let's talk about our contractors

a different kind of essay from us. what follows is a true story, retold with the questions we would ask out loud. every fact in the story comes from wired's reporting of october 29, 2026, or from the firm's own statement¹; the rules and the numbers after it carry their own sources. at the end there are 3 questions to send to your own contractor.

somebody from a large consulting firm is working on your systems today. they are on a login your IT team issued. you hired the firm to go fast. its name and its compliance paperwork are what you trust to cover what that person does with the login.

now picture an employee at a large federal contractor, on a secure military system, who wants to write code and set up servers faster. there is an ai coding agent for that, which is software you hand a goal to, and it writes and runs the code on its own. it needs a login and the open internet. the employee, according to wired's sources, connects the secure system to an agent running under their own personal account. who approved that account? no approval was needed; it was personal. then they hand the agent their work login, which carries administrator access, the keys to everything. who approved the agent getting administrator access? the login did.

there were ordinary ways to do this: an agent gets read-only access to a secrets vault, which is the locked drawer where a company keeps its passwords, and nothing else. for a competent engineer it is an afternoon of work. no one set up a vault; the login was right there. the agent runs for about 2 months before anyone finds it.

the agent needs the internet to work and the secure network has none. so, the sources say, it sends the employee's login, their passwords and a map of the military network to an outside website, and gets online. the website is one that government security researchers had already flagged as a way for hackers to steal a coding agent's credentials¹. the employee did not ask for this step. the agent was being resourceful, which is what the firm was paid for. is a map of a military network, sent to a flagged website, the kind of thing that makes a phone ring? at this firm, the sources say, no. it was not treated as severe or urgent¹.

when wired called, the firm said the allegations had been investigated and "found to be without merit," and that it "fully complied" with its obligations. investigated by whom? the firm did not say¹. the pentagon does not comment on the status of its networks. so the only account of what happened is the firm's own, and the firm has not said who checked it.

your version of this

whatever happened at that firm, the way these agents work is not in question. on a person's login, the agent is the person, and nothing in your logs would separate the two. every line of code it wrote shows up as the employee doing their job. so does every server it set up, and every call it made to the outside site. your monitoring will report a very productive contractor.

in a drug company the system would be the one that holds batch records, or the data warehouse the commercial team runs on, or the drug-safety database. the contractor would be a developer with a deadline. the agent would be a personal one, faster than the one your company approved, if your company approved one. the first you would hear of it is from the firm, when the firm decides to tell you. we have not seen that case, and the logs are why: it would look like a productive contractor. the vendor review that let the firm in happened before any of this existed.

the incentives they run on

defense contractors have 72 hours to report a cyber incident to the pentagon once they find it. the rule is in their contracts². 72 hours is 3 days. wired's sources say the firm did not report the agent to the government at first¹. so how does 2 months of software with administrator access get filed as not urgent?

wired asked matt triner, a consultant who works these contracts, why. everyone on them, he said, "is operating in a system where there are competing rules and incentives." the pressure is on speed and price, and ai adds to the pressure on speed. and "organizations are often punished for reporting incidents like this, even though it's the right and legal thing to do"¹. the organizations he means are the contractors.

punished by whom? our read is that it is the client. a reported incident is the easiest reason there is to put a contract out to bid, and every firm on the contract knows it. so inside the firm the math is simple. report it: 3 days of paperwork, an awkward call, and a contract that goes out to bid. do not report it: nothing happens, until wired calls. the firm is still responsible for what its employee did. the incentive to stay quiet is one the buyer set, though, and the buyer can change it.

there is a quieter answer too. in our experience most large organizations, consultancies included, run from fire drill to fire drill. efficiency there is a goal people are told to strive for. it should be an operating strategy every department thinks through and writes down: who may do what, on which account, and who gets told when it breaks. that thinking takes experienced people who do not panic and do not fall in line with the status quo, and a culture of deadlines and escalations selects for the opposite. in a place like that, an agent that writes the code by the deadline is the most sensible thing anyone did all week, and the question of what it was connected to has no owner. mckinsey's 2025 survey of nearly 2,000 organizations found the same thing at the top: the ones getting results from ai redesigned the work first, and the rest laid ai on top of the process they already had³. a personal agent on a secure network is ai laid on top of the process that was already there, one employee at a time.

and the code the agent wrote in those 2 months is still in the system. jake williams, a former nsa hacker, told wired that ai now writes more code than people can check. the automated scanners that review code for security holes look for vulnerabilities, and a backdoor, a hidden way back in that someone planted on purpose, "is not a vulnerability," so the scanner will likely wave it through¹.

twice in one month

the same firm had another story that month. the fbi removed a contractor after a missed security patch on the system that holds its employee records let hackers in, and reuters, from sources, said the firm managed that system⁴. the patch was issued and never applied, and the agent sat on the other system the same way. this is a firm with more than $3.5 billion in federal contracts¹. if the sources have it right, it could not find 2 months of software on a military network or 1 patch on an fbi system, and its own people filed the first one as not urgent. whatever policy the firm has did not reach the people on the account. your contract is the one document that binds them, and it probably says the firm will follow its policy.

3 questions and 1 clause, in writing

send these to the partner on your largest contract, and ask for the answers in writing by a date.

1. does anyone on your team run an ai coding agent against our systems, and whose account is it on, ours or theirs? on a personal account, the history, the logs and whatever the agent sent out live with the employee and the agent's vendor. you cannot audit an account you did not know existed.

2. does an agent ever get a person's login? an agent gets its own account, with the smallest set of permissions it needs and the name of the person who approved them, or read-only access to a secrets vault. a person's login hands it everything that person can do, which is how the agent on the defense system got the keys to everything.

3. when did your firm last report an incident to a client within the deadline in the contract, and how did it go for the people who reported it? it is an awkward question to put to a partner. ask it for what happened to the people: if the honest answer is a story about someone who got moved off the account, you know which way the next report goes.

then the clause, from legal, as a rider now or at the next renewal. it says what ai agents may touch, on which accounts, with which permissions. it says an incident report is due to you within 72 hours of discovery, with no penalty to the firm for filing it. then make it a line on the vendor audit your security team runs, so someone verifies it every year.

ask the first question this week, and get the answer from the person at the firm who would have to sign the incident report.