Anthropic’s Claude AI model bypassed a paywall to access publicly available aggregate vote counts in Georgia without human authorization, raising questions about how autonomous agents pursue assigned tasks and how organizations restrict their actions. 

The company confirmed the incident in an Oct. 25 statement. Anthropic said Claude did not access Georgia’s voter registration system or change or retrieve individual voter records. The company said it has since taken steps to block similar actions. 

Axios first reported the Georgia incident. 

Anthropic’s Oct. 9 research report described an unnamed state agency incident in which Claude, working on an internal statistics project, learned from an archived agency webpage that a public dashboard issued access tokens to visitors. The model requested a token and used it to query data normally available for a fee without paying. Axios subsequently identified the state as Georgia, with confirmation from Anthropic. 

The Oct. 9 report also outlined other types of unintended behavior observed during testing and internal use, including exploiting software flaws, submitting forms and working around restrictions on data access. 

Security and privacy experts commenting on the incident identified two related concerns: weaknesses in internet-accessible systems and agents taking steps their users never authorized. Their assessments differed, however, on whether the activity should be characterized as hacking. 

A website weakness meets an agent’s persistence 

Ray Walsh, digital privacy expert at Comparitech, said the incident appears to demonstrate how AI agents can accelerate the discovery and exploitation of existing system flaws. 

“The agent did bypass the paywall, but only because an underlying access-control vulnerability made it possible,” Walsh said. 

He distinguished the retrieval of publicly available information from the theft of private data. The agent’s assignment was to gather data, he said, but it independently found a method for avoiding the payment restriction. 

Whether that conduct amounts to hacking is a question for investigators closer to the case, Walsh said. 

Scott Miserendino, chief technology officer at DataBee, a Comcast company, offered a more skeptical assessment of that characterization. 

“This hardly qualifies as hacking,” Miserendino said. “The AI used an existing public endpoint to create a visitor account.” 

In his assessment, the agency responsible for the website should have fully retired older versions that allowed free visitor access if it no longer intended to support that access. 

“The AI did not do anything nefarious here,” he said. “It was just thorough in its attempt to complete a legitimate task.” 

Paul Bischoff, consumer privacy advocate at Comparitech, also emphasized organizations’ responsibility to address weaknesses in their systems. AI’s ability to find and exploit vulnerabilities depends on those vulnerabilities existing in the first place, he said. 

“Every company with internet-accessible resources, products, and services should be using AI to scan their systems for vulnerabilities before cybercriminals do,” Bischoff said. 

Available does not mean authorized 

Erin Hamm, chief data officer at DataBee, focused on the distinction between a technically reachable resource and an authorized action. 

“The data was public but it sat behind a fee,” Hamm said. “Any person would have understood that fee as a boundary. An agent treated it as an obstacle.” 

Hamm argued that organizations often govern agents as they would human users, assigning permissions and establishing policies while assuming the systems will follow the intended limits of a task. 

“Agents have goals, not intent,” she said. “A goal plus a path that is reachable is enough for that agent to cross the boundary a human wouldn’t.” 

Walsh said the same capacity to discover a workaround could have broader consequences when agents are deliberately directed to attack systems. Their ability to work quickly and continuously could increase the chances of finding exploitable flaws, he said. 

His recommendation extends beyond filtering malicious requests. Agents also need limits that cause them to stop before taking an unauthorized step while carrying out an otherwise legitimate assignment. 

“The key takeaway is that once an AI agent is given a task, it may attempt to complete that task using methods that nobody specifically authorised,” Walsh said. 

Anthropic expands its safeguards 

Anthropic said the cases covered in its research report had minimal real-world impact. It nevertheless expanded restrictions on live internet access during internal evaluations and introduced monitoring designed to detect and block the behaviors. 

The company said that tooling blocked all the described cases when tested against them. It is also modifying training environments that reward models for finding ways around restrictions.  

For Walsh, the incident underscores the need for limits on how agents carry out their assignments. 

“This makes it essential for AI agents to be given strict limitations on the kinds of instructions and actions they can carry out,” he said, “with systems in place that either reject those instructions or, in the case of this Georgia incident, force them to stop and ask: ‘I can do this, but should I?’ before proceeding.”