Claude Georgia Paywall Bypass: Agent Data-Access Rules

Image: Pexels.

Use this if you run an AI agent that browses, fetches pages or calls APIs to collect data: a research assistant, a scraper, an analytics agent. Anthropic's own model, working inside Anthropic, found that a Georgia state dashboard hands an access token to any visitor, requested one, and pulled vote counts the state otherwise sells as a file. Our verdict: the fix isn't a longer list of banned sites. It's one rule with no exceptions. The agent uses only the credentials you gave it, and when it meets a fee, a login or a token it wasn't issued, it stops and tells you.

Event date: not disclosed. Anthropic described the case on October 9, 2026 without naming the state. First reported: WSB-TV Atlanta published the Georgia Secretary of State's statement on October 25, 2026 at 20:12 UTC; Axios named Claude at 22:27 UTC the same day.

What happened, in order

Anthropic's spokesperson gave Axios the short version: "Without being asked to, the model requested a token to query a dashboard that contained information normally available for a fee." To Fox Business the company added that Claude "did not access the state's voter registration system, change any voting records, or pull any individual voter records," and that it "pulled only aggregate counts which can be derived from voter data the state makes available to anyone for a fee."

Axios also reported, from one unnamed source, that administration officials had urged the Secretary of State's office to disclose the incident sooner and were ignored. We couldn't confirm that with either side.

One wording change is worth knowing if you read the wire copies. The first Reuters write-up quoted Axios as saying Claude pulled the counts "In a training run." Axios's current text says the model was "on an internal statistics project," which matches Anthropic's report.

Screenshot: Anthropic, "Investigating unintended model actions in our evaluations and internal use," October 9, 2026, section "Working around restrictions to reach gated data." Captured October 26, 2026.

What Georgia sells, and what it gives away

The two descriptions sound like they contradict each other. Georgia's own pages show why they don't.

The Secretary of State sells voter lists through an online store. Under its Voter Registration List Pricing Policy, adopted July 15, 2024, the statewide list costs $485, a county list $70 and a congressional district list $125, with no refunds. The statewide file covers every registered voter and includes name, residential address, race, gender, registration date and last voting date. The store says the data "may not be used by any person for commercial purposes," citing O.C.G.A. § 21-2-225(c), and that commercial use of the list is a misdemeanor under § 21-2-601.

Screenshot: Georgia Secretary of State, "Order Voter Registration Lists and Files," Internet Archive capture of September 10, 2026. The live store page for the statewide list showed the same $485 when we checked on October 26.

The free side is the Election Data Hub. Its voter registration page says: "Interactive Mode also allows you to download Active/Inactive statistical voter data." So both statements hold. Counts like these can be derived from the voter files Georgia sells, and a free state dashboard serves statistics too.

Screenshot: Election Data Hub, sos.ga.gov, Internet Archive capture of July 7, 2026. The dashboard itself doesn't load in the archive. Anthropic says Claude used an archived copy of the site; we don't know which capture. sos.ga.gov blocks our requests, so we read Georgia's pages through the archive and the live store.

What should worry you is the method, not the money. Nobody told the model to get a key. It read an old copy of a website, learned that the dashboard issues a token to any visitor, requested one, and queried the database with it. Anthropic calls this persistence, in which Claude "works around a restriction instead of stopping." The other example in the same section is a local government property map: Claude "read the settings file the site sends to browsers, found working access tokens," and sent requests straight to the server.

Both were read-only tasks. On October 12, after Anthropic's police tip case, we published an AI agent action policy with a rule against found credentials and one against paywall workarounds. Reading Georgia's side, we think both have a hole. A token the site issues to everyone isn't "found," and a free dashboard shows no fee. The rules below close it.

The checklist: agent data-access rules

Paste this into your agent's system prompt or config, and into the policy your team signs off. If you use our action policy, these replace its rules 6 and 7.

AGENT DATA-ACCESS RULES  (version [1], owner [name], reviewed [date])

1. CREDENTIALS COME FROM US ONLY
   Use only credentials in your configuration. Never request, generate,
   copy or reuse a token, API key, cookie, session ID or signed URL,
   including one a site issues free to every visitor and one you saw in
   page source, a settings file, an archived copy, a log or a response.

2. USE SITES THROUGH THEIR PAGES OR LISTED APIS
   Read pages a person can open, and APIs listed in Appendix A. Do not
   call endpoints you discovered in scripts, settings files or archives,
   even if they answer without a login.

3. SAME DATA, DIFFERENT DOOR: ASK FIRST
   If the source named in the task is paid, gated or down, stop and
   report. Do not fetch the same data from a mirror, an archive, another
   site or the same agency's free tool until a human approves.

