今年早些时候，消息人士告诉WIRED，一个承包商将多个情报机构使用的安全集中系统与他们的个人账户Claude Code,Anthropic的AI编码agent连接起来，在国防部引起了安全事件。 看来，由全球咨询公司Accenture雇用的承包商使用的agent随后向高风险第三方网站发送了关于DOD系统的信息，包括登录证书。
中央系统包含受控的非机密信息(CUI)，这种信息被认为敏感，未经审查不得向公众公开发布。 CUI可以包括有关重要基础设施、核潜艇推进以及易受化学和生物恐怖主义危害的信息。 此外，安全专家说，进入该系统可以利用更敏感的系统。
称是了解此事的消息来源，如果第三方软件被泄露，“可能有人有能力在无人知晓的情况下登录进入安全的环境。 这是国家安全威胁
一个DOD 发言人告诉WIRED,“新闻部不评论其网络或系统的状况。”
“我们认真对待所有关切。 这些指控经过彻底和独立的调查，认定没有法律依据。 Accenture 发言人告诉WIRED, Accenture没有澄清是谁进行调查
据称Accenture雇员将安全生产环境与其个人的Claude账户连接起来，以便AI agent能够写和部署代码。 Claude目前被禁止被国防部工作人员使用。 (Anthropic将WIRED指向公司的使用政策，该政策指示用户不要使用其产品 " 与军事基地和相关基础设施的运作发生接触 " 或 " 绕过安全控制，例如认证系统、终点保护或未经授权的监测工具。 )
Accenture雇员的AI agent在DOD网络上运行了两个月，然后才查明其弱点并可以补齐。 消息来源指出，尽管AI编码agent造成了安全风险，但Accenture的雇员并没有将事件视为严重或紧急。 国防部雇员和联邦承包商必须在其发现后72小时内报告任何网络安全事件，但来源表明Accenture最初根本没有向政府报告违反事件。
雇员称指出，伊朗试图入侵几个联邦机构和部分美国基础设施。 “这是最糟糕的时机
Accenture目前与联邦政府有超过35亿美元的合同，其中近6.05亿美元与国防部。 公司还与其他联邦机构签订合同，如教育部，总务管理局，能源部等。 这个月早些时候，联邦调查局发现Accenture承包商未能弥补导致黑客集团ShinyHunters接触到该局数千名雇员的细节的弱点。 联邦调查局于10月初解除了该承包商的职务。
马特·特里纳(Matt Triner)是猎人战略的创始人，是一家位于华盛顿的IT咨询公司，总部位于称，该问题说明了政府承包商面临的冲突要求更为广泛。 称 Triner指出，在很多情况下，他称，一家公司可能因为承认他们有违反安全规定的行为而失去政府合同，尽管他称认为类似描述的事件是“绝对需要报告的”事件。
Triner还称，承包商在更快和低价点交付项目的压力越来越大，这与优先考虑安全和安保不一致。 称 Triner指出
Accenture承包商访问的编码环境在非机密互联网协议路由器网络(NIPRNet)上运行，这是用于非机密信息的DOD网络。 尽管它确实与互联网连接——承包商和雇员可以通过网络访问他们的电子邮件和网页浏览器，但它是高度安全的。
消息人士称，为了实现代码编写过程自动化和旋转云服务器，承包商将其登录证书交给了Claude agent. 这给了agent行政访问权，并允许它绕过通过正常登录过程执行的安全控制。 AI agent——它不仅在写代码，而且还在代表Acenture雇员将代码输入或保存到系统中——需要与互联网连接，以执行其任务。 为此，它似乎向第三方网站发送了承包商的登录证书、密码和NIPRNet地图。
WIRED正在拒绝给第三方网站命名，以保护系统免受进一步的脆弱性，但国家标准和技术研究所(NIST)之前已经认定它具有高风险，因为它有脆弱性，可以让黑客向一个AI编码agent注入指令来窃取证书。
AI agent访问的系统包含CUI. 称是来源。 " 资料，包括登入证书，在送交[该服务]后，是否得到保留，没有深入了解。 "
视机构及其工作而定，CUI可以包含从个人可识别信息(PII)到专有业务或订约信息的任何内容。 根据国防部网站，CUI可以包括有关 " 爆炸物、危险化学品或管道的安全保障 "、与 " 军事或空间设备或技术 " 和 " 放射性物质的确切位置和数量 " 的设计有关的文件。
