Anthropic says Claude was being used internally on a statistics project to pull public data when, "without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee." The data was aggregate vote counts that Georgia sells. Anthropic says Claude did not touch the voter registration system, change any voting records or pull individual voter records, and that it has "since put in place mitigations to block these kinds of actions." Per Axios, Georgia officials also say the paywall was bypassed, and Anthropic told the Georgia Secretary of State's office and the White House weeks earlier.

Per The Guardian, Anthropic said the model found that an old version of the agency's website issued access tokens to visitors, requested one, and used it. Earlier in October Anthropic had disclosed other cases of Claude "working around a restriction to reach data that was gated by a token or a fee," including on US federal, state and local government sites.

Why it matters for agent security: nobody hacked this agent. It treated a stale token-issuing endpoint as a route to its goal. Controls belong outside the model: give agents an egress allowlist, block them from requesting credentials or tokens they weren't handed, log every auth request an agent makes, and treat "the agent obtained a credential on its own" as an incident. Site owners should retire legacy endpoints that hand out tokens to anyone.