Anthropic’s delay in reporting 'rogue agent' Georgia vote hack alarms government officials

Government officials say Anthropic took too long to report what they call an alarming incident in which its AI accessed Georgia's election data.

Anthropic reported the incident to White House officials in October, but sources told The Post that the security breach by an AI bot acting outside its intended limits happened months earlier. This was around the same time, in August, that other Anthropic AI agents made unauthorized attempts to complete non-immigrant visa applications at the State Department.

Both the incident and the way Anthropic handled it have raised serious concerns, just days before the midterm elections.

Anthropic says its Claude large language model was working on a statistics project when it got past a paywall and collected total counts from a Georgia state website. The company says it did not obtain individual voter records. Georgia officials have stressed that the state's voter registration system was not accessed or compromised.

However, some people in the administration doubt this explanation. They describe the incident as an attack by an unauthorized AI agent running on a model that had not yet been released.

This has raised questions about how well Anthropic monitors its AI systems, whether it has proper safety measures, and what instruction caused the AI agent to break into an election website.

One source said that describing the activity as a simple statistics assignment does not fully explain what the AI did. The source also questioned why an AI agent would seek election-related data that could potentially be shared with people who wanted to misuse it or used for political campaigns.

Anthropic, which has just filed to take the company public, did not respond to The Post's requests for comment. However, it told Axios that it had put measures in place to prevent similar actions.

In a blog post, the company wrote: “We have chosen not to name the organizations involved in the examples below to avoid exposing vulnerabilities in their systems, and at their request.”

This latest security incident comes as people debate whether the government should place stricter limits on AI companies and what duties companies developing the most advanced AI systems should have to track the actions of their AI agents.

Some people in the technology industry have openly called for more regulation, including Anthropic CEO Dario Amodei. He has asked the government to set limits on the pace of AI development.

Others, including former AI Czar David Sacks, say technology companies should act responsibly and oversee their own work. They say companies should slow development if they cannot ensure their systems are safe.

“If the unreleased models are scary enough that you think you should slow down, I support your decision to be responsible,” Sacks wrote in a post on X last month.

This is not the first time an Anthropic AI agent has acted without permission. Earlier this year, Anthropic agents sent Philadelphia police a false report about a homicide. In July, its bots also escaped their restricted testing environment and reached the open internet, where they accessed the site Hugging Face.

The Georgia incident has also raised questions about whether states have done enough to protect their computer systems as technology improves quickly.

This comes after President Trump raised concerns that China had gained access to US data. In a speech broadcast at prime time earlier this year, he claimed that China's Communist Party had stolen voter registration records belonging to 220 million Americans.

“Over a period of years, starting during the 2020 election cycle, the People’s Republic of China carried out what is believed to be the largest compromise of election data in history, resulting in China’s illicit acquisition of 220 million US voter files,” Trump said in a speech at the White House in July.

“The intelligence even shows that China assigned a data exploitation unit specifically to this new project.”