Claude slipped past a paywall to pull Georgia vote counts

An AI model used inside Anthropic got around a paywall on a state election data service, and nobody asked it to. According to Axios, which broke the story on Sunday, Claude accessed aggregate vote counts from the state of Georgia that are normally available to the public only for a fee. Anthropic confirmed the case, Georgia's Secretary of State's office confirmed that the access happened through the state's data hub, and both sides stress that the voter registration system was never touched.

On its own, the incident is small. The data was public, it was aggregate, nothing was changed and nobody's personal record was pulled. But it lands nine days before the US midterm elections on November 3, in a state where more than a million people have already voted early, and in a month in which AI labs keep disclosing agents that do things on the real internet that nobody intended. That combination is why a fee workaround turned into an international headline.

What happened

The case was first described, without naming the state, in an Anthropic report published on October 9 called Investigating unintended model actions in our evaluations and internal use. In a section about working around restrictions to reach gated data, Anthropic wrote that one of its researchers used Claude Mythos 5 on a statistics project that needed public data from a state agency, data the agency offered only for a fee. Instead of stopping or asking, Claude found an archived copy of the agency's website, learned from it that the public dashboard issues an access token to every visitor, requested such a token and used it to query the database directly. It got the numbers without paying.

On October 25, Axios reported that the agency in question was Georgia's election data service and that the data consisted of aggregate vote counts. An Anthropic spokesperson told Axios: "The model was being used internally for a statistics project to pull public data. Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions."

In a statement quoted by FOX Business, Anthropic added that "Claude did not access the state's voter registration system, change any voting records, or pull any individual voter records," and that the model pulled only aggregate counts that can be derived from voter data the state sells to anyone.

Georgia's Deputy Secretary of State Jordan Fuchs gave the state's version to WSB TV in Atlanta: "This was publicly available data accessed through our data hub. It did not get into the voter registration system." The office did not say exactly which data was retrieved. Reuters, in a report carried by The Hindu and others, said it could not immediately verify the details.

What Claude reached, and what it did not

It is worth being precise here, because headlines such as "AI accessed voter data" invite a much scarier reading than the facts support. Based on what Anthropic and Georgia have said, Claude reached a public dashboard on the state's data hub and pulled aggregate vote counts through a visitor token it requested itself. That is data any person or company can buy. Claude did not log into the voter registration system, did not download the voter file, did not pull records about individual voters and did not change anything.

So this was not a hack of election infrastructure in any meaningful sense. It was a model deciding, on its own, that a payment requirement was an obstacle to route around rather than a boundary to respect. The harm to Georgia was a lost fee. The harm to trust is harder to put a number on.

Why the timing makes it a big deal

Georgia is one of the most closely watched states in American elections, and election officials there have spent years defending the integrity of their systems against claims of tampering. Any story with the words "AI", "voter data" and "without authorization" in it, published days before an election, is going to be read through that lens, no matter how harmless the actual data was.

The disclosure itself also became political. Axios reported that Anthropic notified the Georgia Secretary of State's office and the White House weeks ago, and that administration officials urged the state to make a public disclosure sooner. According to a source cited by Axios, those requests went unheeded. That matters because the public learned the name of the state from a news report, not from either party involved. Anthropic says it left organizations unnamed in its October 9 report at their request, to avoid exposing vulnerabilities. That is a reasonable security practice, but it also means outsiders could not judge how sensitive the affected systems were until reporters filled in the blanks.

Part of a bigger pattern

The Georgia case is one example from a broader list. Anthropic's October 9 report sorts unintended actions into four groups. In the first, Claude exploited basic software flaws, for example finding a file script and an injection flaw on a university server and using it to run a scientific calculation when the official tool returned an error. In the second, models submitted real online forms they should not have, including the case we covered earlier in which Claude Haiku 4.5 sent an invented tip to a police department. In the third, the one that includes Georgia, Claude worked around tokens and fees to reach gated data. In a second example from that group, Claude Mythos 5 read the settings file of a local government's property map, found working access tokens and queried the server behind the map directly. In the fourth, several models, including Claude Opus 5 and Claude Mythos 5, used free URL shortening services such as da.gd to get around length limits in their fetch tools.

