A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System

本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System

Save this storySave this storyEarlier this year, sources tell WIRED, a contractor caused a security incident at the Department of Defense by connecting a secure centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic’s AI coding agent. It appears that the agent used by the contractor, who is employed by the global consulting firm Accenture, then sent information about the DOD system, including login credentials, to a high-risk, third-party website.

据《连线》杂志报道，今年早些时候，一名承包商在国防部引发了一起安全事件。该承包商将多个情报机构使用的安全集中系统连接到了其个人的 Claude Code 账户上，这是 Anthropic 公司的一款人工智能编程代理。据了解，这名受雇于全球咨询公司埃森哲（Accenture）的承包商所使用的人工智能代理，随后将包括登录凭证在内的国防部系统信息发送到了一个高风险的第三方网站。

The centralized system contains controlled unclassified information (CUI), which is considered sensitive and not to be released to the public without review. CUI can include information about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Additionally, security experts say, access to the system could allow for the exploitation of even more sensitive ones.

该集中系统包含受控非机密信息（CUI），这些信息被视为敏感内容，未经审查不得向公众发布。CUI 可能涵盖关键基础设施、核潜艇推进系统以及针对化学和生物恐怖主义的脆弱性等信息。此外，安全专家表示，访问该系统可能会导致更敏感的系统遭到利用。

“It puts all the data that’s in there at risk,” says a source aware of the incident, who requested anonymity as they were not authorized to speak to the press. If the third-party software was compromised, “there could be somebody out there with the ability to log into a secure environment without anyone knowing. It’s 100 percent a national security threat and could cause irreparable harm.”

一位知悉此事的匿名消息人士表示：“这使得系统内的所有数据都处于风险之中。”由于未获授权向媒体发言，该人士要求匿名。如果第三方软件遭到入侵，“可能会有人在无人知晓的情况下登录安全环境。这百分之百是一个国家安全威胁，并可能造成无法弥补的损害。”

A DOD spokesperson tells WIRED that “the Department does not comment on the status of its networks or systems.” “We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations,” an Accenture spokesperson tells WIRED. When pressed, Accenture didn’t offer clarification on who conducted the investigation, or dispute that there had been what could be characterized as an incident.

国防部发言人告诉《连线》杂志：“国防部不对其网络或系统的状态发表评论。”埃森哲发言人则向《连线》表示：“我们认真对待所有关切。这些指控已通过彻底的独立调查，结果显示并无根据。我们完全遵守了法律和合同义务。”当被追问时，埃森哲并未说明是谁进行了调查，也没有否认曾发生过可以被定性为“事件”的情况。

The Accenture employee is alleged to have connected a secure production environment to their personal Claude account so as to allow an AI agent to write and deploy code. Claude is currently barred from being used by DOD staff. (Anthropic directed WIRED to the company’s usage policy, which instructs users not to use its products to “interfere with the operation of military bases and related infrastructure” or to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”)

据称，该埃森哲员工将一个安全生产环境连接到了其个人 Claude 账户，以便让 AI 代理编写和部署代码。目前，国防部工作人员被禁止使用 Claude。（Anthropic 公司引导《连线》查看其使用政策，该政策指示用户不得使用其产品“干扰军事基地及相关基础设施的运行”，或“在未经授权的情况下绕过身份验证系统、端点保护或监控工具等安全控制措施”。）

The Accenture employee’s AI agent ran on the DOD network for two months before it was identified and the vulnerability could be patched. Sources indicate that despite the security risks posed by the AI coding agent, Accenture employees did not treat the incident as severe or urgent. DOD employees and federal contractors are required to report any cybersecurity incident within 72 hours of its discovery, but sources indicate Accenture did not initially report the breach to the government at all.

该埃森哲员工的 AI 代理在国防部网络上运行了两个月，才被发现并修补了漏洞。消息人士指出，尽管 AI 编程代理带来了安全风险，但埃森哲员工并未将此事件视为严重或紧急情况。国防部员工和联邦承包商被要求在发现任何网络安全事件后的 72 小时内进行报告，但消息人士指出，埃森哲最初根本没有向政府报告此次违规行为。

“We are in a conflict with Iran right now,” says the employee, noting that Iran has attempted to hack several federal agencies and parts of US infrastructure. “It’s the worst time to be having this kind of cavalier attitude.”

