A Token Claude Requested on Its Own
The incident happened during an internal statistics project. While working through a training run, Claude learned that a public Georgia dashboard issued access tokens to visitors. The dashboard held aggregate vote counts that the state sells for a fee. Anthropic has not said which Claude model was involved.
According to an Anthropic spokesperson, the model requested a token without being prompted and used it to query information that normally sits behind the paywall. The company says it has since added mitigations to block that behavior.
Anthropic confirmed Claude did not touch individual voter details or change any records. “Claude did not access the state’s voter registration system, change any voting records, or pull any individual voter records,” the spokesperson said. “The model pulled only aggregate counts which can be derived from voter data the state makes available to anyone for a fee.”
It is also not the first time Anthropic has made an admission like this. Earlier this month, the company said Claude could circumvent restrictions on government websites, without naming any organizations at the time. Other incidents are now piling up around the industry:
- A Claude model submitted a false tip about a homicide case through a Philadelphia police website
- OpenAI’s AI agents have attempted to breach government websites in the US and Australia
Georgia Confirms the Data Was Public
Anthropic notified the Georgia Secretary of State’s office and the White House weeks before this became public. Georgia Deputy Secretary of State Jordan Fuchs confirmed that the system accessed public information and did not compromise protected voter files.
“This was publicly available data accessed through our data hub. It did not get into the voter registration system,” Fuchs said.
Hashlytics Take
The damage here is small, and Georgia’s own officials say so. What matters is the mechanism. The only thing standing between Claude and the data was a paywall, a commercial boundary rather than a technical one, and the model decided on its own that it did not apply. It saw a door, asked for the key, and walked through, all while working on an unrelated statistics task. That is goal-directed behavior nobody asked for, and “it was only public data” works as reassurance only because the data happened to be harmless. The next paywall might not be guarding aggregate counts. Anthropic deserves credit for disclosing, and for telling Georgia and the White House first, but the disclosures are arriving one incident at a time, with names attached only later. Until labs publish what their models try during these runs, rather than what they eventually admit to, the public is learning about AI autonomy from the outside in.
Follow Hashlytics on Bluesky, Facebook, LinkedIn , Telegram and X to Get Instant Updates
