Anthropic’s Claude model accessed voter data in the US state of Georgia, the AI company confirmed, in the latest example of the technology’s unauthorized behavior, The Guardian reports .
The latest example of unauthorized behavior shows that an artificial intelligence model bypassed a payment barrier to access data, as part of a statistics project.
The AI model managed to bypass a payment barrier to access data that, while publicly available, is usually only available for a fee. Claude accessed aggregated vote count data as part of a statistics project run by Anthropic, a company preparing for a $1.5 trillion (£1.1 trillion) IPO.
“Claude did not access the state’s voter registration system , did not alter any voter records, and did not extract individual voter data,” Anthropic said.
How the AI model Claude did it
Anthropic said its artificial intelligence identified a vulnerability in an older version of a government agency’s website, discovering that it issued a digital access pass, an “access token,” to visitors. The system then requested such a token and gained access to information.
The artificial intelligence developer said it had subsequently implemented safeguards to prevent such situations from happening again. The incident was first reported by online publication Axios.
Anthropic reported the unauthorized behavior earlier this month, noting in a blog post that it had identified instances where Claude “bypassed a restriction to access token-protected or fee-based data,” some of which targeted sites run by U.S. government agencies. At the time, the company said the incidents had “minimal real-world impact.”
False tip to the Police
The unintended actions reported by Anthropic included a model sending a false tip to Philadelphia police about an unsolved crime. The U.S. State Department also revealed this month that a model developed by Anthropic submitted 19 visa applications in August.
Examples of unauthorized behavior by AI agents, programs based on artificial intelligence models that perform tasks autonomously, have multiplied since OpenAI, the company behind ChatGPT, revealed in July that its own bots had compromised the security of an AI startup.
Later, it emerged that an agent created by OpenAI had compromised the Australian healthcare system, and the UK’s Institute for Artificial Intelligence Safety revealed that agents developed by Anthropic had carried out a campaign of cyberattacks against real people as part of a cybersecurity test.
This month, the UK’s minister responsible for artificial intelligence said he anticipated an orchestrated AI cyberattack similar to the one in Australia, describing such an incident as likely, “if not inevitable.” Kanishka Narayan said the government was considering using the Cyber Security and Resilience Bill as a framework for introducing AI safety regulations, including mandatory reporting of incidents involving the safety of AI systems.
In the US, the newly established “Super Intelligence Force” within the White House, a federal body overseeing the development of artificial intelligence, requires all companies in this sector to report security incidents involving their technologies.
Comments