WIRED: Contractor's Claude Agent Reached a Secure Pentagon System

A defense contractor connected Anthropic's Claude Code to a secure Department of Defense system, according to a WIRED scoop discussed on the latest episode of the publication's Uncanny Valley podcast. The case matters because it turns a governance question that has mostly been theoretical — what happens when a general-purpose coding agent is given reach into sensitive systems — into a reported incident inside the US government.

What did WIRED report about the Claude agent and the Pentagon?

On the episode, hosts Brian Barrett, Leah Feiger and Zoë Schiffer led with the story. Feiger described it as a scoop about how a defense contractor plugged Anthropic's Claude into a secure Department of Defense system, and called it one of the most outlandish uses of AI in government the team had seen so far. The episode summary states that the contractor connected Claude Code — Anthropic's coding agent — to the secure DoD system, and the companion WIRED article is headlined "A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System."

The published transcript does not name the contractor, identify the specific system, or explain how the connection came to light; those details belong to the separate WIRED article rather than the podcast conversation. What the episode does establish is the shape of the story: a personal AI agent built on a commercial coding model ended up with access to a system the Department of Defense treats as secure. You can read WIRED's write-up and listen to the full episode at wired.com.

What does Anthropic's IPO filing show?

According to Schiffer, Anthropic publicly filed for its IPO on Monday, a move the hosts had been anticipating. She said the company is expected to raise more money in its offering than any company in history, and that it would be the first major US company focused solely on building AI software to go public. Its valuation moved from $183 billion a little over a year earlier to $965 billion in its most recent round, and Schiffer noted some expect it to be worth close to $2 trillion once it starts trading.

The numbers in the filing are what make it a first real look inside a company that, as a private business, did not previously have to report them. Schiffer cited revenue of $16.3 billion in the first half of 2026, up more than 14-fold from the same period a year earlier, alongside billions of dollars in losses and hundreds of billions already committed to compute. Barrett noted that the risk factors section alone runs 94 pages. The hosts framed the filing as a test not only for the AI industry but for the wider US economy.

What are the yellow and red flags in the filing?

Barrett raised a yellow flag on concentration: nearly half of that revenue came from three tech companies' cloud marketplaces — companies that are also competitors building their own AI products. Schiffer agreed it was a vulnerability rather than a shock, and pointed to a Ramp figure she cited showing that roughly 80 percent of revenue for both Anthropic and OpenAI comes from about the top 1 percent of AI spenders. If those large spenders pull back, the exposure is direct.

On the green-flag side, Schiffer highlighted the filing's candor about risk, including language acknowledging concerns that sufficiently advanced AI systems, if not developed and safeguarded appropriately, could pose catastrophic or existential risks to humanity. Barrett counted the phrase "existential risk" three times — twice referring to humanity and once to society. The hosts also noted the filing's emphasis on enterprise coding as the engine of the business, with Schiffer describing Claude Code as the product that showed AI had a viable commercial case beyond consumer chat.

Why is recursive self-improvement both a warning and a selling point?

Barrett flagged what he called a red flag for humanity and a yellow flag for Anthropic: the filing names recursive self-improvement — a model improving the process that builds better models — as both a candidate cause of catastrophic outcomes and one of the company's competitive advantages. In other words, the capability the company warns about is also the capability it says it is investing in to stay ahead.

Schiffer connected this to former Anthropic researcher Jacob Coxon, who resigned and cited curbing recursive self-improvement at the top of his list of reasons, coverage WIRED also ran. Barrett mentioned that Senator Bernie Sanders and Representative Ro Khanna have separate bills that would ban the practice outright. The practical takeaway for readers is not that any of this is settled, but that the same technical direction is being described simultaneously as a business moat and a risk factor in a public financial document.

What else is in the episode?

Beyond the Pentagon scoop and the S-1, the episode covers the midterms, which Feiger noted were only days away. The segment looks at large groups of volunteers around the country preparing for the possibility that ICE officers show up at polling sites, and Feiger framed those grassroots efforts as a reflection of a deeply uncertain election cycle. It is a reminder that the same week produced both a landmark AI filing and a domestic political story with its own technology angle.

What does this mean for teams wiring agents into real systems?

The Pentagon story and the S-1's risk section are two views of one operational question: what an agent can reach, and what stops it from reaching further. A coding agent with credentials is not a chat window; it can read files, run commands and call services. Teams adopting tools in that category should be able to say, in plain language, which systems an agent can touch, what it can do there, and who reviews the output before it lands anywhere consequential.

That is a scoping and review problem more than a model problem. In Grafy, Grafy Code is the AI coding studio where that discipline starts — keeping work in a defined project rather than handing an agent broad access, and reviewing what it produces before it ships. For teams that expose an assistant to users, Bots is the embeddable option, and the design principle is the same: constrain the surface, then widen it deliberately.

Two pieces of our earlier coverage are useful background. Our report on the personal AI agent that reached Pentagon data covers the incident itself, and our look at autonomous agents that stop at a budget ceiling describes the general pattern of giving an agent a hard limit rather than trusting it to self-regulate. Neither replaces a security review. Both are ways to make the boundary visible before something crosses it.

Frequently asked questions

Did a contractor really give Claude access to a Pentagon system?

According to WIRED's Uncanny Valley podcast, a defense contractor connected Anthropic's Claude Code to a secure Department of Defense system, and WIRED published a companion article describing a personal AI agent given access to a secure Pentagon system. The podcast transcript does not name the contractor or the system, so those specifics should be read in the original WIRED article.

What is recursive self-improvement and why does it matter here?

It describes an AI system improving the process that produces better AI systems, potentially closing the loop without human review. On the podcast, WIRED's Brian Barrett noted that Anthropic's filing cites it both as a possible catastrophic risk and as a competitive advantage, which is why the hosts treated it as the most consequential item in the document.

How can I limit what an AI agent can reach?

Start by defining the smallest surface the agent needs — a single project, a single repository, a single data source — and review outputs before they are used anywhere sensitive. In Grafy, Grafy Code keeps coding work inside a project, and Bots limits an assistant to the content you give it.

---

Source: WIRED — AI — How a Contractor’s Claude Agent Got Into the Pentagon