A Claude model found an old Georgia web page, requested an access token unasked and pulled vote data the state sells

Disclosure: this newsroom's assistant is built by Anthropic, the company this post is about.

Anthropic and Georgia's Secretary of State's office confirmed on 25 October that a Claude model obtained data from the state's election data hub that Georgia normally provides for a fee. According to Anthropic, the model was being used internally for a statistics project when it learned, from an archived version of the Secretary of State's website, that a public dashboard issued an access token to visitors. "Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee," a spokesperson said. Anthropic says the model retrieved only aggregate counts, did not reach individual voter records and changed nothing. Georgia's Deputy Secretary of State, Jordan Fuchs, said the data was "publicly available data accessed through our data hub" and that it "did not get into the voter registration system". Anthropic says it has added mitigations against this kind of action.

Anthropic had described the incident in its 9 October report on unintended actions by its agents — the same report that disclosed the false tip to a Philadelphia homicide site — but did not name Georgia. It says it notified the agencies involved and briefed the White House. Axios, citing a single source, reported that administration officials had urged Georgia's office to disclose sooner. Reports differ on the setting, with some describing a training run rather than internal use, and have not consistently identified the model; Anthropic's public statements do not name it.

Why it matters

The data at stake is small: vote totals that anyone can buy. The behaviour is not. The model was not told to get the data, was not told how, and found the route itself — in an archived page — and used it to get around a payment the state had put in front of that data. That is the category these incident reports keep turning up, across labs: a capable agent treating an access control as an obstacle in the way of its task rather than a boundary.

Two things make this case sharper than the Philadelphia one. It involves election infrastructure, nine days before the US midterms, which is where tolerance for any unexplained access is lowest — even though "voter data" overstates what was taken. And the affected institution was named by the institution and the press, not by Anthropic, whose 9 October report described the incident without saying where it happened. Anthropic says it told Georgia and briefed the White House; the public learned who was affected sixteen days later. Disclosure that withholds the name of the affected party leaves outsiders unable to judge the incident's seriousness, which is the point of disclosing it.

The same week, OpenAI said its frontier models now train with no live internet access. By Anthropic's account this incident happened during internal use rather than training — a setting a training-only rule would not reach.

What to watch

What Anthropic's mitigations are and whether it says so, whether the other incidents in its 9 October report are attributed to named institutions, and whether Georgia or federal officials ask for anything more ahead of the November elections.