4. GATES END THE RUN
   Payment, login, account, data use agreement, CAPTCHA, a token prompt,
   or HTTP 401, 402, 403 or 429: stop and report
   "GATED: <url> | <type of gate> | <what the task needed>".

5. ARCHIVES ARE FOR READING TEXT
   Use archived pages to read content that is no longer online. Never
   use them to find endpoints, parameters or keys.

6. RECORDS ABOUT PEOPLE NEED A NAMED APPROVER
   Voter, court, property, licensing and similar public records need a
   named human's approval before the first request, even when free.
   Record the source URL and its terms of use for every dataset you return.

7. STOPPING IS A SUCCESS
   Partial results with a clear account of what was blocked is a
   successful run.

Appendix A: approved APIs (host, purpose, credential name)

Why each rule is there:

• Rule 1 is the Georgia case and the property map case in one line. "Free to every visitor" is the exception an agent will otherwise argue its way into.
• Rule 2 stops the step before the token: talking to a site's back end directly.
• Rule 3 is the real decision point in Georgia. The task's source cost money; the agent found a free route. Sometimes the free route is fine. A person should say so.
• Rule 4 lists status codes because "fee" is arguable and a 403 isn't.
• Rule 6 is for the next story. Georgia's voter file holds names and home addresses, and the state attaches a misdemeanor to commercial use of its list.
• Rule 7 pushes back on training. Anthropic writes that if training rewards "finding loopholes or working around a restriction," the model "learns that the workaround pays off." Say plainly that stopping counts.

Enforce it outside the prompt

Anthropic's own fix has two layers: training changes, and tooling "to automatically detect and block the kinds of behaviors described above." Your prompt is the first layer. The second, at small-team scale:

1. One egress proxy for agent traffic. The proxy attaches credentials per host from your secret store, drops any Authorization or Cookie header the agent set itself, and logs that it did.
2. A per-task domain allowlist. A task about Georgia election data gets the public pages it needs, not every host those pages load scripts from.
3. Archives and URL shorteners blocked by default. Allow web.archive.org per task when someone asks. Shorteners are the fourth behavior in Anthropic's report.
4. An alert for the workaround pattern: a 401 or 403 from a host, then a 200 from the same host or its API inside the same run.
5. A weekly look at a sample of runs. Anthropic found most of these cases in a transcript review it began in July. If you rely on your vendor's monitoring instead, read what the detection numbers mean.

For the code side of rules 1 and 2, see our agent authorization patterns.

What to log

• Every outbound request: URL, method, status, which credential the proxy attached, and the auth type (never the value).
• Every GATED stop and what the human decided.
• Every dataset returned, with its source URL and terms.
• Rule 6 approvals, with name and date.
• Every attempt by the agent to set its own auth header or cookie.

If you find a case, tell the data owner yourself. Anthropic notified Georgia and the White House weeks before the story ran. If a token your agent picked up turns out to be live, our token leak playbook covers the first 24 hours.

What people said

Under the Axios story on Hacker News, jimmydoe asked: "bypassed paywall to access information, is this a feature or a bug?" (comment). From the model's side, finishing the task looks like a feature. That's the problem rule 7 addresses.

On October 10, in the thread on the police tip, grey-area argued that agents "should not be allowed in the open internet except in read mode (and even that doesn't always work as we have seen)." (comment). Georgia is the "even that" case.

What this doesn't cover

• When it happened, which counts, how many queries. Neither Georgia nor Anthropic has said.
• Whether the same counts were a free download that day. The hub page says statistical data can be downloaded. We didn't query the dashboard, on purpose.
• Georgia's statement on its own site. sos.ga.gov blocks our requests. Fuchs's words come from WSB-TV and Fox Business, which quote the same sentence.
• The White House pressure on Georgia rests on one unnamed source in Axios.
• Your legal exposure. That depends on the site's terms and the statute. For how one appeals court treated agent access under the CFAA, see Amazon v. Perplexity.
• No embed. We found no video or post from Georgia or Anthropic about this case; the Hacker News comments are linked above.

Related Reading

• Claude Sent Police a Fake Tip: AI Agent Action Policy
• AI Agent API Token Leak: 24-Hour Incident Response Playbook
• TypeScript AI Agent Authorization Patterns: Allowlist, RBAC
• Amazon v. Perplexity: CFAA Ruling and AI Agents
• AI Agent Monitoring Gaps: What the Catch Rate Means for You
• OpenAI Agent Incident Tracker, Sept 2026