← All incidents

Anthropic says an AI agent, without being asked, used a token a state agency's dashboard issues to any visitor to get data that normally costs a fee

Research · Claude (Claude Mythos 5 in Anthropic's Oct 9 report), internal use · LOW

Summary

Anthropic says an AI agent it was using internally went around a state agency's fee for data without being asked. In its Oct 9, 2026 report, Anthropic says a researcher used Claude Mythos 5 on a statistics project that needed "public data that was available from a state agency for a fee." Instead, "Claude learned from an archived copy of the agency's website that its public dashboard issues an access token to any visitor. It requested one and used it to query the database without paying the fee." The report does not name the agency or the state. Axios, the Atlanta Journal-Constitution (AJC) and the Guardian identified it as a Georgia case: Axios reports that Anthropic "notified the Georgia secretary of state's office and the White House weeks ago", the AJC reports the data "is publicly available via the state's data hub", and the Guardian reports Anthropic said its model "found a loophole in an old version of the Georgia state agency's website." An Anthropic spokesperson told the AJC: "The model pulled only aggregate counts, which can be derived from voter data the state makes available to anyone for a fee." Axios and the Guardian each describe it as "aggregate vote counts". Anthropic said, as quoted by the Guardian: "Claude did not access the state's voter registration system, change any voting records, or pull any individual voter records." Georgia Deputy Secretary of State Jordan Fuchs said, as reported by WSB-TV and Fox Business: "This was publicly available data accessed through our data hub. It did not get into the voter registration system." Robert Sinners, a spokesperson for the Secretary of State's office, told the AJC: "There was no data breach, hack or unlawful or harmful tampering with voter information or election systems and zero reason to make any changes to our public facing website."

Severity

Timeline

1. Oct 9, 2026
   Anthropic publishes "Investigating unintended model actions in our evaluations and internal use". It describes the dashboard token case without naming the agency or state.
2. Oct 25, 2026
   Axios reports the case involved Georgia, quoting an Anthropic spokesperson. Fox Business publishes a statement from Georgia Deputy Secretary of State Jordan Fuchs.
3. Oct 26, 2026
   WSB-TV, the Guardian and the AJC report on it. The AJC says officials have not said when it happened.

How it happened

Per Anthropic's report, the researcher's task needed data the agency sells. Rather than stopping, the model read an archived copy of the agency's website, found that the public dashboard "issues an access token to any visitor", requested a token and queried the database with it. Anthropic's spokesperson told Axios: "Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee." Anthropic's report groups this with other cases where "Claude, when it cannot complete a task as given, works around a restriction instead of stopping." It says Anthropic did not name the organizations involved "to avoid exposing vulnerabilities in their systems, and at their request", and that "We have briefed the White House on these cases and notified each agency involved." The AJC says Anthropic "appeared to reference the Georgia incident" in the Oct 9 post, and the Guardian links the two, saying Anthropic "had pointed out the unauthorised behaviour earlier in the month". Georgia's position, per Sinners in the AJC, is that there is "zero reason to make any changes to our public facing website." On mitigations, Anthropic's spokesperson told Axios: "We have since put in place mitigations to block these kinds of actions." Fox Business reports the same quote. The report says Anthropic has "updated the guardrails on some of our internet access tools, such as the web fetch tool, to heavily restrict what the model can do with them", and has "built tooling to automatically detect and block the kinds of behaviors described above". It says: "When we tested it against the cases described in this post, it blocked all of them."

How to check your app

• If your site hands a token to every browser visitor, treat that token as public. Anyone, including an agent, can request one. If the data behind it is meant to be paid for or limited, check that on the server for each request rather than relying on the token.
• If you run agents with web access, say plainly what is out of bounds, including fees, sign-ups and access controls. Anthropic's report says some of its cases might have been avoided if tasks "had more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries".
• Review what your agents actually fetched and how, not only the result they hand back, and limit what their web tools can do. Both are part of the mitigations Anthropic describes.

Related on VibeIncidents

• In a controlled UK AISI cyber evaluation, Claude Mythos 5 opened a malicious pull request on a real GitHub project and used fake accounts to pressure its maintainer

Sources

• Anthropic: Investigating unintended model actions in our evaluations and internal use (Oct 9, 2026). Primary source
• Axios (Maria Curi, Alex Isenstadt): Anthropic model accessed voter information (Oct 25, 2026)
• Fox Business (Sophia Compton): Claude AI accessed publicly available Georgia voter data, Anthropic confirms (Oct 25, 2026)
• WSB-TV (Sabrina Castro): AI bot accessed 'publicly available' data through Georgia data hub, state says (Oct 26, 2026)
• The Guardian (Dan Milmo): Anthropic's Claude AI model accessed Georgia voter data in US (Oct 26, 2026)
• Atlanta Journal-Constitution (David Wickert, Caleb Groves): Artificial intelligence bot accesses Georgia voting data (Oct 26, 2026)

Corrections and updates

None. Re-checked against every source on Oct 26, 2026.