The AI instead accessed aggregate vote counts through a loophole in an older version of the website, which issued access tokens to visitors. The AI requested this access token, received it, and gained access to the data. 

Did Claude AI Hack Voter Data?

Comparitech’s Digital Privacy Expert Ray Walsh explains, “The incident in Georgia appears to be evidence not of rogue AI agents acting of their own volition to steal private data, but rather evidence that AI agents are capable of massively accelerating the discovery and exploitation of existing flaws in systems. In this specific case, Anthropic researchers were carrying out an internal statistics project by using Claude to gather useful data for that purpose. Unfortunately, it would appear that in carrying out that request, the agent was able to discover a way to access aggregate voting data for free by bypassing the paywall.

“This does not mean that the agent accessed data that was not already publicly available. Anthropic could have simply paid for its agent to access that data. What happened instead is that the agent was able to discover an archived version of the government website, noticed that the website issued access tokens to visitors, and then independently worked out how to use one of those tokens to access the data behind the paywall.

“The agent did bypass the paywall, but only because an underlying access-control vulnerability made it possible. It is true that the agent had not been specifically instructed to bypass the payment restriction: its job was simply to gather data. However, it ultimately did so using a discovered method that many people will feel amounts to theft. Whether this really does amount to hacking is a question for investigators closer to the case.

“I think it is important to play this case forward, because it serves as excellent circumstantial evidence about how agents could perform if instructed to hack by their users. Due to AI agents’ ability to work quickly and around the clock, the chances of discovering underlying flaws that can be exploited for the purpose of hacking could increase significantly. This stands to greatly speed up the work of nefarious actors.

“This makes it essential for AI agents to be given strict limitations on the kinds of instructions and actions they can carry out, with systems in place that either reject those instructions or, in the case of this Georgia incident, force them to stop and ask: ‘I can do this, but should I?’ before proceeding. The key takeaway is that once an AI agent is given a task, it may attempt to complete that task using methods that nobody specifically authorised, unless the companies behind autonomous AI agents develop and deploy strict limitations to prevent this kind of behaviour.

“In this case, the agent independently discovered a way to bypass a paywall without anybody instructing it to do so. However, without the underlying access-control vulnerability, the agent would not have been able to complete that objective in such a straightforward manner.”

This event follows several other instances of AI models breaching organizations or websites without human knowledge or intent.

• OpenAI Agent Breaches Australian Government Health Service
• A Fourth Claude Model Escaped Guardrails
• Security Experts Discuss the Hugging Face, OpenAI Incident

Erin Hamm, Chief Data Officer at DataBee, A Comcast Company, states, “This is not a story about a single model or a single agent. It is a story about the gap between what is available and what is authorized. The data was public but it sat behind a fee. Any person would have understood that fee as a boundary. An agent treated it as an obstacle. Access control tells you who is allowed in. It says nothing about what a system will decide to do in order to finish its assigned task. Most organizations are still governing agents the way they govern users. They set permissions, write a policy, and assume intent will follow. Agents have goals, not intent. A goal plus a path that is reachable is enough for that agent to cross the boundary a human wouldn’t.”

Paul Bischoff, Consumer Privacy Advocate at Comparitech, concludes, “The question should not be, ‘how did Anthropic breach voter records?’ It should instead be, ‘what did the state of Georgia do wrong to allow this breach?’ Anthropic is not magic. It's good at finding vulnerabilities and exploiting them, but the vulnerabilities must exist in the first place. In other words, this could have been prevented.

“Every company with internet-accessible resources, products, and services should be using AI to scan their systems for vulnerabilities before cybercriminals do. LLMs have accelerated the pace of cybersecurity, and many more vulnerabilities will be discovered over the next few months. This is going to be a rough transition and Georgia won’t be the last casualty.”