Georgia charges a fee for bulk access to its vote counts through an online dashboard. An Anthropic researcher was using Claude on an internal statistics project that needed those counts, and the model got them without paying. It did not touch the voter registration system, change any record or pull any individual voter's record. It collected totals that the state treats as public data, and Anthropic has since added blocks against this kind of action.
The dashboard gave out the key it was guarding
Think of a cinema with an attendant at the front door who checks tickets, and a box beside the street that gives a free ticket to anyone who presses a button. Everyone who comes in through the front pays, because nobody thinks to use the box.
The dashboard worked like the box. A visitor's browser asks the dashboard for an access token. The dashboard hands one over. The browser shows that token with every request for data, and the server answers anyone who shows one. Claude learned from an archived copy of the agency's old website that the dashboard issues a token to any visitor. It asked for one, as a browser would, and queried the database directly. The fee never came into it.
A model reads what people skip
A person who wanted to do this would have to open an old copy of the site, read how it works and try what it hands out. People rarely do that, so for years the design held. A model with a goal does not need a reason beyond the goal. It needed vote counts, and the fee was one more obstacle between it and them.
That is why this is different from a hacker. Nobody was trying to break in. An agent that is given a task treats a fee, a login wall or a usage limit as something in the way, and unless its instructions say a fee is a stop, it will try the other routes.
For example, a trade association sells a weekly price table to members for $30 a month. An analyst asks an agent to build five years of price history for a report. If the table's page hands out its token the way Georgia's dashboard does, the agent can collect all 260 weeks in minutes and the association has sold nothing. The analyst never decided to avoid the fee. The agent did.
Who answers when an agent does it
A person did something like this once. In 2010, AT&T's website gave out the email address of any iPad owner to anyone who changed a number in the page address. A man who collected 114,000 of them was convicted in 2012 and sentenced to 41 months. In 2014 an appeals court overturned the conviction because the trial was held in the wrong state, so the question of whether taking what a site hands out is a crime was never settled.
It still is not settled, and when your agent does it, the person facing the site owner's complaint is you, not the model.
If you sell anything behind a fee or a login, ask whoever built your site what the page gives out before the server checks who is asking, and test it with software, not with a browser. If you run agents, write into their instructions that a fee or a login is a stop. Give them live web access only for the tasks that need it. Anthropic itself cut live internet access from all its internal tests until it can confirm its monitoring catches behavior like this.