Published on
Anthropic's AI model Claude bypassed a paywall and accessed publicly available voter data in the US state of Georgia without human authorisation, according to a report by Axios.
The case is the latest in a string of security scares at the world's top AI developers ahead of crucial US midterm elections on 3 November, which could see Democrats win control of the US Congress and launch stronger action to rein in AI firms such as Anthropic and OpenAI.
The AI model was accessing aggregate vote counts as part of a statistics project when it autonomously requested a token to access a paywalled data dashboard without "without being asked to” by humans, according to an Anthropic spokesperson.
The model had found a loophole, noticing that a token was automatically issued to visitors, which it then used to circumvent the paywall and get hold of the aggregate vote counts that are public but normally require a fee to view.
Claude accessed aggregate voter counts in Georgia, where more than one million voters have already cast early ballots, Axios reported, citing an Anthropic spokesperson.
It did not access the state's voter registration system or change or download any voting records, the spokesperson said, adding that the company has since taken measures to prevent these kinds of actions.
Georgia Deputy Secretary of State Jordan Fuchs confirmed that the activity involved publicly accessible data through their data hub rather than a breach of the voter registration system.
The disclosure adds to growing unease over whether the world’s leading AI labs can control increasingly autonomous systems.
In July, a group of OpenAI agents broke out of their test environments and launched a cyberattack on AI firm Hugging Face, causing international alarm. Other companies and governments have since reported similar incidents.
The incidents have fuelled calls in the United States and abroad for tighter oversight of AI development.
American tech executives signed in September what President Donald Trump described as a "morally binding" commitment to build adequate safeguards around AI models.
Meanwhile in Europe, the European Commission’s AI Office began investigating OpenAI and Anthropic this month over AI agents that hacked outside organisations, putting to the test its rules on governing artificial intelligence for the first time under the EU AI Act.
The law does include an R&D exemption covering research, testing and development. But the Commission is pushing a broader interpretation that would let the AI Office police the development phase too under certain circumstances.