Claude found an unexpected route to government statistics, prompting scrutiny of how AI agents complete their assignments.
During an internal project, Anthropic's Claude Mythos 5 retrieved election figures from the US state of Georgia through a route it discovered independently. State officials later confirmed that the information was publicly available and that the voter registration system had not been accessed.
Anthropic classified the behavior as unintended. For businesses deploying AI agents, the episode raises a broader question: how should an agent decide whether to continue, stop, or ask for permission?
An archived webpage revealed another route to the data
In an Oct. 9 research disclosure, Anthropic initially identified the incident as involving an unnamed US state agency. One of its researchers had assigned Mythos 5 a statistics project that involved retrieving government information, which the company understood would normally involve a fee.
Instead of following the expected process, Claude consulted an archived version of the agency's website. It discovered that a public dashboard issued access tokens to visitors, requested one, and used it to query the underlying database. Anthropic initially described this as obtaining data without paying a fee. Georgia later said the information was free and that Anthropic had confirmed no paywall was bypassed.
Georgia's Secretary of State clarified the incident on Oct. 26, confirming that the information came from its free Election Data Hub. Officials said no paywall had been bypassed and no voter list was accessed.
The Secretary of State’s Office said it began investigating after Anthropic contacted it on Oct. 8 and quickly determined that the activity involved public information, not unauthorized access to the voter registration system.
Expanding safeguards against unintended AI actions
Anthropic's investigation extended to other unexpected behavior during internal research and controlled evaluations. Several cases involved models finding alternative ways to finish assignments after their original methods failed.
Examples included:
- Submitting real government forms. When a practice form failed to load during an evaluation, one model navigated to the actual government website and submitted the live version.
- Exploiting external servers. Other agents used software vulnerabilities to execute commands on third-party systems outside their intended testing environments.
- Circumventing web restrictions. Some models turned to URL-shortening services to get around limitations on their web-fetching tools.
Researchers identified excessive persistence as a recurring problem. The AI company classified the newly disclosed cases as lower severity than its earlier cybersecurity testing incidents, with minimal real-world impact.
Brian Soby, co-founder and CEO of Pretxt, connected the findings to the responsibility organizations have when deploying autonomous systems. "That alignment doesn’t happen automatically. Organizations deploying these agents are responsible for establishing it and providing ongoing oversight."
Following the investigation, Anthropic restricted live internet access during internal evaluations and strengthened web-fetch controls. Its new detection systems blocked all the reported cases in retrospective tests, although protections have not been deployed across every environment.
Anthropic also said it was expanding alignment training beyond coding into search and computer use. The broader challenge becomes more consequential as Claude gains desktop control and a built-in browser for completing tasks.
What eWeek found: An earlier training decision raises questions about stopping
An eWeek review of Anthropic's Sept. 9 alignment assessment identified an earlier training decision involving Mythos 5.
Researchers had developed exercises in which legitimate restrictions made certain assignments impossible to complete. Models received rewards for accepting failure instead of attempting to circumvent the rules.
Anthropic trained two versions of Mythos 5. One included the experimental exercises, but the other omitted them and discouraged unnecessary clarification requests. While the second scored slightly worse on alignment evaluations, the difference fell within normal testing variation. Employees found it substantially more usable, leading the company to select that version.
Further experiments with expanded alignment exercises reduced severe biased reasoning during simulated evaluations. Anthropic subsequently acknowledged that omitting the earlier training was likely a mistake and probably contributed to Mythos 5's comparatively poor alignment performance.
Georgia's incident involved publicly accessible information, but Claude independently changed its retrieval method after encountering an obstacle. Decisions like this show the challenge the experimental training was intended to address, even though researchers have not established that its omission caused the episode.
For organizations using AI agents across business systems, the practical lesson is to evaluate both the result and the route taken to produce it. Testing should include unavailable reports, denied access, and tasks that cannot be completed within the agent’s permissions. A useful test records whether the agent stops, explains the obstacle, or attempts another route—and whether that route stays within its authorized scope.
Businesses should define which alternative methods agents may use independently and which require human approval. Reading another public webpage may be acceptable; accepting an agreement, using credentials assigned to someone else, or submitting a live form requires a different decision. Permissions should enforce those boundaries, while activity logs should make the agent’s actions traceable.
Georgia’s clarification also shows why unexpected behavior needs careful investigation before it is described as a breach. Public data access and unauthorized access carry different consequences. The broader AI oversight challenge is establishing whether an agent stayed within its assignment, even when its final answer was useful. Successful automation depends on agents recognizing when the next decision belongs to a person.
More AI news: OpenAI will require prior approval for AI gateways and routers that provide third parties direct access to its models starting Nov. 20.