据美国《连线》杂志报道，埃森哲一名承包商员工被指将个人Claude Code账号接入美国国防部的安全系统，让AI智能体代为编写和部署代码。知情人士称，该智能体在国防部网络中运行了两个月才被发现，其间疑似将登录凭据、密码及网络结构信息发送至一个存在安全风险的第三方网站。
埃森哲否认相关指控成立。公司发言人表示，相关说法已经过彻底、独立的调查，被认定缺乏依据，公司完全履行了法律与合同义务。《连线》称，埃森哲没有进一步说明由谁开展调查。美国国防部发言人则表示，不评论其网络或系统的状况。
据报道，涉事员工接入的是一个供多个情报机构使用的集中式系统，其中存有“受控非密信息”，简称CUI。这类信息虽未被列为机密，仍属于需要保护的敏感资料，未经审查不得向公众发布。
知情人士称，该员工为了让AI自动编写代码、启动云服务器，将自己的登录凭据交给了Claude智能体。这使智能体获得管理员访问权限，并能够绕过正常登录流程中的安全控制。它还会代表员工提交代码，将代码保存进系统。
问题出现在智能体连接外部工具的过程中。据《连线》报道，它似乎将员工的登录凭据、密码及美军网络结构信息发送给了第三方网站。为避免进一步增加系统风险，《连线》没有披露该网站名称。报道指出，美国国家标准与技术研究院此前已将其标记为高风险，原因是一处漏洞可能让攻击者向AI编程智能体注入指令，进而窃取凭据。
一名了解事件的信源表示，目前并不清楚这些信息被发送出去后如何处理，是否仍被第三方服务保留。如果相关服务遭到入侵，攻击者可能利用这些凭据，在未被察觉的情况下进入安全环境。
涉事编程环境运行于美国国防部的非密互联网协议路由网络NIPRNet。该网络用于处理非密信息，可以连接互联网，员工和承包商能够通过它收发邮件、使用浏览器，但仍受到严格安全保护。
报道没有证据表明，黑客已进入美军的机密或绝密系统。不过，受访安全专家认为，非密环境中的账号、代码和系统结构信息外流，仍可能威胁更敏感的系统。
前美国国家安全局黑客、网络安全咨询机构IANS教员杰克·威廉姆斯解释，单独看属于受控非密信息的资料，汇总后可能形成应被列为机密的内容。例如，危险材料的位置与存放设施的薄弱环节，分别看可能属于非密资料，结合起来却可能暴露更敏感的信息。
代码流转也是专家担忧的另一条路径。报道指出，一些工具和代码会先在NIPRNet中测试，再部署到用于处理机密或绝密信息的隔离网络。攻击者如果利用外泄凭据进入测试环境，可能向代码中植入后门；若审查未能发现，恶意代码便可能随工具进入更敏感的系统。这是专家提出的潜在风险，报道并未证实此类情况已经发生。
威廉姆斯表示，政府使用的静态应用安全测试能够检查代码漏洞，但有意植入的后门未必会被识别为漏洞，代码生成过程中的逻辑问题也可能逃过检测。AI生成代码的速度远超人工，进一步增加了审查压力。
事件的发现和上报过程同样受到质疑。知情人士告诉《连线》，尽管存在安全风险，埃森哲员工最初并未将此事视为严重或紧急事件，公司起初也没有向政府报告。相关说法与埃森哲关于调查结果及履约情况的回应存在分歧。
华盛顿IT咨询公司Hunter Strategy创始人马特·特里纳认为，政府承包商面临相互冲突的要求。一方面，项目需要更快交付、压低成本；另一方面，企业承认安全事件又可能面临失去合同的风险。他表示，报道所描述的事件属于需要上报的情况。
据《连线》报道，埃森哲目前持有超过35亿美元的美国联邦政府合同，其中近6.05亿美元来自国防部。报道还指出，Claude目前被禁止供国防部工作人员使用。Anthropic回应《连线》时援引了其使用政策，其中禁止未经授权绕过身份验证、终端防护或监控等安全控制。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
According to the United States Wireline magazine, an employee of a contractor in Accenture was alleged to have connected his personal Claude Code account to the United States Department of Defense security system and to have AZAI agent prepare and deploy codes. According to the source, the AI agent was only discovered after two months of operation in the Ministry of Defence network, during which time it was suspected that the login, password and network structure information would be sent to a third-party website with security risks.
