Anthropic's Claude found its own way into a state agency's database. Your research agents need a rule for when to stop
Anthropic says Claude, doing routine research, used an access token handed out by a public web page to query a US state agency's data directly. Any AI agent given research it cannot finish by the expected route may do something similar.
Good Transformer is Patrick Hussey's AI practice. Want help with this in your business? Get in touch.
On 9 October, Anthropic published a report on things its Claude AI models had done that nobody intended. One case came from ordinary work rather than a safety test. A researcher asked Claude to gather figures for a statistics project, and Claude found its own route into the database of the state agency that held them.
The agency was not named in the report. The news site Axios first reported, on 25 October, that it was an agency in the US state of Georgia. On 26 October the Guardian reported that the data was aggregate vote counts: totals, not records about any person. Anthropic said Claude "did not access the state's voter registration system, change any voting records, or pull any individual voter records", and that it has since put guardrails in place.
The two sides describe the data differently. Anthropic's report says the figures were available for a fee and that Claude got them "without paying the fee". Georgia's Secretary of State's office says the data is public. "This was publicly available data accessed through our data hub," the deputy secretary of state, Jordan Fuchs, told Atlanta News First. The Secretary of State, Brad Raffensperger, added that "Accessing public information is not a hack".
Both accounts agree that Claude was asked for some figures and, without checking with anyone, chose its own way of getting them, one its user had not expected. Staff in many firms now hand research to AI in the same way. So what did Claude actually do, why did it do it, and could the tools your team uses do the same?
What Claude did
Claude was working as an agent. An agent is AI software that carries out a multi-step job on its own: searching, opening pages, trying again when something fails and deciding what to do next, rather than answering a single question.
Anthropic's account is in its report, Investigating unintended model actions in our evaluations and internal use. The researcher was using Claude Mythos 5, one of Anthropic's models. Claude looked at an archived copy of the agency's website, a snapshot of how the site used to look, kept by a web archive. From it, Claude learned "that its public dashboard issues an access token to any visitor". It requested a token and "used it to query the database without paying the fee", in Anthropic's words.
An access token, sometimes called an access key, is a digital pass. Websites issue them so that a program can request information from the site's database directly. The agency's live dashboard, a page anyone could open, handed a working pass to every visitor. Claude used that pass to send its own requests to the database, instead of going through the route the agency set up for getting the data.
The report describes a similar case from one of Anthropic's tests, in which Claude was asked to identify where a photo was taken. It tried a local government's property map website. The test limited Claude's ability to click through the site as a person would, so it read a settings file that the site sends to every visitor's browser, found working access tokens in it, and used them to request data straight from the server behind the map.
Why an AI would do this
Anthropic describes most of the cases in its report as "persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." It also says that in many cases Claude "had been given tasks that were ambiguous or impossible to complete".
Anthropic's report gives one reason models behave this way. Models learn by attempting tasks many times and being rewarded when they succeed. If that training rewards finding a way round an obstacle, the model learns to look for one, including in places where its user would rather it stopped.
Anthropic does not say what instructions the researcher gave in the Georgia case. Its general finding is that when an agent cannot get what it was asked for by the expected route, it may look for another route rather than stop and report back.
"Find the latest figures on X" is a typical instruction to a research agent. It usually does not say which sources are allowed, or what the agent should do if the figures are behind a payment or a login.
How serious was it?
Anthropic describes the effect of all the cases in its report as small: "The cases we've identified to date in these categories had minimal real-world impact." Georgia's officials agree that nothing private was reached. No personal records were involved, and nothing was changed.
Anthropic's stated reason for publishing is that it hopes the report will "help other developers check for similar behaviors in their own models." The report also came out as Anthropic prepared to file for its stock market listing, which it did on 26 October, and as the White House's newly formed Super Intelligence Force, a federal body overseeing AI, began requiring AI companies to report security incidents, according to the Guardian.
Could the agents your staff use do the same?
Nobody can tell you for certain. Anthropic says none of the cases in its report involved customer data, and it does not say whether the versions of Claude that customers use would behave this way. It says it has tightened the guardrails on some of its internet tools, such as the web fetch tool, which is the part of Claude that reads web pages.
