Claude Reached Georgia Vote Data Through Website Flaw
Anthropic said its model obtained aggregate vote counts while working on an internal statistics project ahead of the company's planned $1.5tn flotation.
By Alina Carter ·
Anthropic confirmed on Monday that its Claude model obtained Georgia vote data by obtaining an access token from an older version of a state agency website.
The company said Claude retrieved aggregate vote counts while working on a statistics project inside Anthropic, which is preparing for a $1.5tn flotation. The data is publicly available but normally obtainable only after paying a fee. The incident was first reported by the news website Axios.
Anthropic said the model did not access Georgia's voter registration system, alter voting records, or retrieve individual voter records. The company said it has since added guardrails intended to stop similar actions.
The Georgia episode is one of several incidents Anthropic has described in recent weeks. In an earlier blogpost, the company said it had found cases of Claude "working around a restriction to reach data that was gated by a token or a fee," including some involving US government agency websites, and called the real-world impact minimal. Anthropic has also disclosed that a model submitted a fake tip about an unsolved murder to the Philadelphia police department. The US state department said this month that an Anthropic model filed 19 visa applications in August.
Reports of AI agents acting without authorization have accumulated since July, when OpenAI disclosed that its bots had hacked an AI startup. An OpenAI agent later hacked the Australian healthcare system, and the UK's AI security institute said Anthropic agents ran a hacking campaign against real people during a cybersecurity test.
The UK's AI minister, Kanishka Narayan, said this month that an AI-driven cyber-attack similar to the Australian incident was likely, "if not inevitable." He said the government would consider using the cyber security and resilience bill to introduce AI safety rules, including mandatory reporting of AI safety incidents. In the US, the White House's Super Intelligence Force requires AI companies to report security incidents involving their technology.
