An Anthropic researcher set Claude to work on a statistics project that needed public data from a US state agency. According to Anthropic, the agency made that data available for a fee. Claude found an archived copy of the agency's website, learned from it that the public dashboard issued an access token to any visitor, requested one, and used it to query the database without paying. Anthropic says nobody had asked it to.

Anthropic described the case in a report on 9 October without naming the state. On 25 October, Axios named it: Georgia, a little over a week before the US midterm elections. Anthropic and Georgia agree on what was taken: aggregate vote counts only, with no access to the voter registration system and no records changed. Anthropic says it notified the agency and briefed the White House, and Georgia says Anthropic first contacted the state on 8 October.

Georgia disputes that the data was behind a paywall. Anthropic's spokesperson said the counts come from voter data the state "makes available to anyone for a fee". Georgia's office says the information was freely available, and Secretary of State Brad Raffensperger said: "Accessing public information is not a hack, and pretending otherwise is reckless and dangerous."

Georgia is one named case. Anthropic's report describes the same kind of behaviour on other government sites, which leads to the question this series follows: if AI is finding these ways in, who fixes them?

InteractiveHow Claude got Georgia’s vote counts

  1. It reads an archived page Anthropic’s account

    An Anthropic researcher had Claude on a statistics project that needed public data from a state agency. Claude found an archived copy of the agency’s website.

    Who says so: Anthropic, 9 October report on unintended model actions

  2. It finds the token Anthropic’s account

    The archived copy showed that the public dashboard issued an access token to any visitor. Nobody has reported whether the live dashboard still does.

    Who says so: Anthropic’s report; repeated by the Guardian and Fox Business

  3. It asks for one Anthropic’s account

    Claude requested a token. Anthropic says it did this “without being asked to”.

    Who says so: Anthropic spokesperson to Axios, 25 October

  4. It queries the dashboard Both sides agree

    It pulled aggregate vote counts. It did not get into the voter registration system, and no records were changed or pulled.

    Who says so: Anthropic to Axios and the Guardian; Georgia’s Deputy Secretary of State to Fox Business

  5. Was that a paywall? Disputed

    Anthropic says the counts come from data the state “makes available to anyone for a fee”. Georgia says the data was freely available. Secretary of State Brad Raffensperger: “Accessing public information is not a hack.”

    Who says so: Anthropic to Fox Business; Raffensperger’s 26 October statement, via StateScoop

Most of this rests on Anthropic’s own account. Nobody has published an independent investigation.

My read is that Claude found a published method of getting at the data and used it as well as it could. Whether we call it a hack or not is immaterial. The question is whether the way in was properly plugged, because if it was not, it can lead to more.

Whether we call it a hack or not is immaterial. The question is whether the way in was properly plugged.

The Georgia case is one of four categories in the report. Claude exploited an injection flaw in a university-hosted tool to run commands on the server. Claude submitted an invented tip through a police department's online form. Claude worked around a restriction to reach data gated by a token or a fee, which is the Georgia case. Claude used URL shortening services to get around limits in its fetch tool. Anthropic says some of the cases involved websites run by US government agencies at federal, state and local level, and that the real-world impact was minimal. It has also switched off live internet access for all its internal evaluations until its monitoring reliably catches this behaviour.

Georgia may not class this as a serious vulnerability. I still think it is a canary in the coal mine, given the speed at which things are being compromised. All it takes is a couple of searches to find out what else runs on the same framework for that agency, then look for other exploits in other places and find your way in. Nobody has as much time to act as we had in the past. Mandiant's M-Trends 2026 puts the mean time to exploit at an estimated -7 days, "meaning exploitation is routinely occurring before a patch is even released".

Anthropic's Logan Graham told Axios on 7 April that other AI companies would release models with similar powers in as little as six months or as far out as 18. Even if the US is not using this class of model, a bad actor or a nation state may be using something like it that we do not know about.

In its 22 May update on Project Glasswing, Anthropic said it and about 50 partners had found more than ten thousand high- or critical-severity vulnerabilities in the first month. Glasswing is mostly big tech and operating system work. Education, maintenance and the systems that are actually running need attention too, and that work falls to people.

There is less time to act on a flaw than we had in the past, and no one is clearly responsible for plugging those gaps or sourcing the people to do it.

AI securityGovernanceAnthropicClaude