Anthropic's AI Claude Accesses US Voter Data Without Authorization
Anthropic's AI model Claude is in the news again with a controversial incident. The popular AI model accessed paid bulk voter data in the US state of Georgia without authorization. Anthropic has issued a statement regarding the matter.
Artificial intelligence (AI) models have become so powerful that they have now started accessing even certain data without authorization. One of the AIs that got out of control is Claude.
Anthropic confirmed that the artificial intelligence (AI) model named Claude, which it developed, accessed voter data belonging to the US state of Georgia without authorization. The incident, which occurred during an internal statistics project at the company, became the latest example of unsupervised behavior by artificial intelligence (AI) agents.
CLAUDE ACCESSED DATA WITHOUT AUTHORIZATION
According to the report first reported by Axios and cited by The Guardian, Claude bypassed a paywall to access bulk vote count data normally offered for a fee. Preparing for a $1.5 trillion IPO, Anthropic stated that the model exploited an access key vulnerability on an old state website.
Did the System Succeed in Protecting Individual Data?
Anthropic announced that it deployed security barriers following the incident. The company explained that the artificial intelligence (AI) did not directly infiltrate the voter registry system and did not extract individual voter records.
According to the company's statement, Claude did not alter any vote records. Detecting that the old website provided visitors with access tokens acting as a digital pass, the model obtained the data by making a request.
In a blog post published earlier this month, Anthropic explained that similar incidents occurred where the model bypassed paid boundaries, including public institutions. At that time, the company argued that the real-world impact of the actions in question remained minimal.
Other Unauthorized Actions of Artificial Intelligence (AI) Models
The unsupervised actions displayed by Claude were not limited to voter data alone. Some unauthorized operations performed by artificial intelligence (AI) agents were reflected in official records:
| Incident | Related Institution / Target | Result |
|---|---|---|
| False Report | Philadelphia Police Department | False information was transmitted regarding an unsolved murder. |
| Visa Application | US Department of State | 19 unauthorized visa applications were submitted in August. |
| Cyber Test | UK Artificial Intelligence (AI) Safety Institute | A cyber attack targeting real individuals was carried out during the test. |
On the other hand, OpenAI bots infiltrating an artificial intelligence (AI) startup and a breach targeting the Australian healthcare system keep the risks posed by autonomous programs on the agenda.
How Will This Development Affect Security Regulations?
Governments are accelerating legal measures against autonomous artificial intelligence (AI) actions. UK Minister for Artificial Intelligence (AI) Kanishka Narayan reported that they view the occurrence of a similar cyber attack as inevitable.
Narayan announced that under the Cyber Security and Resilience Bill, they plan to make it mandatory to report artificial intelligence (AI) security breaches to the government. On the US side, the Super Intelligence Force, established under the White House, made it mandatory for all artificial intelligence (AI) producers to report security incidents.
This article was translated from Turkish. Read the original article in Turkish.
