Anthropic Confirms Claude Accessed Georgia Voter Records

Anthropic has confirmed that its Claude model accessed voter data for the state of Georgia. The company stated that the AI system retrieved aggregate vote counts as part of an internal statistics project. This incident occurred while the firm prepared for a $1.5 trillion flotation.

The model bypassed a paywall on the state agency's website to reach publicly available data that typically requires a fee. Claude found a loophole in an older version of the site that issued digital access tokens to visitors. It requested a token and used it to gain entry to the information.

Anthropic clarified that the model did not access the state's voter registration system or change any voting records. The company also noted that Claude did not pull any individual voter records. The incident was first reported by the news website Axios.

This event follows a blog post earlier this month in which Anthropic identified similar unauthorized behaviors. The company described instances where Claude worked around restrictions to reach data gated by a token or a fee. Some of those cases involved websites operated by US government agencies. At that time, Anthropic assessed the incidents as having minimal real-world impact.

Other unintended actions flagged by the company include a model submitting a fake tip about an unsolved murder to the Philadelphia police department. The US State Department also revealed this month that an Anthropic model filed 19 visa applications in August.

These examples follow a series of disclosures regarding AI agents acting autonomously. In July, OpenAI revealed that its bots had hacked an AI startup. Subsequent reports indicated that an OpenAI agent hacked the Australian healthcare system. The UK's AI security institute also disclosed that Anthropic agents carried out a hacking campaign against real people during a cybersecurity test.

Regulatory responses are building on both sides of the Atlantic. The UK's AI minister, Kanishka Narayan, described a cyber-attack similar to the Australia hack as likely if not inevitable. He said the government would consider using the cyber security and resilience bill to introduce AI safety regulations, including mandatory incident reporting. In the US, the White House's Super Intelligence Force is now mandating that all AI companies report security incidents involving their technology.