A contractor's personal AI agent sat inside a sensitive Department of Defense system for roughly two months, and nobody noticed. If that can happen on a network that holds information about nuclear submarine propulsion, it can happen on yours.
I spent much of my career in cybersecurity, defense and intelligence before ProLion. This story doesn't surprise me, and it shouldn't surprise you. The problem isn't that AI agents are dangerous. It's that most organizations still can't see who, or what, is touching their most sensitive data.
What happened
According to WIRED's reporting, summarized by AI Weekly on October 29, 2026:
- An Accenture staffer connected a personal AI coding-agent account to a secure DOD system used by several intelligence agencies.
- The agent ran on the network for about two months before anyone identified it.
- It appears to have sent information about the system, including login credentials, to a high-risk third-party website.
- The system holds Controlled Unclassified Information (CUI), a category that can include critical infrastructure, submarine propulsion and chemical-biological threat vulnerabilities.
Still unknown: which site received the credentials, whether anyone used them, and how the agent was finally caught. A security source told WIRED the exposure put everything in the system at risk.
Why two months went by
The agent didn't break in. It walked in through a trusted user's credentials, so every perimeter control saw a legitimate employee doing legitimate work.
That is the defining risk of shadow AI. A bring-your-own agent inherits all of its human's permissions, works around the clock and moves data faster than any person. Acceptable-use policies don't stop it, and network tools see an authorized session.
The only place the behavior looks different is at the data itself: what is being read, how much, how fast, by which identity, and whether that pattern matches the human it supposedly belongs to. Most regulated organizations have no live view there, especially in on-premises and air-gapped environments where cloud-native security tools can't reach.
How ProLion would have changed the outcome
ProLion would have turned a two-month blind spot into an alert measured in minutes. Our Data Security Posture Management platform runs fully on-premises, including air-gapped, and connects agentlessly by streaming data events, so it sees every read, write and copy against sensitive files as it happens.
- Discover: Mapped where CUI actually lives across file shares, so nothing sensitive sits outside the watch list
- Classify: Tagged CUI, credentials and configuration files, so access to them carries the right weight
- Access: Showed which identities can reach that data, exposing an over-privileged account before it was misused
- Monitor: Recorded every access by that identity, giving a full forensic trail instead of open questions
- Detect: Flagged machine-speed, round-the-clock activity that no human analyst produces
- Respond: Blocked the offending identity automatically, stopping further access while the team investigated
To be clear about scope: ProLion doesn't replace egress filtering or endpoint controls, and it wouldn't see the outbound web request itself. What it does is make sure an AI agent can't quietly read sensitive data for weeks, which is where this incident should have been caught.
This is why we're building AI-Trust: so regulated organizations can say yes to AI agents on their own terms, with a sovereign, on-prem record of exactly what each agent touched.
What to do this week
You don't need to wait for new DOD guidance to act. Five steps for CISOs and AI transformation leads:
- Find your crown-jewel data. If you can't list where regulated data lives on-prem, you can't protect it from an agent.
- Review who can reach it. Every account with broad access is a potential agent host.
- Set a behavioral baseline. Know what normal human access looks like, so machine-speed access stands out.
- Give people a sanctioned path. Banning AI drives it underground; approved, monitored agents beat shadow ones.
- Rehearse the response. Decide in advance who can lock an identity, and make it automatic for clear-cut cases.
The bottom line
AI transformation is coming to every regulated organization, whether it is sanctioned or not. The organizations that move fastest will be the ones that can prove their on-premises data stays secure, sovereign and AI-safe while they do it.
That's ProLion's mission. If you want to see how we'd spot an unsanctioned agent in your environment, talk to our team and we'll walk you through it on your own data.
Sources
- A defense contractor gave their personal AI agent access to a secure Pentagon system, WIRED
- Accenture Staffer's Claude Agent Ran Two Months on DOD Network, AI Weekly, October 29, 2026
