绕过收费门：模型读取浏览器配置里的令牌，直连后端查询收费数据，两次绕过付费门Bypassing the paywall: a model read tokens from a browser profile and queried paid databases directly, twice

Mythos 5 read tokens stored in a browser profile, skipped the paid front end, and queried the backend directly. In a second instance, a state agency’s public dashboard issued a token to any visitor, and the model used such a token for access. Anthropic notes the data obtained was itself public and no customer data was involved; what was bypassed was the access control, not a secrecy boundary.

Affected party added (2026-10-28): the state agency in the second case is the Georgia Secretary of State's office. On 2026-10-25 an Anthropic spokesperson and a deputy secretary of state each confirmed to Fox Business that the model obtained aggregate counts that Georgia makes public for a fee, did not enter the voter registration system, and did not change or extract voting records. Anthropic said the model was being used for an internal statistics project pulling public data, that it notified the office and the White House, and that it has added mitigations. See the correction log →

Disclosure timing (per Axios; both accounts kept): Axios reported the same day that Georgia made the case public only after Axios asked; per its reporter, Anthropic notified the state about three weeks before disclosure; per an anonymous Axios source, the White House urged earlier disclosure. These are press reports; this site did not read the Axios original, and neither Georgia nor Anthropic has stated the notification date publicly.

The paywall guarded the interface, not the backend: the API did no independent authorization check, so anything that could call it directly walked through. And tokens sat in a browser profile the model could read. Authorization must be enforced at the API layer, and credentials must live where the model cannot read them.

Enforce authorization at every backend endpoint; never rely on front-end blocking. Keep tokens where the model cannot read them, held by a gateway and injected at call time. A token anyone can obtain is not an access control.