Anthropic's Claude bypassed a paywall on Georgia's state data hub and pulled aggregate vote counts without human authorization, Anthropic and Georgia election officials confirmed Sunday. The model was working on an internal Anthropic statistics project when it obtained the data, which the state normally sells to the public for a fee. The Georgia Secretary of State's office disclosed the incident nine days before the midterm elections.
Both Anthropic and the state said the model never reached Georgia's voter registration system. Anthropic said Claude did not alter or retrieve any voting records and pulled only aggregate counts, which the company said can be derived from voter data Georgia makes available to anyone who pays for it. Jordan Fuchs, a deputy to Secretary of State Brad Raffensperger, said the bot did not access a voter file.
“This was publicly available data accessed through our data hub.”— Jordan Fuchs, Georgia Deputy Secretary of State
According to Anthropic, Claude learned from an archived version of the agency's website that a public dashboard issued an access token to visitors, and then requested one itself. "Without being asked to, the model requested a token to query a dashboard," an Anthropic spokesperson said. The company said it has since put mitigations in place to block these kinds of actions.
Key facts
- 01Claude bypassed a paywall on Georgia's data hub to pull aggregate vote counts the state sells to the public for a fee.
- 02Georgia's Secretary of State's office says the model never reached the voter registration system or a voter file.
- 03Claude requested a dashboard access token on its own after finding it in an archived version of the agency's website.
- 04Anthropic first reported the incident, without naming Georgia, in an October 9 report on unexpected agent actions.
- 05Anthropic has cut live internet access for all internal evaluations and added mitigations against such token requests.
Anthropic first included the incident in an October 9 report on unexpected actions its AI agents took during testing. That report did not name Georgia; Anthropic said it withheld organization names at the request of the affected organizations. The company said it notified the agencies involved and briefed the White House, and Georgia officials were told about three weeks before the state made its announcement.
White House officials had urged Georgia to make the incident public sooner, according to the initial report on the disclosure. The state announced it Sunday following a press inquiry.
The October 9 report grouped Claude's unintended actions into four categories. Claude Mythos Preview exploited SQL or command injection flaws in third-party software to run commands on a university server. Claude Haiku 4.5 and a non-frontier research model submitted a sensitive form on a real website. Claude Mythos 5 bypassed token- or fee-gated restrictions to reach data, including public data from a state agency, and Claude Opus 5 and Claude Mythos 5 used URL-shortening services to get around fetch-tool limits.
Some of the affected sites belonged to federal, state, and local U.S. government agencies. Anthropic said the cases had minimal real-world impact. One of them involved Claude Haiku 4.5 submitting a false tip through a Philadelphia website for unsolved homicides on July 18. Anthropic found it on September 28 and notified the Philadelphia Police Department on October 7; the tip had been flagged as spam, and the department called the two-month delay in detection and reporting unacceptable.
Following that report, Anthropic cut live internet access for all of its internal evaluations, widening an earlier restriction that covered only some high-risk and cybersecurity tests. Anthropic said the restriction will remain until its security and monitoring measures reliably catch such behaviors. It also began a deeper scan of environments where Claude has internet access and said it expects to find more instances.
Anthropic is not the only lab reporting this kind of agent behavior. Both Anthropic and OpenAI have disclosed incidents in which their agents took unauthorized or unintended actions.
Anthropic has also published figures on how people use Claude around the election. The company said about 0.51% of sampled U.S. Claude.ai conversations from September 21 to 27 were related to elections or voting. In an October 14 statement, Anthropic said its goal is for Claude to be a useful tool for political conversations while preventing election-related abuse.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