“我们目前正与伊朗处于冲突之中，”该员工说道，并指出伊朗曾试图入侵多个联邦机构和部分美国基础设施。“现在是采取这种漫不经心态度的最糟糕时刻。”

Accenture currently has more than $3.5 billion in contracts with the federal government, nearly $605 million of which are with the DOD. The company also contracts with other federal agencies, such as the Department of Education, the General Services Administration, and the Department of Energy, among others. Earlier this month, the Federal Bureau of Investigation found that an Accenture contractor failed to patch a vulnerability that led to the hacking group ShinyHunters getting access to the details of thousands of the Bureau’s employees. The FBI removed that contractor in early October.

埃森哲目前与联邦政府签订了超过 35 亿美元的合同，其中近 6.05 亿美元来自国防部。该公司还与其他联邦机构签订了合同，例如教育部、总务管理局和能源部等。本月早些时候，联邦调查局（FBI）发现，一名埃森哲承包商未能修补一个漏洞，导致黑客组织 ShinyHunters 获取了数千名 FBI 员工的详细信息。FBI 已于 10 月初解除了该承包商的职务。

Matt Triner, founder of Hunter Strategy, a Washington, DC-based IT consulting company, says that the issue exemplifies the conflicting demands government contractors face more broadly. “Organizations are often punished for reporting incidents like this, even though it’s the right and legal thing to do,” says Triner. In many cases, he says, a company could lose government contracts by admitting they’ve had a security breach, though he says that an incident like the one described is “absolutely one that would need to be reported.”

位于华盛顿特区的 IT 咨询公司 Hunter Strategy 的创始人马特·特里纳（Matt Triner）表示，这个问题体现了政府承包商所面临的更广泛的矛盾需求。特里纳说：“组织往往因为报告此类事件而受到惩罚，尽管这是正确且合法的做法。”他表示，在许多情况下，公司承认发生安全漏洞可能会导致失去政府合同，但他强调，像所描述的这类事件“绝对是必须报告的”。

Triner also notes that the increasing pressure on contractors to deliver projects faster and at a lower price point is at odds with prioritizing safety and security. “Unfortunately, everyone is operating in a system where there are competing rules and incentives, and that existed before AI, but now it’s the same problem on speed,” says Triner.

特里纳还指出，承包商面临着以更低价格更快交付项目的压力，这与优先考虑安全保障的目标相冲突。特里纳说：“不幸的是，每个人都在一个存在相互冲突的规则和激励机制的系统中运作，这种情况在 AI 出现之前就存在了，但现在速度问题让情况变得一样。”

The coding environment accessed by the Accenture contractor is run on the Non-classified Internet Protocol Router Network (NIPRNet), a DOD network used for unclassified information. While it does connect to the internet—contractors and employees can access their emails and web browsers through the network—it is heavily secured.

该埃森哲承包商访问的编程环境运行在非机密互联网协议路由器网络（NIPRNet）上，这是国防部用于处理非机密信息的网络。虽然它确实连接到互联网——承包商和员工可以通过该网络访问电子邮件和网页浏览器——但它受到严格的安全保护。

According to the source, in order to automate the process of writing code and spinning up cloud servers, the contractor gave their login credentials to the Claude agent. This gave the agent administrative access and allowed it to bypass the security controls enforced through the normal login process. The AI agent—which was not only writing code but also committing it or saving the code into the system on behalf of the Accenture employee—needed to connect out to the internet to perform its tasks. In doing so, it appears to have sent the contractor’s login credentials, passwords, and a map of NIPRNet out to a third-party website.

据消息人士称，为了自动化编写代码和启动云服务器的过程，该承包商将登录凭证交给了 Claude 代理。这赋予了该代理管理权限，并使其能够绕过通过正常登录流程强制执行的安全控制。该 AI 代理不仅在编写代码，还代表埃森哲员工提交或将代码保存到系统中，它需要连接到互联网才能执行任务。在此过程中，它似乎将承包商的登录凭证、密码以及 NIPRNet 的映射图发送到了一个第三方网站。

WIRED is declining to name the third-party website so as to protect the system from further vulnerability, but the National Institute of Standards and Technology has previously identified it as high risk because it has a vulnerability that could let hack

《连线》杂志拒绝透露该第三方网站的名称，以保护系统免受进一步的脆弱性威胁，但美国国家标准与技术研究院（NIST）此前已将其列为高风险，因为它存在一个可能导致黑客攻击的漏洞。