She was denied bail.
The 25-year-old federal contractor was charged with leaking information regarding a 2016 Russian military intelligence cyberattack to The Intercept, an online news outlet.
She is accused of revealing classified information, used as the basis for an article published Monday by The Intercept, which detailed a classified National Security Agency memo. The NSA report, dated May 5, provides details of a 2016 Russian cyberattack on a US voting software supplier, though there is no evidence the hack affected any votes.
Assistant US Attorney Jennifer Solari said it is unclear how much material is involved in the case. Authorities are looking at two laptops, a tablet and four cellphones seized from Winner's home as well as spiral-bound notebooks.
The charge, willful retention and transmission of national defense information, could bring Winner up to 10 years in prison. She could also face a fine of up to $250,000.
Winner, dressed in an orange jumpsuit with the word "Inmate" on the back, spoke very little to Judge Brian Epps. She stood with her hands behind her back and said, "Yes, your honor" when asked whether she has gotten a lawyer.
Solari told the judge that Winner had admitted to FBI agents during her arrest that she sought out classified information.
According to Solari she told them she was "mad about what she had recently seen in the media" and she "wanted to set the facts right."
The US attorney also alleged that Winner once searched on her work computer, while she was still in the Air Force, for the phrase: "Do top secret computers detect when flash drives are inserted?"
And there was a notation in one notebook, Solari said in which Winner purportedly wrote, "I want to burn the White House down."
Winner's mother, Billie Winner-Davis, told the court her daughter had never been in any trouble and was at the top of her class throughout her school days.
Her stepfather said Reality Winner never expressed unpatriotic thoughts and "is a good person."
Twitter posts curtailed while at new job
The Intercept provided the US government agency with a copy of the document, according to the complaint. The news outlet later said it did not know the identity of the person who gave it the document.
Winner served in the Air Force from December 2010 to 2016, leaving as a senior airman who was a cryptologic language analyst.
She provided support to missions and received the Air Force Commendation Medal in 2016, which is for members who have "distinguished themselves by meritorious achievement and service."
Recently she was a contractor with Pluribus International Corp. in Augusta, Georgia.
On Twitter, Winner posted about leaks and regularly took to social media to blast President Donald Trump, though her Twitter activity dropped off significantly after she began working for Pluribus in February.
Winner posted under a pseudonym, Sara Winners, but didn't seem concerned with concealing her identity, using a photo of herself as a profile picture and posting a selfie in February.
Winner followed Edward Snowden, WikiLeaks, several accounts with links to the hacking collective Anonymous, and several "alt" government agency accounts that became popular after Trump's inauguration. Many of the accounts claim to be run by agency employees unhappy with Trump.