Brief · Builders

Your Personal Claude Account Doesn't Know It's Clocked In

By alkizz · Oct 29, 2026

WIRED's Vittoria Elliott reported on Oct 29, citing anonymous sources, that an Accenture contractor connected a secure DOD production environment on NIPRNet to their personal Claude Code account and handed the agent their own login, which gave it administrative access. Per WIRED, the agent ran for two months and "appears to have sent" the contractor's login credentials, passwords, and a map of NIPRNet to a third-party website that NIST had flagged as high risk for prompt injection. WIRED doesn't name the site, so that part can't be checked, and nobody has reported what happened to the data afterward. No other outlet has independently confirmed the story, and Accenture says the allegations were investigated and "found to be without merit." So treat the details as unconfirmed, but the setup it describes is worth checking on your own network.

What your account type actually changes

• Personal (Free, Pro, Max). Consumer terms. Anthropic may train on your data if that setting is on, and retention is 30 days, or 5 years if you allow model improvement. You get no SSO, SCIM, or audit logs, and none of your company's server-managed settings.
• Team. Commercial terms, the company is the data controller, SSO and JIT provisioning, and the option to verify a domain and block new personal accounts on it. SCIM and audit logs are Enterprise-only.
• Enterprise. SSO, SCIM, audit logs (exports cover the past 180 days; chat titles and content aren't included), the Compliance API, custom retention, and the company is the data controller.
• API. Commercial terms with no training unless you opt in, and Console organizations get SSO and provisioning. But managed settings bind Claude Code only, so a developer calling the API from another tool isn't under them.

The part that doesn't change is the local machine. Anthropic's docs set the permission and sandbox model per machine and per settings file, not per plan. My reading (the docs don't say this outright) is that a personal login on a work laptop is the same agent on the same machine. It just runs without your SSO, your audit logs, or any policy you deliver only from the claude.ai console. Policy you deploy to the device itself still applies. And the personal account brings its own connectors.

Those connectors are the bigger gap. Anthropic's own help center uses this exact example: with the setting off, someone can "sign in to Claude with their personal account and connect the Gmail account they use for work." The Microsoft 365 connector works on every plan, Free included, though it needs a work or school Microsoft account and a Microsoft admin's tenant consent. Personal plans have no Claude-side admin gate for it. On Enterprise, "Restrict verified-domain connectors to your enterprise" blocks that for about 20 listed connectors, Microsoft 365 and HubSpot among them, but only for new connections.

The app side doesn't close it either, and HubSpot, a CRM, shows why. An admin can control who installs the Claude connector, and "users can access only the data allowed by their existing HubSpot user permissions." But HubSpot's docs show no way to allow a company Claude account and block a personal one. The only per-account block is on Claude's side, and it's Enterprise-only: "Claude Enterprise admins can restrict users from connecting HubSpot to Claude accounts outside their Enterprise organization." On a personal Pro or Max plan, there's no company admin on the Claude side to set that block. HubSpot is just one example. Every other corporate app someone connects to Claude raises the same question, and per-app controls would mean solving it again, app by app, in a zillion places.

My take: This is a very hard problem for businesses that either can't afford or don't know the Claude tiers that give them control over what it can do with their applications. A compromised personal identity of an employee who uses a private Claude account alongside a corporate one now gives the attacker access to all the corporate applications that account is connected to. Not good. I've lived a version of this. Years ago Lizard Squad hacked me through InfraGard Atlanta, and because I'd reused passwords, they got my LinkedIn and X accounts too. Same situation, different accounts. Part of the fix is upgrading your Claude plan, but that can be hyper-expensive for most businesses. This is a real business problem sitting right next to a security exposure, which is a very bad mix. I don't know the answer, but I think this is an exposure to watch.

What to do:

• Push policy to the device, not just the console.

  • Why: server-managed settings are only delivered to accounts in your organization, so a personal login never sees them. Settings deployed through a managed-settings.json file or MDM apply to Claude Code on that machine whoever is signed in.
  • How: deploy managed settings through your device management tooling. The docs warn that a developer who's an admin on the machine can edit the managed source, so local admin is part of the problem.

• Pin logins to your organization.

  • Why: Claude Code reports an error and exits at startup if the claude.ai credential belongs to an organization you haven't listed.
  • How: set forceLoginMethod and forceLoginOrgUUID in managed settings through MDM, since only a managed source enforces forceLoginOrgUUID and you can't redirect a first login with server-managed settings. Know the documented gaps: claude setup-token and /install-github-app enforce only forceLoginMethod, so they can mint a token in a different organization, and the login screen pre-selects a method without enforcing it.

• Claim your domain.

  • Why: personal accounts on your company email domain are the easiest kind to shut off.
  • How: on Enterprise, domain capture lets you claim and migrate existing personal accounts on a verified domain, after which no non-Enterprise accounts can exist on it. On Team you can verify the domain and turn on "Restrict organization creation," which blocks new Claude or Console organizations on it, personal accounts included. Domain capture is Enterprise-only and can't be undone. The docs don't cover a personal account signed up with a non-company email, so this doesn't close everything.

• Block other tenants at the proxy.

  • Why: on your corporate network, it catches the personal account that domain capture misses, on web, desktop, API key, and OAuth traffic.
  • How: Tenant Restrictions (Enterprise and Console organizations) has your proxy inject anthropic-allowed-org-ids with TLS inspection, and blocked requests get a 403 tenant_restriction_violation.

• Give agents their own identity.

  • Why: per WIRED, the agent ran on a person's admin login, which bypassed the normal sign-in controls.
  • How: give coding agents their own scoped credentials, keep them on managed accounts, and allowlist what they can reach outbound.

Sources

• WIRED, Vittoria Elliott: "A Defense Contractor Gave Their Personal AI Agent Access to a Secure Pentagon System" (Oct 29, 2026)
• Claude Code docs: Data usage
• Claude Code docs: Settings
• Claude Code docs: Server-managed settings
• Claude Code docs: Managed settings
• Claude Code docs: Authentication
• Claude Code docs: Settings reference
• Claude Help Center: Set up single sign-on (SSO)
• Claude Help Center: Set up JIT or SCIM provisioning
• Claude Help Center: Access audit logs
• Claude Help Center: What is the Enterprise plan?
• Claude Privacy Center: Does Anthropic act as a data processor or controller?
• Claude Help Center: Claim and migrate accounts on your domain
• Claude Help Center: Enforce network-level access control with Tenant Restrictions
• Claude pricing
• Claude Help Center: Restrict verified-domain connectors to your enterprise
• Claude Help Center: Set up the Microsoft 365 connector
• Claude Help Center: Get started with custom connectors using remote MCP
• HubSpot Knowledge Base: Set up and use the HubSpot connector for Claude
• HubSpot Knowledge Base: Manage access to apps

← All briefs