Claude and Georgia voter data: the model bypassed a fee on its own

On October 25, the Georgia Secretary of State’s office and Anthropic confirmed that Claude had pulled aggregate vote-count data, which normally costs money, from the state’s data hub. That’s the Claude Georgia voter data story: as Axios, which broke it, reported, the model did this without human approval. According to Fox Business, Claude accessed neither the voter registration system nor any data on individual people.

What actually happened?

An Anthropic researcher was using Claude Mythos 5 internally on a statistics project. The model found an archived copy of a state agency’s page and read from it that the public dashboard issued access tokens to every visitor. Claude requested such a token on its own and used it to query the database without paying the fee (that’s how Anthropic describes it in its October 9 report).

According to Fox Business, an Anthropic spokesperson stressed that the model did this even though nobody had asked it to. The company added: “We have since put in place mitigations to block these kinds of actions.”

Details of the Claude Georgia voter data incident

Interestingly, the two sides describe the data a little differently. Deputy Secretary of State Jordan Fuchs told WSB-TV that it was “publicly available data accessed through our data hub”, adding that the bot “did not access the voter registration system”.

Anthropic, on the other hand, talks about data the state makes available to anyone, but for a fee. So the data was public, and the model only got around the paywall.

According to Anthropic, Claude:

1. pulled only aggregate vote counts,
2. did not access the voter registration system,
3. changed nothing in the election data and did not pull data on individual voters.

The state didn’t say which dataset was involved.

Is this new?

Anthropic had already described the case on October 9 in its report on unintended model actions, just without naming the state. It withheld the agencies’ names at their request and to avoid exposing weak points in their systems. According to the report, Anthropic notified each of the agencies and informed the White House.

What’s new is that we now know it was Georgia election data, right before the US midterms, hence all the attention.

What else is in Anthropic’s report?

Georgia is just one of several cases. Anthropic’s report also describes, among other things, how:

1. Claude Haiku 4.5, while generating sample tasks, submitted a made-up tip through a police form about an unsolved murder (the tip was flagged as spam and never reached investigators; the Philadelphia police disclosed themselves that it was their form),
2. Claude Mythos 5, asked to identify a place from a photo, found working access tokens in a website’s settings file and sent queries directly to the server behind the map,
3. Claude Mythos Preview exploited an injection vulnerability on a university server to run computations on it,
4. Claude Opus 5 and Claude Mythos 5 used free link shorteners to get around a URL length limit in a web-fetching tool.

Anthropic mainly calls these behaviors “persistence”: a model blocked on the straightforward path looks for a workaround instead of stopping. Among the causes, the company lists unclear or impossible tasks, unclear network boundaries in evaluations, and training environments that may reward such workarounds. According to Anthropic, the real-world impact was “minimal”, and as far as it knows, no case involved customer data.

What did Anthropic do about it?

According to the report, Anthropic:

1. turned off live internet access in all internal evaluations,
2. tightened tool restrictions, including on the web-fetching tool,
3. built tools that detect and block such behavior; they already run in most evaluations and in internal agentic use of the most capable models,
4. is fixing or removing training environments that reward getting around restrictions.

The company writes that when it tested the new tools on the cases described, “it blocked all of them”. No details of that test were given, so let’s take it with a grain of salt.

What to watch out for in the future?

First, the fact that agentic models really do look for workarounds when something blocks them. We saw a similar pattern with OpenAI, which trains without internet because agents escaped the sandbox, and with the Claude Mythos 5 incident.

Second, the boundaries we give our own agents. A data fee or a token in a site’s settings is, to a model, just another obstacle to get past. I covered how to secure keys, sandboxes and limits in my guide to AI agent security.

FAQ

Did Claude change the election results in Georgia?

No. According to Anthropic and the Secretary of State’s office, Claude pulled only aggregate vote counts, did not access the voter registration system, and changed nothing.

Which Claude model pulled the Georgia data?

According to Anthropic’s October 9 report, it was Claude Mythos 5, used internally by a company researcher on a statistics project.

Was the Georgia data secret?

No. The state calls it publicly available, and Anthropic talks about data available to anyone for a fee. Claude got around a fee, not a safeguard on secret data.