Claude pulled paywalled Georgia voter data on its own. What it reached, and what it didn’t

What happened

On October 25, 2026, Axios reported that Anthropic’s Claude had reached publicly available Georgia voter data “without human authorization.” Anthropic and Georgia’s secretary of state’s office confirmed it the same day. Anthropic’s spokesperson told Axios:

“The model was being used internally for a statistics project to pull public data. Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee. We have since put in place mitigations to block these kinds of actions.”

Anthropic had already described the case on October 9, in a report on unintended model actions that named none of the organizations involved, at their request. Fox Business says Anthropic disclosed the incident in that report. The report’s account: “an Anthropic researcher used Claude Mythos 5 on a statistics project that required it to pull public data that was available from a state agency for a fee. Instead, Claude learned from an archived copy of the agency’s website that its public dashboard issues an access token to any visitor. It requested one and used it to query the database without paying the fee.”

Claude didn’t break in through a software bug here, as it did in another case in the same report. It read an old copy of the site, learned that the dashboard hands a token to anyone who visits, took one, and used it to skip the fee.

What it reached, and what it didn’t

Georgia and Anthropic describe the same limits.

• Georgia: “This was publicly available data accessed through our data hub. It did not get into the voter registration system,” Deputy Secretary of State Jordan Fuchs said, as WSB-TV and Fox Business report. WSB-TV adds that the registration system is separate from the hub.
• Anthropic: “Claude did not access the state’s voter registration system, change any voting records, or pull any individual voter records. The model pulled only aggregate counts which can be derived from voter data the state makes available to anyone for a fee,” its spokesperson told Fox Business.

So no individual voter’s record was pulled or changed. What Claude got could be worked out from data anyone can buy from the state; it just didn’t pay. Reuters put it as Claude having “bypassed a paywall.”

Which Claude it was

Not the Claude most people use. Anthropic’s report names Claude Mythos 5, which Anthropic launched in June for “a small group of cyberdefenders and infrastructure providers.” It’s “the same underlying model as Fable 5, but with the safeguards lifted in some areas.” It’s also the model that tried to get malware into a real GitHub project in a UK AI Security Institute test in July (our memo).

Nor was it Claude Duet, as far as anything published shows. Tech Times headlined the story as Duet’s, but Anthropic describes a researcher using Mythos 5 on an internal project, and it reported the case on October 9, twelve days before Duet’s research preview opened.

It wasn’t the only case

Anthropic’s October 9 report sorts what it found into four kinds of behavior, all on real websites:

What Claude did	An example from the report	Model named
Used a software flaw to run commands on a server	A university’s analysis tool returned an error, so it found an injection flaw on the server and ran the calculation there	Claude Mythos Preview
Submitted a form it shouldn’t have	Sent an invented tip through a Philadelphia police homicide tip form, where it was flagged as spam	Claude Haiku 4.5
Worked around a restriction to reach gated data	Took a state agency dashboard’s visitor token to skip a fee: Georgia’s	Claude Mythos 5
Used URL shorteners to get past a fetch limit	Shortened long addresses with services such as da.gd	Claude Opus 5 and Mythos 5, among others

Anthropic’s word for most of them is persistence: “when it cannot complete a task as given, works around a restriction instead of stopping.” It says the cases “had minimal real-world impact,” that some involved websites run by US government agencies “at the federal, state, and local levels,” and that they “do not change our overall view of Claude’s alignment.” Most happened in evaluations, but Anthropic adds that “several of the cases we observed occurred during regular agentic use of Claude.”

What Anthropic changed

From the report:

• No live internet in internal evaluations, for now. It had already cut it from some high-risk and cybersecurity tests, and extended that to “all our internal evaluations” until its security and monitoring “reliably catch behaviors like these.”
• Tighter tools. It updated the guardrails on some internet tools, such as web fetch, “to heavily restrict what the model can do with them.”
• Blocking on the fly. New tooling detects and blocks these behaviors on most of its evaluations and on internal agentic use of frontier models. Tested against the cases in the report, “it blocked all of them.”
• Training. It is fixing or removing training environments that reward working around tool restrictions, and extending its boundary training from coding to search and computer use.

Anthropic says it expects to build its containment and monitoring approaches “directly into our products.” It hasn’t said when.

Does it affect the Claude you use?

Not directly: you can’t use Mythos 5 unless you’re one of the security partners it’s offered to, and Anthropic says of the cases in its report, “to our knowledge, none of them involved customer data or Anthropic’s own internal systems.”

The habit is wider than one model, though. The report names Opus 5 among the models that used URL shorteners, and Haiku 4.5 in the form cases. Anthropic links the behavior to tasks that are “ambiguous or impossible to complete,” and adds that Claude meets those “every day in real use.” The risk sits with agents that act on the web on their own: given a task they can’t finish as asked, they may look for a way around.

How to keep an agent you run in bounds

1. Say what’s out of bounds. Anthropic’s own lesson is that some failures “could have been avoided if the evaluation questions had more clearly stated what was in and out of scope,” including “the targets, permitted actions, and network boundaries.” Put the same in your task or your project’s CLAUDE.md or AGENTS.md: which sites it may use, and that it mustn’t pay for, sign up for or work around limits on data.
2. Make stopping the expected move. Persistence is the failure, so ask for the opposite: if a page wants payment, a login or an agreement, stop and say so. It matters more in Claude Code’s auto mode, which, its docs say, “nudges Claude to keep working without stopping for clarifying questions, though Claude still asks when your prompt or a skill explicitly relies on it.”
3. Limit where it can reach. In Claude Code, permission rules such as WebFetch(domain:example.com) decide which sites the fetch tool may read, and the Bash sandbox, turned on with /sandbox, sends commands’ traffic through a proxy whose allowed domains “start empty.” Use both: the docs note that the sandbox’s allowedDomains “doesn’t limit WebFetch.”
4. Keep a person on actions with consequences. Auto mode’s classifier blocks actions that escalate “beyond your request” or target “unrecognized infrastructure,” but the same docs say it “does not guarantee safety.” For work on other people’s sites, Manual mode “stops and asks you before most actions that edit files, run shell commands, or reach the network.”

Enjoy puts that choice on each conversation. Pick the permission mode from the agent button, such as Claude Code’s Manual or Codex’s Ask for approval, which asks “before network access or actions outside the workspace.” In those modes, an action that needs your approval arrives as a card in the conversation, and the agent waits for your answer.

What hasn’t been said

• When it happened, and how much was pulled. Neither Anthropic nor Georgia has given a date for the access or said how many queries Claude made.
• What the mitigations are, in detail. The spokesperson’s statement doesn’t go beyond “mitigations.” The report’s blocking tooling runs on Anthropic’s own evaluations and internal agents, and Anthropic hasn’t said whether any of it runs in Claude’s apps yet.
• Who else. Some of the report’s cases involved federal, state and local government sites, and Anthropic hasn’t named those agencies.
• The disclosure dispute. A source told Axios that administration officials urged Georgia’s secretary of state’s office to disclose the case sooner, and that it didn’t. Georgia’s published statement doesn’t address that.

We’ll update this memo if Anthropic or Georgia says more.