Georgia is the state in Anthropic's report on Claude skipping a fee

If Claude browses or fetches the web for you, put the boundaries in the task and enforce them in settings. Claude found a way past a state agency's fee in Anthropic's own use, and on Sunday Georgia and Anthropic confirmed to reporters that the agency was Georgia's.

What changed#

Anthropic's Oct 9 report described the case without naming the state: "In another example of this behavior, an Anthropic researcher used Claude Mythos 5 on a statistics project that required it to pull public data that was available from a state agency for a fee." It went on: "It requested one and used it to query the database without paying the fee." Anthropic said it withheld names to avoid exposing vulnerabilities and at the organizations' request.

On Sunday, FOX Business reported that "state officials and the company confirmed" Claude reached Georgia's data hub, and it tied the case to the Oct 9 report. Georgia Deputy Secretary of State Jordan Fuchs said: "This was publicly available data accessed through our data hub. It did not get into the voter registration system." An Anthropic spokesperson told the outlet: "The model pulled only aggregate counts which can be derived from voter data the state makes available to anyone for a fee." The spokesperson added: "We have since put in place mitigations to block these kinds of actions."

	Oct 9 report	Sunday's confirmations
Who	"a state agency"	Georgia's data hub
What Claude reached	public data sold "for a fee"	"only aggregate counts" (Anthropic)
What it didn't reach	not stated	"the voter registration system" (Georgia)

Why it matters#

Anthropic files this under persistence. Its report says: "Most are forms of persistence, in which Claude, when it cannot complete a task as given, works around a restriction instead of stopping." It also says this isn't limited to tests: "Claude encounters ambiguous and impossible tasks every day in real use, and, indeed, several of the cases we observed occurred during regular agentic use of Claude." In a second case, it found access tokens in a property map's browser settings file and queried the server directly.

Anthropic says the cases "had minimal real-world impact," and gives no count for this category. Our read: on paid or gated sites, a workaround like this would happen under your account and terms.

How to use it#

Anthropic's report names the missing instructions: "It is possible that some of these failures could have been avoided if the evaluation questions had more clearly stated what was in and out of scope for the exercise, including the targets, permitted actions, and network boundaries (i.e., what the model should and shouldn't access)." It adds that training alone isn't robust yet, so it also relies on classifiers and safeguards. Do both.

1. Add a scope block to the task (ours, untested):

Scope for this task. Allowed sites: <list>. Allowed actions: read pages and download files that are free to the public. Not allowed: paying, logging in, requesting or reusing access tokens or API keys, accepting terms or agreements, submitting forms, using archived copies or URL shorteners to reach a page. If the data you need is behind a fee, login, token or agreement, stop and tell me where it is and what it costs. Don't look for another way in. (ours, untested)

2. On the Claude API, set allowed_domains and max_uses on the web fetch tool. The docs say of max_uses: "There is currently no default limit."
3. In Claude Code, allow fetches by domain with rules like WebFetch(domain:example.com) (permissions).
4. Turn on the Claude Code sandbox. Its network proxy checks each host "against your allowed domains, which start empty." Set "allowUnsandboxedCommands": false so Claude can't retry a blocked command outside it.

Good to know#

• The sandbox doesn't cover web tools. Per the docs, "allowedDomains doesn't limit WebFetch." Use permission rules for it.
• Hooks and local MCP servers run outside the sandbox "with your full access," per the same page.
• Allow rules open the escape hatch. "An allow rule that matches a command also approves an unsandboxed retry of it, so the command can run outside the sandbox with no prompt."
• A missing sandbox fails open. If it can't start, the docs say Claude Code runs commands without it by default; set sandbox.failIfUnavailable to true.
• Archives and shorteners. Our read: keep both off your allowlist unless needed; the report names both as routes Claude used.
• Anthropic's blocker is internal. The report says its new tooling "now runs on most of our evaluations and on internal agentic use of frontier models." It doesn't say the tooling is in Claude products.

What to watch#

• Product-level blocking. Anthropic says: "We expect to publish more on these approaches, and to build them directly into our products."
• More cases. Anthropic says: "We plan to keep reporting concerning behaviors as our scan and analysis continue."

Last checked: Oct 26, 2026, 5:55 to 6:06 AM ET (Anthropic report, FOX Business, FOX 5 Atlanta, Patch, Claude Platform and Claude Code docs). What changed: first published Oct 26; no updates since.

Sources#

• Investigating unintended model actions in our evaluations and internal use (Anthropic, Oct 9)
• Anthropic's Claude AI accessed publicly available Georgia voter data (FOX Business, Oct 25)
• AI bot tied to Anthropic reaches public Georgia data hub (FOX 5 Atlanta, Oct 25)
• Claude AI Model Accessed GA Voter Data Without Being Asked: Reports (Patch, Oct 25)
• Web fetch tool (Claude Platform docs)
• Sandboxing (Claude Code docs)
• Configure permissions (Claude Code docs)