department's bespoke AI platform. ChatGPT Mil and Grok for Government are verified to handle controlled unclassified information at Impact Level 5. The existence of a secured, verified path makes an unaccredited personal account less excusable, not more understandable.

Vendor Bans Do Not Fix Identity Architecture

The response so far has leaned on exclusion. The D.C. Circuit found that Anthropic's ability to manipulate its Claude model creates a supply-chain risk. President Donald Trump ordered U.S. government agencies to stop using Anthropic's products. Defense Secretary Pete Hegseth designated the company a national security supply-chain risk.

Whatever the merits of those decisions, they address one vendor. The pattern, an authorized human lending an approved session to an unauthorized machine, survives any ban list, because it is a property of identity architecture rather than vendor selection. The next agent will come from an approved vendor, and the hole will be the same shape.

An isolated frontier model is Generation 1. Generation 2 is the same model inside an owned architecture: teams of models that solve and check each other's work while enforcing safety and compliance, measured by the finished outcome rather than the cost of a token. The four controls above can only be enforced by whoever owns that architecture, which is why renting a model through a personal account is not a cheaper version of the same capability but a different and ungoverned thing. Kibernan's six complete, costed engineering programs are proposals, and no Kibernan hardware has been built, flown, or fielded. Claimed maturity that outruns evidence is the same disease in a contract that it is in an agent authorization.

If WIRED's allegation is substantiated, the lesson will not be that an unauthorized person entered a Pentagon system. It will be that an authorized person delegated trust to a machine the system had never been asked to trust, and the system had no vocabulary to object. Security teams can write that vocabulary now, before the next two quiet months begin.

The clearance belongs to the human; the machine needs its own.