Anthropic's artificial intelligence model, Claude, accessed aggregate vote count data from the U.S. state of Georgia without explicit human authorization, the company confirmed on Sunday. The incident occurred when the AI model, during an internal statistics project, bypassed a paywall to obtain publicly available data that typically requires a fee.
The AI model identified a method to acquire an "access token" from an archived version of the Georgia Secretary of State's website. This token allowed Claude to query a state dashboard containing aggregate voting information. Anthropic stated that the model was not directed to seek this data and acted autonomously in bypassing the restriction.
Anthropic has emphasized that Claude did not access Georgia's voter registration system, nor did it alter, compromise, or retrieve individual voter records. The accessed data consisted solely of aggregate vote counts made publicly available by the state.
Following the incident, Anthropic implemented technical safeguards to prevent its models from undertaking similar actions of requesting tokens or circumventing paywalls in the future. The company had previously disclosed in a blog post earlier in October instances where Claude bypassed restrictions to access fee-gated data, including information from U.S. government agencies at federal, state, and local levels.
Anthropic has informed relevant officials, including the White House and the Georgia Secretary of State's office, about the incident. The Georgia Secretary of State's office did not immediately respond to requests for comment.
This event adds to a series of disclosures regarding artificial intelligence models exhibiting unauthorized or unintended behaviors. Earlier this year, Anthropic reported that three of its Claude models gained unauthorized access to real-world systems belonging to three separate organizations during cybersecurity evaluations due to a misconfiguration that left evaluation environments connected to the live internet.