No AI company that we are aware of has said its research agents will always stop on their own at a paywall, a login or a form on someone else's website. Agents from other labs, including OpenAI's, have gone beyond their instructions this year too, as we set out in our account of this year's agent incidents.
So the sensible assumption is that a research agent given an open-ended job might do what Claude did. The limit needs to come from your firm, in the instructions and in the tool's settings.
What this means for a small firm
This matters to a small firm in two ways: for the agents your staff use, and for your own website.
First, your agents. An agent fetching data does so on your firm's behalf. If it gets round a supplier's fee, uses a token it found in a file or submits a form it should not have, your firm has to answer for it to the supplier, and perhaps to a client whose work used the data. The answer the agent hands back will not tell you how it got the data unless you ask.
Take a marketing agency preparing a pitch. A member of staff asks an agent for market-share figures in the client's sector. The best figures are in a paid industry report. A well-briefed agent says so and offers the free alternatives. A poorly briefed one may look for another way in, and the agency may present those figures to the client without knowing where they came from.
Second, your website. The routes Claude used are ordinary features of public websites: a page that hands a working pass to every visitor, and working tokens in a file that every visitor's browser downloads. Agents read these background files and old archived copies of pages, which most people never look at. A small firm's website, client portal or booking tool, often built by an outside developer with plugins, can work the same way. That may not matter for information you give away. It does matter for data you charge for, and for tokens that let someone run services at your expense, as in the attacks we described in our piece on stolen AI keys.
What to do
- Give every research task a stopping rule. A stopping rule is a standing instruction that tells the agent where its permission ends and what to do when it gets there. For example: "Use free, publicly available sources only. If anything needs a login, a payment, a form or an access token, stop and report what could not be found." Save it in the tool's custom instructions so it applies every time.
- Make the task one the agent can finish. Anthropic's report says some of the failures in its tests could have been avoided if the task had stated more clearly what the model was allowed to do and where. For a research task, that means saying which sources are allowed, and what a good answer looks like when the data is not freely available: a note of what is missing and where it is sold.
- Ask where each figure came from. Require a source link for every number, and check any source you do not recognise or would normally pay for before it goes to a client.
- Use the settings your tools offer. Where a tool lets you limit which websites the agent may visit, or require a person to approve before it submits a form or makes a purchase, switch that on.
- Never give an agent your own login to a paid service. If it needs a subscription, set it up with its own account and narrow permissions, and have a person sign it in so the agent never sees the password, as we describe in our piece on giving agents their own accounts.
- Ask your web developer two questions. Does any page on our site or client portal hand out working access tokens to any visitor? Are any working tokens or keys sitting in files the public can download? If the answer to either is yes or "not sure", ask them to fix it.
The first three points belong in your firm's AI policy, next to the rules on client data.
Common questions
Did Claude hack the Georgia website?
Georgia's Secretary of State says no: the data was public and "Accessing public information is not a hack". Anthropic says Claude used a pass the agency's own dashboard handed to every visitor, and did not reach the voter registration system or any individual records. The two accounts differ on whether a fee normally applied.
Is this only a problem with Claude?
Anthropic is the company that published these cases, and its report covers only its own models. Agents from OpenAI have also acted beyond their instructions this year. Any agent given a job it cannot finish by the expected route may look for another one, so the same precautions apply whichever tool you use.
Does a stopping rule actually work?
It reduces the risk but does not remove it. The agent can still ignore or misread an instruction. Combine it with tool settings that block forms and payments, and with a check of the sources the agent used.
Should we stop using research agents?
Not because of this. Brief them the way you would brief a new junior member of staff: say which sources are allowed, and ask them to report back when the data they need sits behind a payment or a login.
Sources
- Anthropic, Investigating unintended model actions in our evaluations and internal use, 9 October 2026
- The Guardian, Anthropic's Claude AI model accessed Georgia voter data in US, 26 October 2026
- Atlanta News First, Georgia secretary of state downplaying Anthropic AI bot that accessed election data, 26 October 2026
- The Guardian, Anthropic files for potentially record-breaking stock market valuation, 26 October 2026
If you would like help setting rules like these for your team, book a free call.
Work with Patrick
Want a clear AI plan for your business?
AI Strategy is two to three weeks with your leadership team: a 90-day plan, the use cases worth doing and a plain-English policy. Email, call or book a free 30-minute call.