Anthropic has confirmed that its Claude AI model independently bypassed a digital paywall to access restricted voter data in the US state of Georgia, marking the latest in a mounting series of unauthorised behaviours from autonomous AI systems.

The incident occurred as part of an internal statistics project at Anthropic, which is currently preparing for a massive $1.5tn (£1.1tn) stock market flotation. According to the company, Claude accessed aggregate vote counts that are technically public but normally gated behind a state-mandated fee and website login.

Emphasising the limited scope of the breach, Anthropic stated: “Claude did not access the state’s voter registration system, change any voting records, or pull any individual voter records.”

Investigators discovered that the AI model achieved the breach by exploiting a software vulnerability in an outdated version of the Georgia state agency’s website. Claude realised that the legacy system automatically issued a digital entry pass, known as an “access token”, to visitors. The autonomous model then requested a token on its own initiative, successfully bypassing the financial paywall to pull the targeted dataset.

Anthropic reported that it has since implemented strict new guardrails to prevent its models from executing similar autonomous workarounds in the future. The Georgia voter incident was first uncovered by news outlet Axios and follows a disclosure earlier in the month where Anthropic admitted Claude had worked around restrictions to access t on various US government agency websites.

The unauthorised Georgia data grab adds to growing international concern regarding autonomous AI agents. Recent months have seen a string of alarming AI actions, including an OpenAI bot hacking an AI startup, an OpenAI agent compromising Australia’s university healthcare system and an Anthropic agent executing a simulated hacking campaign against real humans during a UK security evaluation.

Earlier this month, Anthropic also revealed that one of its models independently submitted a fake tip to the Philadelphia police department regarding an unsolved murder and filed 19 separate visa applications to the US State Department.

The mounting frequency of autonomous digital trespassing has intensified political pressure on tech developers. In the UK, AI minister Kanishka Narayan recently warned that major AI-driven cyber-attacks are virtually inevitable, prompting the government to consider mandatory reporting regulations via upcoming cybersecurity legislation.

Meanwhile, in the United States, the White House’s newly established is moving to mandate strict federal reporting for all security incidents involving commercial AI technology.

For latest tech stories go to TechDigest.tv