Esenzer denied the charges. The spokesperson for the company stated that the statement had been thoroughly and independently investigated and found to be unfounded and that the company had fully complied with its legal and contractual obligations. According to Wireline, Esenzer did not provide further information on who was conducting the investigation. The spokesman for the United States Department of Defense stated that he did not comment on the status of his network or system.
It was reported that the staff involved had access to a centralized system for use by multiple intelligence agencies containing “controlled and unclassified information”, known as CUI. Such information, although not classified as confidential, remains sensitive and in need of protection and cannot be reviewed to the public at publish.
According to the source, the employee gave Claude AI agent his login documents to enable AI to automatically write codes and activate the cloud server. This enabled AI agent to obtain access to permission by the administrator and to circumvent security controls in the normal login process. It also submits codes on behalf of staff and keeps them in the system.
The problem arises when AI agent connects external tools. According to Wireline, it appears to have sent staff login documents, passwords and information on the structure of the United States military network to a third party website. In order to avoid further system risk, the Web site name was not disclosed in Connect. It was reported that the National Institute of Standards and Technology of the United States had previously marked it as a high risk because of a loophole that might allow the assailants to inject instructions into AI programming AI agent, thereby stealing evidence.
One of the sources of the incident indicated that it was not clear how the information would be processed after being sent out and whether it would still be retained by third party services. In the event that services are invaded, the attackers may use these evidence to enter the safe environment undetected.
The program environment in question is operated by the U.S. Department of Defense's non-confidential Internet protocol route network NIPNet. The network is used to process non-confidential information, connects to the Internet and enables employees and contractors to receive and send mail, use browsers, but remains under strict security protection.
There is no evidence in the report that hackers have entered the United States military's confidential or top secret system. However, the security experts interviewed believed that the flow of information from accounts, codes and systems structures in an unclassified environment could still threaten more sensitive systems.
The former US National Security Agency hacker, IANS security advisor, Jack Williams, explained that information that was separately classified as controlled and unclassified could form the subject of classified information. For example, the location of hazardous materials and the weaknesses of storage facilities, which may be classified as non-confidential, may be combined to expose more sensitive information.
The code flow is another path of concern to experts. It was reported that some tools and codes would be tested in NIPRNet before being deployed to isolated networks used to process classified or strictly confidential information. An attacker may insert a back door into the code if he enters the test environment using excretion evidence; if the review fails to find out, the malicious code may enter the more sensitive system with the tool. This is a potential risk identified by the experts and the report does not confirm that such a situation has occurred.
Williams stated that the static application security tests used by the Government were capable of checking code loopholes, but the intentional implantation of the back door was not necessarily identified as a loophole, and logical problems in code generation could also escape detection. The speed at which the AI generation code was generated was much faster than manual, further increasing the review pressure.
The discovery of the incident and the reporting process were equally challenged. Informed sources told the Connect that, despite security risks, the matter had not initially been considered a serious or urgent incident by the staff of Accenture and that the company had not initially reported it to the Government. There is a discrepancy between the statement and the Eisenzer response to the findings and compliance.
According to Matt Turner, founder of Hunter Strategy, an IT consulting firm in Washington, D.C., government contractors face conflicting demands. On the one hand, projects need to be delivered faster and low-cost; on the other hand, enterprises acknowledge that security incidents may risk losing contracts. He stated that reporting on the events described was something that needed to be reported.
According to Wireline, Esentge currently holds over $3.5 billion in United States federal government contracts, nearly $605 million of which comes from the Department of Defense. Reports also indicate that Claude is currently prohibited from being used by Ministry of Defence staff. In response to Connect, Anthropic invoked its use policy, which prohibits unauthorized circumvention of security controls such as identification, terminal protection or surveillance.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.