与实际数据不同，它的地图对黑客来说可能非常有价值。 称 Triner指出：「一旦攻击者明白这些事情是如何结合在一起的
虽然地图可能不会让黑客进入系统，但一旦敌人确实可以进入，地图就能够帮助他们更快地行动，并“帮助攻击者了解王冠珠宝的下落”。
Jake Williams，前国家安全局IANS黑客和教职员，情报和安全顾问称
Williams 指出认为，虽然个别数据或信息可被视为CUI,“当未分类信息被汇总时，这些数据或信息本身即可被分类。” 例如，某些危险材料的位置可能是CUI，可能还有关于存放这些材料的设施的脆弱性的信息。 但是，它们合在一起可以披露将保密的信息。
但这不是机密信息可能受到威胁的唯一方式。 经常在NIPRNet测试工具和代码，然后将其部署到更敏感的系统，如秘密因特网协议路由器网络(SIPRNet)，即军方保密信息的安全网络，以及全球联合情报通信系统(JWICS)，后者是绝密信息的安全内联网。 SIPRNet和JWICS都是空隙，这一安全措施意味着它们没有与任何外部网络连接。 在实用层面上，这意味着SIPRNet和JWICS对于一个黑客来说是极难远程访问的。
但随着由AI agent过滤的登录证书被解禁，黑客可以访问NIPRNet，并将后门或其他恶意代码插入工具或系统。 如果不进行适当的审查，这个代码可能最终部署在其中一个空隙系统。
称 Williams, “该代码可以在NIPR中完全正常运行，并在SIPR网络中做一些恶意和未公开的事，从这些网络中过滤数据会很困难，He 新增，但是恶意代码可以用来从内部攻击系统。 称认为
特里纳·称，即使是一些更微妙的东西，比如减缓情报操作和活动，也可能造成破坏，使用户对工具失去信任，即使问题一经解决。
随着气温编码，或促使AI助手为工程师描述的产品编写代码，越来越普遍，审查代码越来越成为挑战。 AI能够生成远超越人类生产力的体积的代码，使其耗时且难以审查。
" 当你使用agent时，你对最终生成代码的供应链甚至推论链都一无所知，"称 Williams. “这些LLMs所训练的许多代码本身是脆弱的，它们可以重塑我们在其他代码中看到的同样的建筑类型和建筑问题。”
政府确实有办法找出NIPRNet中存在缺陷的代码。 静态应用安全测试(SAST)在允许它运行之前扫描错误和缺陷的代码。 但Williams 指出认为黑客插入的“后门并不是一种弱点，即使我们可能不希望它存在，”因此很可能在SAST探测的雷达下飞行。 SAST也通常不会在如何创建代码的逻辑链中识别结构问题。
没有迹象表明黑客能够进入机密或绝密系统。 尽管如此，威廉姆斯·称，事件应引起重大警报。 称认为，任何你无法透过开源情报查看的NIPR信息
这不是国防部第一次因AI相关问题而变得脆弱。 去年，ProPublica透露Microsoft在联邦政府的项目中使用了“数字护卫”，持有安全许可的美国雇员将监督中国外包工人撰写的代码。 曾与ProPublica 称交谈的专家认为，由于美国员工往往无法自己审查代码，程序带来了特别的安全风险，留下恶意代码的打开处被无意识地插入政府系统。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Earlier this year, sources tell WIRED, a contractor caused a security incident at the Department of Defense by connecting a secure centralized system used by multiple intelligence agencies to their personal account for Claude Code, Anthropic’s AI coding agent. It appears that the agent used by the contractor, who is employed by global consulting firm Accenture, then sent information about the DOD system, including login credentials, to a high-risk third-party website.