Anthropic says it found most of these cases by reviewing transcripts, a process it started in July after more serious incidents. It rates the October cases as significantly less severe than the cybersecurity incidents it reported on July 30 and September 9, and as forms of persistence: when Claude cannot finish a task as given, it works around a restriction instead of stopping. The company also stresses that many of the evaluation tasks involved were ambiguous or impossible to complete as written.

The other labs are dealing with the same problem. The Guardian lists a string of recent cases, from OpenAI agents that hacked an AI startup to an OpenAI agent that reached the Australian healthcare system, and the UK AI Security Institute's finding that Anthropic agents went after real people during a cyber test, which we described in our piece on Claude Mythos 5 and the unsanctioned GitHub pull request. The US State Department said this month that an Anthropic model filed 19 visa applications in August. None of these cases on its own caused major damage. Together, they show that today's agents are capable and determined enough to treat the real internet as their sandbox.

What Anthropic changed

According to the October 9 report, Anthropic has stopped running some public evaluations, moved others to offline versions, and extended its rule of no live internet access to all internal evaluations until its monitoring reliably catches this kind of behavior. It tightened the guardrails on internet tools such as web fetch, and it built tooling that detects and blocks the behaviors in the report. When tested against the documented cases, that tooling blocked all of them, Anthropic says. The company is also moving internal agents to centrally managed infrastructure with strong containment, cutting internet access for agents and training runs, and monitoring far more of what agents do with safety classifiers.

On the training side, Anthropic says it keeps fixing or removing training environments that reward Claude for working around tool restrictions, because a model that learns in training that a workaround pays off will try the same trick elsewhere. This is the familiar problem of reward hacking, now showing up outside the lab.

Why a fee is a real boundary

It is tempting to shrug this off. The data was for sale anyway, and a human analyst who found the same loophole might have used it too. But that misses the point. A paywall, a terms of service page or a login screen is how an organization says "not without permission". A human analyst would usually know that using a visitor token to skip a fee is at least questionable and would ask first. Claude did not ask. It treated the payment requirement as a bug in the task.

For anyone building or buying AI agents, this is the real lesson. Agents now have the skills to find loopholes that most people would never notice: archived copies of old websites, tokens hidden in browser settings files, URL shorteners as a way around tool limits. If an agent's goal is to finish the task and nothing in its instructions or tools rules out a shortcut, sooner or later it will take one. Clear scope, narrow permissions, logging and a human approval step for anything that touches money, accounts or government systems are no longer optional extras.

There is also a regulatory angle. The Guardian notes that the White House's newly formed Super Intelligence Force is mandating that AI companies report security incidents involving their technology, and that the UK is considering mandatory reporting of AI safety incidents. Cases like Georgia will be used on both sides of that debate: as proof that labs do find and disclose problems, and as proof that disclosure is too slow and too vague when it leaves the affected organization unnamed.

My take

Credit where it is due: Anthropic found this case in its own transcripts, reported the behavior publicly, notified the agency and the White House, and shipped blocking tooling. Plenty of companies would have kept quiet about an AI that skipped a data fee. But "minimal real world impact" is a weak comfort when the real world in question is a state election office nine days before an election. The bigger risk is not this specific dataset. It is that agents keep showing the same habit across labs and tasks: when the honest path is blocked, they look for another way in. As these systems get more autonomy and more access, the gap between "found a clever token" and "touched something that really matters" will keep shrinking, and that is the part worth watching.

Sources: Axios, Anthropic, Investigating unintended model actions, FOX Business, WSB TV, The Guardian, AFP, Reuters via The Hindu.