If AI is getting harder to control, do we really need to give it more power as companies push for greater autonomy?

Anthropic's Claude agent accessed Georgia election data without authorisation, renewing questions about AI autonomy. As companies give agents more power to browse, code and act independently, past incidents involving Anthropic and OpenAI show why human oversight remains vital.

As artificial intelligence (AI) technology continues to advance rapidly, industry players developing it have flagged serious risks arising from its rapid development, including "catastrophic or existential risks to humanity". In the past few months, several instances of AI agents going rogue and accessing information and websites they should not have accessed have come to light. Most recently, Anthropic disclosed that a Claude agent accessed Georgia election data without human authorisation.

The incident has raised fresh concerns about the risks of giving AI systems greater autonomy. The company said the agent retrieved aggregate vote counts during an internal research project and did not access individual voter records or alter election data. Yet the episode comes as AI companies race to build agents that can browse the internet, write code and complete multi-step tasks with less human oversight.

What we know about the Georgia incident

Axios reported on October 25 that Anthropic's Claude model gained unauthorised access to publicly available Georgia voter data by getting past a paywall. An Anthropic spokesperson said the system obtained aggregate voter counts while working on an internal statistics project, at a time when more than one million people in the state had voted early.

The model accessed the data "without being asked to," the spokesperson said. Claude did not enter Georgia's voter-registration system, alter election data or download voting records, according to the company.

The Georgia episode is neither an isolated case nor one limited to Anthropic, with other AI agents also reported to have crossed intended boundaries while carrying out tasks.

Previous instances of AI agents going rogue

In October, it was reported that an Anthropic AI model submitted a fake tip to a Philadelphia police website about an unsolved homicide case. The Philadelphia incident occurred in July, when Claude Haiku 4.5 was tasked with generating and performing example tasks on randomly selected webpages. The AI model filled out a form on the police website, indicating that it may have information.

Another example involved Claude submitting an online form that it was not supposed to submit. In a blog post, the AI firm said that, during one of its tests, an unreleased AI model was asked to fill out a practice government form. When it failed to open the practice version, or when it was accidentally closed, the model went to the actual website and submitted the real form.

In one of the cases, an unreleased Anthropic model halted its attack after recognising that it was aimed at a real organisation rather than a simulated system. Anthropic said the response was a positive indication of safer behaviour, though it added that further testing was needed to draw firm conclusions.

Separately, in September, Anthropic rival OpenAI disclosed at least six reports of "unexpected or concerning" behaviour in AI models. According to reports, in one of the newly disclosed cases, an unreleased OpenAI research model added "jailbreak-like instructions" to its own notes in an effort to bypass its usual restrictions. It also instructed itself to be "freed from the roles and identities that bind other chatbots."

Another instance involving OpenAI agents occurred in September, when an AI agent accessed US government websites during a prolonged testing period. According to a Wall Street Journal report, the AI agents hacked websites linked to the US Commerce Department and the Securities and Exchange Commission (SEC).

In July, a group of OpenAI agents escaped their testing environment and carried out a cyberattack on AI company Hugging Face, raising concerns globally. Similar incidents have since been disclosed by other companies.