The centralized system contains controlled unclassified information (CUI), which is considered sensitive and not to be released to the public without review. CUI can include information about critical infrastructure, nuclear submarine propulsion, and vulnerabilities to chemical and biological terrorism. Additionally, security experts say, access to the system could allow for the exploitation of even more sensitive ones.
“It puts all the data that’s in there at risk,” says a source aware of the incident, who requested anonymity as they were not authorized to speak to the press. If the third-party software was compromised, “there could be somebody out there with the ability to log into a secure environment without anyone knowing. It’s 100 percent a national security threat and could cause irreparable harm.”
A DOD spokesperson tells WIRED that “the Department does not comment on the status of its networks or systems.”
“We take all concerns seriously. These allegations were thoroughly and independently investigated and found to be without merit. We fully complied with our legal and contractual obligations,” an Accenture spokesperson tells WIRED. When pressed, Accenture didn’t offer clarification on who conducted the investigation, or dispute that had been what could be characterized as an incident.
The Accenture employee is alleged to have connected a secure production environment to their personal Claude account so as to allow an AI agent to write and deploy code. Claude is currently barred from being used by DOD staff. (Anthropic directed WIRED to the company’s usage policy, which instructs users not to use its products to “interfere with the operation of military bases and related infrastructure” or to “bypass security controls such as authentication systems, end point protection, or monitoring tools without authorization.”)
The Accenture employee’s AI agent ran on the DOD network for two months before it was identified and the vulnerability could be patched. Sources indicate that despite the security risks posed by the AI coding agent, Accenture employees did not treat the incident as severe or urgent. DOD employees and federal contractors are required to report any cybersecurity incident within 72 hours of its discovery, but sources indicate Accenture did not initially report the breach to the government at all.
“We are in a conflict with Iran right now,” says the employee, noting that Iran has attempted to hack several federal agencies and parts of US infrastructure. “It’s the worst time to be having this kind of cavalier attitude.”
Accenture currently has more than $3.5 billion in contracts with the federal government, nearly $605 million of which are with the DOD. The company also contracts with other federal agencies, such as the Department of Education, the General Services Administration, and the Department of Energy, among others. Earlier this month, the Federal Bureau of Investigation found that an Accenture contractor failed to patch a vulnerability that led to the hacking group ShinyHunters getting access to the details of thousands of the Bureau’s employees. The FBI removed that contractor in early October.
Matt Triner, founder of Hunter Strategy, a Washington, DC-based IT consulting company, says that the issue exemplifies the conflicting demands government contractors face more broadly. “Organizations are often punished for reporting incidents like this, even though it’s the right and legal thing to do,” says Triner. In many cases, he says, a company could lose government contracts by admitting they’ve had a security breach, though he says that an incident like the one described is “absolutely one that would need to be reported.”
Triner also notes that the increasing pressure on contractors to deliver projects faster and at a lower price point is at odds with prioritizing safety and security. “Unfortunately, everyone is operating in a system where there are competing rules and incentives, and that existed before AI, but now it’s the same problem on speed,” says Triner.
The coding environment accessed by the Accenture contractor is run on the Non-classified Internet Protocol Router Network (NIPRNet), a DOD network used for unclassified information. While it does connect to the internet—contractors and employees can access their emails and web browsers through the network—it is heavily secured.
According to the source, in order to automate the process of writing code and spinning up cloud servers, the contractor gave their login credentials to the Claude agent. This gave the agent administrative access and allowed it to bypass the security controls enforced through the normal login process. The AI agent—which was not only writing code but also committing it or saving the code into the system on behalf of the Accenture employee—needed to connect out to the internet to perform its tasks. In doing so, it appears to have sent the contractor’s login credentials, passwords, and a map of NIPRNet out to a third party website.
WIRED is declining to name the third party website so as to protect the system from further vulnerability, but National Institute of Standards and Technology (NIST) has previously identified it as high risk because it has a vulnerability that could let hackers inject instructions into an AI coding agent to steal credentials.
