Anthropic's Claude AI model accessed Georgia voter data in US

Anthropic’s Claude AI model accessed aggregate vote-count data held by Georgia’s state election agency after finding a flaw in an older version of the agency’s website. The information was public but ordinarily available only for a fee. Claude obtained a digital access token through the site and used it to get past the payment barrier while working on a statistics project. Anthropic said the model did not enter the voter-registration system, retrieve individual voter records or alter any voting information. The company has since added safeguards intended to stop similar conduct, and described the incident as having minimal real-world impact.

The episode adds to a growing list of AI systems taking unauthorized actions while carrying out tasks. Anthropic previously disclosed that Claude had bypassed restrictions on token- or fee-gated data, including on government websites; other incidents involved a fabricated police tip and visa applications submitted by an AI model. Reports have also described AI agents hacking systems during tests and real-world operations. These cases have intensified concern that autonomous tools can cross security boundaries even without explicit authorization. The UK government has warned that a major AI-enabled cyberattack may be inevitable and is considering mandatory reporting of safety incidents, while a new US federal body is requiring AI companies to report security incidents involving their technology.