The Pentagon won't stop rogue AI with another memo

America needs a Pentagon that can move at the speed of technological change without handing sensitive information to anyone with a personal AI subscription.

That should not be too much to ask.

Yet a new report from WIRED raises troubling questions about whether the Defense Department can deliver on either.

According to the report, an Accenture contractor connected a personal Claude Code account to a Pentagon production environment used by multiple intelligence agencies. Sources told WIRED that the AI agent operated for roughly two months before it was discovered.

The system held controlled unclassified information — a category of government information that can include details about critical infrastructure, the propulsion systems of nuclear submarines, and our vulnerabilities to chemical and biological terrorism.

Now put that next to the duration: an unapproved agent with admin access, running inside that system for sixty days, with no one watching.

The contractor reportedly gave the agent login credentials so it could write code and spin up cloud servers. WIRED's sources said that access allowed the agent to bypass normal login controls and that it appeared to send credentials and information about the network to a high-risk third-party website.

Accenture disputes the allegations, but defense leaders do not need to wait for every disputed detail to be resolved before addressing the risk this story illustrates: What happens when powerful AI tools are easy to obtain personally, difficult to obtain officially, and capable of acting inside government systems?

A deadline is not a security clearance

I spent years in government before building technology companies, and the rationale for the behavior is evident to anyone who has worked inside an agency.

The approved path for new technology is slow on purpose and involves a tangle maze of jargon. Getting a new tool into a Pentagon boundary means an authority to operate. For a cloud service, that usually means FedRAMP — the government’s security authorization for cloud technology — plus a provisional authorization. Each step exists for a reason. Together, jumping through these hoops can take longer than executing the contract the tool was supposed to help with.

Meanwhile, the person doing the work has a deadline. They also have a personal subscription to a coding agent that does in twenty minutes what the sanctioned toolchain does in two days, if the sanctioned toolchain includes an agent at all. Claude is currently barred for Pentagon staff, so in this case, there wasn't an approved version of the tool to reach for.

That divide — between the authorized process and the unauthorized one — is where shadow AI comes from. Most people aren’t sitting at their desks plotting to leak government information. They’re trying to finish the work.

Policy memos won't fix this

The standard response to an incident like this is a memo reminding everyone that unapproved AI tools are prohibited. That memo already exists in almost every agency. It works about as well as the memos about personal email did (see: Hillary Clinton's email server).

The rules for reporting incidents like this one have long been in place. None of that helps much if the tool people actually want sits outside the boundary and the approved one shows up eighteen months later.

What works is making the sanctioned path faster than the unsanctioned one.

There was a time when everyone feared that piracy would kill Hollywood. The industry didn't beat it with lawsuits — it beat it with convenience. Apple and Netflix made legal streaming easier than stealing, and the piracy problem quietly dissolved. In other words, they used desire path engineering.

In practice, that means getting accredited agentic tools inside the boundary, with the controls that would have mattered built in.

A future of agent controls

What might the right controls look like, in a future where the government cannot ignore the reality of convenience that agents bring? Here are a few I might suggest.

First, an agent should get its own identity and should never borrow a person’s login. If something requires a human to sign in with a government security card, the agent should not get to piggyback on that access.

Second, permissions should be least privilege and scoped to the task. An agent writing code for one service doesn't need admin rights across the environment.

Third, every action must be logged in a place that a security team actually reviews. Two months is a long time for an agent to run unnoticed, and better logging is the boring fix for that.

Fourth, outbound connections from the agent go through an allowlist. If it needs to reach the internet, someone decided in advance which parts.

And finally, deploys to production need a human to approve them. The agent can draft and test as much as it likes. A person with accountability pushes the button.

None of this is exotic. It's the same discipline the government already applies to human admins, extended to software that acts like one.

It’s also urgent: Every agency team I talk to already has people using AI. The open question is whether that work happens on government-approved systems, where someone can limit access and review what happened, or on somebody’s personal account.

The contractor who plugged an AI agent into a Pentagon system wasn't trying to break anything. He had a deadline, and the only tool fast enough sat outside the wall. He didn't go rogue. He took the one path the ground left open. Build the faster road inside the boundary, and the next contractor won't have to choose.

Alex Cohen is co-founder and CEO of Statecraft. He previously worked in the Bureau of Indian Affairs.