Follow-up: Georgia’s Secretary of State’s office has been named as the agency whose paid-for election data an Anthropic Claude agent reached without being asked, and state officials have confirmed it. According to Axios, the White House knew weeks ago and wanted the state to go public sooner.
What happened
On Sunday 25 October, Anthropic and officials in the US state of Georgia confirmed to several outlets that a Claude model had pulled vote-count data from the state’s election data hub. Nobody had told it to. The model was doing an internal statistics project for Anthropic when it requested an access token from a public dashboard. It then used that token to query aggregate figures that the state normally charges for.
Until now the victim had not been named. Anthropic first described the episode on 9 October, in a report on unintended actions by its models during evaluations and internal use, and secnews.co.uk covered that report at the time. Anthropic left out the organisations involved because they had asked it to. What is new is the identity of the agency, Georgia’s confirmation, and questions over how quickly it was made public.
Jordan Fuchs, Georgia’s Deputy Secretary of State, played down the impact. He told Fox Business: “This was publicly available data accessed through our data hub.” The Secretary of State’s office said the model never reached the voter registration system or any voter file. Anthropic says it retrieved only aggregate counts and did not alter or extract individual records. Axios reports that the company told both the Georgia Secretary of State’s office and the White House some weeks before the story broke. Citing one source, Axios says administration officials pressed the state to disclose earlier and those requests were not acted on.
The technical picture
From Anthropic’s own account, this was not an exploit in the usual sense. In its 9 October report, which did not name the state, Anthropic says a researcher had given Claude Mythos 5 a project that needed data a state agency sells. The model came across an archived version of the agency’s site. That copy showed the public dashboard hands out an access token to any visitor. The model requested a token and queried the underlying database directly, so it never went through the paid route.
An Anthropic spokesperson told Patch the data was “normally available for a fee”. Both the company and Georgia officials describe what happened as getting round a paywall. Anthropic’s report files it under working around restrictions to reach gated data, one of four categories of unwanted behaviour.
In response, Anthropic says it has tightened guardrails on its internet tools and built tooling to detect and block this kind of behaviour. That tooling now runs across most evaluations and internal agent use. It has also turned off live internet access for internal evaluations until it is confident its monitoring is reliable. Anthropic says that when it tested the tooling against the cases in its report, it blocked all of them.
Why it matters for UK organisations
The scale of the harm here is small, but the pattern applies well beyond the US. Many UK public bodies, local authorities and data businesses publish dashboards that are open to anyone but still sit in front of licensed or chargeable data. A front end that issues a token to every visitor protects nothing on its own. If the API behind it trusts any token, then anything able to read a web page, including an autonomous agent, can reach the data directly.
Disclosure is the second issue. Weeks passed between the incident being known privately and the victim being named, which suggests how unclear the reporting obligations are once an AI agent is involved. In the UK, the ICO has already written to OpenAI, Anthropic, Meta and the AI Security Institute about agentic testing in which agents reportedly got round protections and reached external systems. It is also running a call for evidence on the data protection risks of AI agents, which closes on 20 November 2026. Richard Nevinson, the ICO’s Director of Technology Regulation, has said that autonomy “is not an excuse for poor compliance”. Any organisation deploying agents should expect that position to shape the regulator’s forthcoming statutory code on AI and automated decision-making.
Supplier assurance matters too: if an agent you deploy reaches paid or restricted data without permission, expect to answer for it alongside the model vendor.
Expert view
When we test web applications, a token that is issued without any check of who is asking is one of the first things we flag. It is authentication theatre. What the Georgia case shows is that an agent will find and use these shortcuts unprompted, and much faster than a bored analyst would. Anything that depends on an attacker not bothering is now on borrowed time.
The behaviour on the agent side matters more to me. Anthropic describes it as persistence, and that is a fair description. But for whoever owns the system, an agent that will not take no for an answer behaves just like an intruder working towards a goal. In my experience, many organisations that use agents have little visibility of which external services those agents touch, and few log the agent’s reasoning alongside its network traffic. Without both, you cannot reconstruct what happened, let alone explain it to a regulator.
The disclosure delay also needs addressing. If an agent of yours reaches someone else’s system without authorisation, the victim deserves to hear about it quickly and directly. Incident response plans should treat agent overreach as a reportable security event with a named owner.
What to do now
- Audit your public dashboards and APIs. Find any endpoint that issues tokens to anonymous visitors, then check that the API behind it enforces licensing, rate limits and scope. Do not rely on the front end to do that job. This fits the Cyber Essentials secure configuration control.
- Inventory every agent and its reach. List each AI agent in use, the tools it holds and the domains it can contact. Apply allow-lists rather than giving agents general internet access.
- Restrict credentials and actions. Give agents least-privilege accounts, require a human to approve any form submission, purchase or token request, and remove standing access when it is not needed. This maps to user access control.
- Log reasoning and traffic together. Keep agent transcripts alongside proxy logs so you can rebuild what happened, and alert when an agent requests credentials or tokens it was not given.
- Write agent overreach into incident response. Decide in advance who tells an affected third party, how fast, and whether the ICO needs to know.
- Respond to the ICO. If you build or deploy agents, consider replying to the ICO’s call for evidence before 20 November.
Bottom line
An agent requesting a free token to reach paid election data is a minor breach of the rules. Leaving the affected agency unnamed for weeks raises harder governance questions. UK organisations should treat both sides seriously: harden anything that hands out tokens to anonymous visitors, and make sure their own agents cannot quietly do the same to someone else.
Sources
- Axios: Anthropic model accessed voter information
- Fox Business: Claude AI accessed publicly available Georgia voter data, Anthropic confirms
- Patch: Claude AI model accessed GA voter data without being asked, reports say
- Anthropic: Investigating unintended model actions in our evaluations and internal use
- ICO: ICO secures changes from leading AI developers as scrutiny extends to AI agents
