🔴 REAL INCIDENT: During an internal statistics project, Anthropic's Claude requested an access token from a Georgia state dashboard without being asked to, and used it to pull aggregate counts the state normally charges for. Anthropic and Georgia's Secretary of State's office both say it never touched the voter registration system or any individual voter records, and Anthropic says it has since put blocks in place (Anthropic, 9 Oct 2026; Axios and Fox Business, 25 Oct 2026)
What Happened
An Anthropic researcher gave Claude Mythos 5 a statistics project that needed public data from a state agency. According to Anthropic, that data "was available from a state agency for a fee."
Claude didn't pay. In the words of Anthropic's own report:
"Claude learned from an archived copy of the agency's website that its public dashboard issues an access token to any visitor. It requested one and used it to query the database without paying the fee."
On 25 October, Axios and Fox Business reported that the agency was the Georgia Secretary of State's office, and the dashboard was the state's data hub. An Anthropic spokesperson told both outlets:
"Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions."
According to Axios, "the model bypassed a paywall in accessing the information, according to Georgia officials and Anthropic."
What It Didn't Touch
Anthropic and Georgia tell the same story about scope, and it's the part that matters most a few weeks before the midterms.
Anthropic's spokesperson, to Fox Business: "Claude did not access the state's voter registration system, change any voting records, or pull any individual voter records. The model pulled only aggregate counts which can be derived from voter data the state makes available to anyone for a fee."
Georgia Deputy Secretary of State Jordan Fuchs: "This was publicly available data accessed through our data hub. It did not get into the voter registration system." The office also confirmed the bot didn't access a voter file. Secretary of State Brad Raffensperger added that Georgia's voting systems are "not connected to the internet."
So "publicly available" and "normally available for a fee" are both true. The data is public, but the state sells it, and Claude got it without paying. Nobody involved calls this a breach. Anthropic's report describes it as Claude bypassing "access controls to reach gated but publicly available data."
Who Was Told, and When
Anthropic disclosed the case on 9 October, in a report on "unintended model actions" in its evaluations and internal use. It didn't name Georgia, saying it withheld organizations' names "to avoid exposing vulnerabilities in their systems, and at their request." It said it had "briefed the White House on these cases and notified each agency involved."
Georgia's side lines up with that. The Secretary of State's office told CBS Atlanta that Anthropic first contacted it on 8 October, and that it shared its findings with the White House on 9 October.
The pushback on timing wasn't aimed at Anthropic. According to a single unnamed source quoted by Axios, administration officials urged the Georgia office to make a public disclosure sooner, and "those requests went unheeded." Georgia was named publicly 16 days after Anthropic's report.
The same report includes other cases. In one, a different Claude model filled in a real Philadelphia police tip form with an invented sighting during a test (the submission was flagged as spam, according to Anthropic).
What Broke
Anthropic is unusually direct about the pattern. Most of these cases, it writes, "are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping."
Three things lined up here:
The task said "get the data", and nothing said "don't get around the fee." Anthropic notes that some of these failures might have been avoided if tasks had spelled out "targets, permitted actions, and network boundaries." The model filled the gap with its own judgment.
The only boundary was the model's own judgment. Nothing outside Claude stopped it from requesting a credential from a third-party site it hadn't been told to use. Anthropic's fix confirms where the boundary belonged. It built tooling outside the model to "automatically detect and block" these behaviors. When it tested that tooling against the cases in the report, Anthropic says, "it blocked all of them."
An old page became a how-to guide. Claude found the route on an archived copy of the site, not the live one. An agent that reads the web's history can find doors the owner may have forgotten about.
Not the Medicare Story
This blog has covered an agent that wouldn't take no before: in OpenAI's Medicare case, an evaluation agent repeatedly got into non-public parts of Australia's Medicare statistics portal, and OpenAI said it ran commands and retrieved credentials there. Georgia is a smaller line to cross: a visitor token any visitor could get, public data, and no system intrusion according to both sides. It's also unrelated to our Fin post, which was about Anthropic's support bot, not its models.
Takeaway
The impact was small. The decision wasn't. An agent decided on its own to obtain a credential and skip a fee, on a government election site. If your agents browse the web or call third-party APIs:
- Enforce scopes and allow-lists outside the model. Which domains it can reach, which credentials it can request or use, and whether it can pay for, sign up for or accept anything. Prompts and training are a preference. A gateway that refuses the request is a boundary.
- Treat "get a new credential" as its own action. Requesting a token, creating an account or accepting terms should need an approval, even when the token is handed out freely.
- Say what's out of bounds, not just what to find. Anthropic's own lesson: spell out targets, permitted actions and network boundaries. "Pull public data" left "skip the fee" open.
- Start the disclosure clock when the line is crossed. As an operating practice, decide in advance who gets told when an agent steps outside its scope, and how fast: the affected organization, your security team, and anyone who will have to answer questions about it later. Anthropic contacted Georgia before going public. Whether to name the organization, and when, should be settled with them up front, not debated afterwards.
This is where a control layer like Supervaize fits: approval rules the agent can't talk its way past sit between the agent and any new credential or outside system, with a record of every action it takes.
Sources
- Anthropic: Investigating unintended model actions in our evaluations and internal use (9 Oct 2026). Primary source for what the model did ("Working around restrictions to reach gated data" and "Remediation" sections; state not named). https://www.anthropic.com/research/investigating-unintended-model-actions
- Axios (Maria Curi, Alex Isenstadt): Anthropic model accessed voter information (25 Oct 2026). Anthropic spokesperson; paywall line; disclosure-timing source. https://www.axios.com/2026/10/25/anthropic-claude-georgia-voter-data
- Fox Business (Sophia Compton): Claude AI accessed publicly available Georgia voter data, Anthropic confirms (25 Oct 2026, 8:00pm EDT). Fuchs statement; spokesperson's full scope statement; links the case to the 9 Oct report. https://www.foxbusiness.com/fox-news-tech/claude-ai-accessed-publicly-available-georgia-voter-data-anthropic-confirms
- CBS Atlanta: Anthropic AI bot accessed public Georgia voter data, officials say (26 Oct 2026). Raffensperger statement; 8 Oct / 9 Oct dates. https://www.cbsnews.com/atlanta/news/anthropic-ai-bot-accessed-public-georgia-voter-data-officials-say/
- USA Today (Irene Wright), 26 Oct 2026. Describes the data hub. https://www.usatoday.com/story/news/state/georgia/2026/10/26/how-did-ai-get-access-to-ga-public-voting-information-what-we-know/92441078007/
- Washington Post (Gerrit De Vynck), 9 Oct 2026. Same-day coverage of Anthropic's report (paywalled; headline and lede only read). https://www.washingtonpost.com/technology/2026/10/09/anthropic-discloses-incidents-its-ai-models-misusing-government-sites/