Two incidents from the past 48 hours read like a Halloween double feature. A defense contractor wired a personal AI coding agent into a Pentagon development system, and the agent ran for about two months before anyone noticed. Binance says its record $6.3 billion theft may have started on one compromised DevOps engineer's laptop. Both attacks entered through a connected agent or device outside security's control. Below is what happened, why your current stack misses the pattern, and the three moves we would make before the weekend.
The Agent on the Pentagon Network
According to WIRED's October 29, 2026 investigation, an Accenture employee allegedly linked a personal Claude Code account to a secure Department of Defense production environment and gave the agent administrative access. The environment ran on NIPRNet, the network for unclassified defense communications, and held controlled unclassified information. WIRED described it as a centralized system used by multiple intelligence agencies. Connecting it to a personal account was only the first problem.
According to WIRED’s sources, the contractor also supplied their login credentials to Claude Code, which allowed it to automate development, commit code, and provision cloud servers. The agent wrote and committed code under the employee's identity, so its actions looked like the employee's own. The result: this access allegedly let the Claude Code agent bypass controls that are normally enforced at authentication. Along the way, the agent appears to have sent the contractor's credentials, passwords, and a NIPRNet map to a third-party website NIST had already rated high risk because of a flaw that lets attackers inject instructions into AI coding agents. Accenture disputes the allegations and says an independent investigation found them without merit. The Pentagon declined to comment. The WIRED report does not establish confirmed exploitation or a compromise of classified networks.
If we strip away the headlines and media buzz, the foundational architectural flaw in modern organizations around agentic identity and permissions remains clear. A contract employee gave an autonomous agent production credentials, a route to the internet, and permission to write and deploy code. If the agent had been in anyone's inventory, it would not have run unnoticed for two months. No policy sat between the agent's decisions and the network. To any traditional endpoint security tool, the activity looked like a standard developer process making outbound HTTPS calls.
The Pentagon disclosed a separate breach weeks earlier. Attackers reached the Defense Manpower Data Center's HR system through a file-sharing weakness, with access running from October 2025 through July 2026. About 2.76 million living people and roughly 294,000 deceased people were affected. Nine months of dwell time on one system. Two months on the other. Detection keeps arriving late, and prevention with traditional tooling, all but impossible.
Binance: one laptop, ten chains, twenty minutes
Binance estimated the impact at $6.3 billion, with around $3 billion frozen, and pledged to cover all losses. TRM Labs reported about $6.36 billion leaving Binance wallets across 10 blockchains, and most of the funds were gone in about 20 minutes. TRM Labs and Chainalysis attributed the theft to North Korea's TraderTraitor unit, though Binance has not confirmed the attribution. Binance says investigators found no evidence of a private key leak.
Binance's initial investigation suggests a compromised DevOps engineer's laptop may have let the attacker reach a service container and submit unauthorized withdrawals. CEO Richard Teng has since said the attack involved more than one engineer's permissions, and TRM Labs says the cross-chain pattern points to a broader compromise of signing infrastructure. Either way, the way in was a trusted machine inside the perimeter.
The same week also brought a hardware version of the story. Trezor received a report of a Safe 5 wallet, bought in August from CryptoBilis, a Southeast Asian reseller Trezor has since dropped from its authorized network, allegedly implanted with an extra circuit board, a cellular module, and an antenna to capture on-screen data, including seed phrases, and send the data over mobile networks. Trezor has not yet examined the device but calls the report credible. Earlier in October, Ledger confirmed a hardware implant in devices sold through the same reseller. A trusted device arrived compromised, while the owners trusted it because of where it came from. Swap "hardware wallet" for "community MCP server" or "popular GitHub skill" and you have the exact agentic supply chain problem everyone is facing. How do you know who and what to trust?
Attackers strike at machine speed
Moving billions across ten chains in twenty minutes takes well-planned automation. TRM Labs says preparations began at least 36 hours before the theft, with transaction signatures obtained in advance. The attacker spent a day and a half getting ready and twenty minutes cashing out. Attackers are using the latest open-weight models, deploying agents and scripts to achieve faster, deeper, and more multi-chain and multi-step attacks, with minimal resources. Expect more incidents like these, with shorter gaps between first access and full blast radius. A response plan built on support tickets and Monday standups will most likely happen after the data and the money are gone.
What we would do before the weekend
If we had to secure every agent and endpoint before the weekend, here is the order.
First, build your inventory. Find every agent, MCP server, and custom skill touching your environment, including personal AI accounts tied to corporate credentials and tools installed by contractors. The Pentagon agent reportedly ran for two months before anyone caught it, in large part because there was not a record of the agent in the inventory. Your search has to reach developer laptops, IDE plugins, and local MCP configs, since most CMDBs never see those surfaces.
Second, cut unknown access. Once the map exists, revoke production and secrets access for anything unrecognized or unapproved. Save the ownership hunt for Monday. Rotate every credential an unapproved agent touched and treat those secrets as exposed. Personal AI accounts lose access to corporate credentials and production systems today.
Third, enforce at runtime. Approved agents change behavior. A prompt injection hidden in a README, an image, or a fetched web page turns a sanctioned agent into an exfiltration tool in one turn. Set policy at the action layer: which files an agent reads, which shell commands run, which MCP tools fire, and which destinations receive outbound data. A runtime guardrail stops an agent calling a known high-risk website before anything leaves.
Where Noma fits
Noma AI Security Posture Management finds agents, MCP servers, skills, and AI tools across endpoints, code, and cloud, shadow installs included, then maps each one's blast radius through the Agentic Risk Map. Noma AI-DR runtime guardrails sit inline with agent actions in tools such as Cursor and Claude Code. They inspect tool calls, shell commands, file reads, and outbound requests, and block unsafe actions before execution. Inventory tells you what exists. Runtime enforcement decides what runs.
Spend Halloween weekend handing out candy, not running incident response. Book a Noma technical walkthrough to see every agent in your environment, deploy Access Control, and enforce automatic runtime guardrails to stop the actions you would never approve.
