Anthropic’s Claude model accessed voter data in the US state of Georgia, the AI company has confirmed, in the latest example of unauthorised behaviour by the technology.
The AI model managed to bypass a paywall to reach data that is publicly available but is typically accessible only after paying a fee. Claude accessed aggregate vote counts as part of a statistics project at Anthropic, which is preparing for a $1.5tn (£1.1tn) flotation.
“Claude did not access the state’s voter registration system, change any voting records, or pull any individual voter records,” Anthropic said.
Anthropic said the AI found a loophole in an old version of the state agency’s website, discovering that it issued a digital entry pass – an “access token” – to visitors. It then requested a token and gained access to the information.
The news isn’t how it’s being sold, as AI breaking into a restricted voter database. It’s just showing two things - AI can be very persistent in reaching its goals, more than a human might be, and that federal and state sites aren’t as secure as they pretend they are. Maybe GA and other states should look at their public-facing sites and make sure they’re properly protected. Unless you got rid of all your IT people, then I guess ask AI.
We had an idea of how unsecure some government sites were for a while. Universities were some of the worst for data breaches, public and private.
That said, Ai attacking vulnerabilities is throwing a TON of compute at finding bugs no human could have ever discovered. Its essentially making most cybersecurity obsolete as we speak. No amount of good practices can protect against this.
Ai and this enormous amount of compute is just a hazard for the open internet. The US and a handful of US corporations owning all that compute is going to be a national security threat to every country.
No amount of good practices can protect against this.
Isn’t that the cause of this problem?
Sites were built that didn’t follow accepted security practices, and now AI is able to find and exploit those holes quickly.
As time goes on, and more of these vulnerabilities are fixed, AI is going to be less effective at gaining access to systems.
accepted security practices
Basic ones even. Sanitizing user input and encrypting important data. Ai is just finding more of the obscure loopholes and doors, but online security has been a joke for a lot of places for a long time now, usually because of the same reason they now have AI in place. To cut labor costs. Well, hope that bonus was worth it.
I doubt it’s even possible to fix all the loopholes. New ones will be found and there’s just a swamp of reports that maintainers can’t keep up with.
It’ll be even worse if and when people resort to Ai fixing stuff. That will introduce even more absurdly obscure bugs.
This year has just been open season on CVEs.
We are basically throwing so much compute at some of these systems, we are just brute forcing bugs at this point.
I just see no solution outside air gapping anything critical off the open internet.
“Trust us bro”
Our AI broke the law bypassing a DMCA restriction in a website and if it was a regular person would be facing criminal charges. Luckily, no one cares if we break the law.
Democracy is not equipped to handle modern day technology and we’ve done nothing to equip it.
