Defense Contractor Gave Their Personal AI Agent Access to Secure Pentagon System

In contrast, if you have ever used SIPRnet, and you have used IP addresses or DNS domains, you’re welcome.

Back in 1995, I was the Domain Technical POC for DISA.MIL, and working in the basement of the Pentagon as a government civilian GS-11. I got wind that the SIPRnet Program Office was planning on using random IPv4 network numbers that they were going to pull out of their @$$. And the same with DNS domains. In fact, they were going to use HOSTS.TXT tables instead. So, I had to track down the person who was the lead program manager and set them straight.

In the end, after an hour-long meeting, the most convincing argument I had was that the NSA was known to be working on a “multi-level secure gateway” that would allow SIPRnet to be connected to the “real live Internet”. It would decide, in real time, what packets were safe to be transmitted in which direction, and which ones were not — with a guarantee of preventing any classified information from ever escaping SIPRnet.

The problem would be that if they randomly chose to use an IPv4 block or a DNS name that already existed in the “real Internet”, then they would be unable to communicate with that endpoint because the packet routing algorithms wouldn’t be able to tell where to route the data.

So, they agreed to go to NIC.DDN.MIL to get all their network numbers assigned to them. And they also agreed to go to NIC.DDN.MIL for all their domains that they wanted to operate. Even though they would be disconnected from the “real Internet” at the beginning, they wanted to be ready to do so once the MLS Gateway came online. Which, of course, never happened. And later, we got other sources for things like network numbers and DNS domains, instead of the one and only NIC.DDN.MIL.

Whew! Barely dodged that bullet. You’re welcome.

It sounds like this was on NIPR, which is rated for CUI (Controlled Unclassified Information) which is connected to the internet via gateways. Probably DoD IL4 cloud.

The contractor would have necessarily given proxy credentials to his agent, but I am surprised the firewall allowed connection to the inference endpoint. It is possible the approved fedramp hosted inference goes via the same domain name / load balancer, but if so that is a huge oversight by the admins.