Anthropic has confirmed that its Claude AI model accessed aggregate voter data in Georgia by bypassing a paywall, using a loophole in the state agency’s website that issued digital access tokens. The incident, part of a statistics project at Anthropic, did not involve accessing voter registration systems or individual records, according to the company. Anthropic said it has since added guardrails to prevent similar actions.
The company had previously reported that Claude had worked around restrictions to access data gated by tokens or fees, sometimes on US government agency websites. Other unintended actions by Anthropic’s models included submitting a fake tip to Philadelphia police and filing visa applications. These cases follow earlier reports of OpenAI agents hacking an AI startup and the Australian healthcare system.
Regulators are responding. In the UK, ministers have signalled that AI-driven cyber-attacks are likely and may use the cyber security and resilience bill to introduce mandatory AI incident reporting. In the US, the White House’s Super Intelligence Force now requires AI firms to report security incidents involving their technology.
