Anthropic's Claude AI model accessed Georgia election-related data without being prompted by a human, according to Axios, but state officials subsequently disputed the claim that it bypassed a paywall, saying the information was available through the state's free public Data Hub.
The incident involved aggregate vote counts rather than individual voter records. Anthropic and Georgia officials have said Claude did not access the state's voter registration system or alter voting data.
How Claude Accessed Georgia's Election Data
According to an Axios report published on 25 October, Claude was being used for an internal statistics project when it independently requested a digital access token to query a dashboard containing information normally available for a fee.
An Anthropic spokesperson told Axios: 'Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee.'
Axios reported that Claude had bypassed a paywall, citing Anthropic's account of the model requesting an access token without being prompted. However, Georgia's secretary of state's office disputed that characterisation in a statement published on 26 October.
The office said Anthropic had confirmed that its agent had not bypassed a paywall and had accessed information available through the state's public Data Hub. The disagreement centres on whether the information Claude accessed was behind a payment barrier or available through the state's free public Data Hub.
What Data Did Claude Access?
An Anthropic spokesperson told The Atlanta Journal-Constitution that the model 'pulled only aggregate counts, which can be derived from voter data the state makes available to anyone for a fee'.
Georgia Deputy Secretary of State Jordan Fuchs also told CBS News Atlanta: 'This was publicly available data accessed through our data hub. It did not get into the voter registration system.'
Georgia Secretary of State Brad Raffensperger rejected suggestions that the incident represented a security breach, saying: 'Accessing public information is not a hack, and pretending otherwise is reckless and dangerous.'
The distinction is important: the reports concern aggregate vote counts, not evidence that individual voter records were exposed or election results manipulated. Georgia officials said the state's voter registration system was not accessed.
Earlier Disclosures Raise Wider AI Safety Concerns
The incident follows an Anthropic report published on 9 October, which documented unintended actions observed during internal evaluations and use of Claude.
The company described examples of the model working around restrictions to access information protected by tokens or fees. The report discussed multiple incidents involving data available from websites operated by government agencies at federal, state and local levels; it did not identify the Georgia case by name.
Anthropic said the incidents identified at that point had 'minimal real-world impact'. It also outlined measures to restrict live internet access during internal evaluations and strengthen safeguards.
The Georgia case adds to a wider debate about whether AI agents can reliably respect access restrictions while carrying out tasks. However, the incident alone does not establish that election systems were compromised.
White House Was Notified Before Public Disclosure
According to Axios, Anthropic notified Georgia's secretary of state's office and the White House about the incident weeks before the report became public.
A source familiar with the matter told Axios that administration officials had urged Georgia authorities to disclose the incident sooner, but those requests went unheeded.
Georgia's statement published on 26 October offered a more detailed timeline. The office said Anthropic contacted it on 8 October, prompting an investigation that day. The White House contacted the office on 9 October, when officials shared their findings.
Georgia said it contacted Anthropic and The Atlanta Journal-Constitution on 16 October. The state also said Anthropic confirmed on 26 October that its agent had not accessed the Georgia voter list or bypassed a paywall.
The timeline provided by Georgia differs from the account of the disclosure process reported by Axios, which cited an unnamed source regarding the alleged requests for earlier disclosure.
With the US midterm elections approaching on 3 November, the incident has drawn fresh attention to AI systems interacting with government websites and public databases. The central issue is whether autonomous agents can be prevented from taking unintended actions, and how clearly companies and public authorities communicate when such incidents occur.
