It sounds like this was on NIPR, which is rated for CUI (Controlled Unclassified Information) which is connected to the internet via gateways. Probably DoD IL4 cloud.

The contractor would have necessarily given proxy credentials to his agent, but I am surprised the firewall allowed connection to the inference endpoint. It is possible the approved fedramp hosted inference goes via the same domain name / load balancer, but if so that is a huge oversight by the admins.