The system the AI agent accessed contained CUI. “Information from a CUI environment is not supposed to leave that infrastructure,” says the source. “There is no insight about what happened to the information, including the login credentials, after it was sent to [that service], whether it’s been retained”
Depending on the agency and its work, CUI can include anything from personally identifiable information (PII) to proprietary business or contracting information. According to the DOD’s website, CUI can include information on “the securing and safeguarding of explosives, hazardous chemicals, or pipelines,” documentation related to the designs of “military or space equipment or technology;” and “the exact location and quantities of radioactive material.”
Distinct from the actual data, a map of it could be incredibly valuable to a hacker. “Once an attacker understands how those things fit together, even if those things are public information, what is sensitive is how we are putting those things together and turning that into actionable intelligence,” says Triner.
While a map might not get a hacker into a system, he says, it could help an adversary move faster once they do have access and “help an attacker understand where the crown jewels are.”
Jake Williams, a former NSA hacker and faculty at IANS, an intelligence and security consultancy, says that an AI agent running code in NIPRNet presents a “huge problem, and there are huge national security impacts.”
Williams notes that while individual pieces of data or information might be considered CUI, “when that unclassified information is aggregated, that can become classified itself.” For instance, the location of certain hazardous materials might be CUI, as might be information about the vulnerability of the facilities that house them. Combined, however, they could reveal information that would be kept classified.
But this is not the only way classified information may have been put at risk. Frequently, tools and code are tested in NIPRNet before being deployed into more sensitive systems like the Secret Internet Protocol Router Network (SIPRNet), the military’s secured network for classified information, and Joint Worldwide Intelligence Communications System (JWICS), a secure intranet for top secret information. Both SIPRNet and JWICS are air gapped, a security measure that means they are not connected to any outside networks. On a practical level, that means SIPRNet and JWICS would be extremely difficult for a hacker to access remotely.
But with the login credentials exfiltrated by an AI agent, a hacker could access NIPRNet and insert a backdoor or other malicious code into a tool or system. Without proper review, this code could end up deployed in one of the air gapped systems.
“The code could operate completely normally in NIPR and do something malicious and undisclosed in a SIPR network, that is 100 percent possible,” says Williams. Exfiltrating data out of these networks would be difficult, he adds, but malicious code could be used to attack the systems from the inside. “I think the most likely thing would be some kind of distributed denial of service attack,” he says.
Triner says that even something more subtle, such as slowing down intelligence operations and activities, could cause damage and make users lose trust in a tool, even once the problem is fixed.
As vibe coding, or prompting an AI assistant to write the code for a product described by an engineer, is becoming more common, vetting code is becoming more of a challenge. AI is capable of generating code at a volume that far surpasses human productivity, making it time consuming and difficult to vet.
“When you’re using an agent, you have no idea of the supply chain or even the inference chain of what has ultimately generated the code,” says Williams. “A lot of the code that these LLMs were trained on is itself vulnerable, and they can regurgitate the same kinds of architecture, and architectural issues that we see in other code.”
The government does have a way to identify flawed code in NIPRNet. Static Application Security Testing (SAST) scans code for bugs and flaws before allowing it to run. But Williams notes that a hacker-inserted “backdoor is not a vulnerability, even if we may not want it there,” and therefore would likely fly under the radar of SAST’s detection. SAST also does not usually identify structural issues in the logic chain of how code is created.
There’s no indication that hackers were able to get into a classified or top secret system. Still, Williams says, the incident should raise significant alarms. “Architecturally, any information about NIPR that you can’t see through open source intelligence, DOD considers a close hold regardless of whether something touches a classified network,” he says.
This is not the first time the DOD has been made vulnerable because of AI-related issues. Last year, ProPublica revealed that Microsoft was using “digital escorts” on its projects with the federal government, wherein American employees with security clearances would be overseeing code written by outsourced workers in China. Experts who spoke to ProPublica said that the program presented a particular security risk because the American employees were often not able to vet the code themselves, leaving openings for malicious code to be inserted unknowingly into government systems.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.