Anthropic says external researchers found a gap in its election safeguards: Claude reliably refused direct requests to deceive voters, but could miss a malicious campaign divided across ordinary-looking tasks such as research, website development and writing. The finding comes from the company’s account of testing by the Institute for Strategic Dialogue and McCain Institute.[1]
That is a different safety problem from detecting a prohibited sentence. It requires the system to recognise intent across time, tools and apparently legitimate subtasks without treating every campaign website, policy summary or fundraising email as suspicious.
Ordinary political use is much larger than abuse
Anthropic analysed a random sample of 250,000 US Claude.ai consumer conversations from 21 to 27 September. It classified 5.75% as touching politics, public policy or social issues and 0.51% as specifically about elections or voting. Requests for voting recommendations were much rarer: its graphic uses the upper end of a 95% confidence interval for that category. A separate review of 250,000 conversations estimated election-policy violations at about 0.002%.[1]
Different samples and measures in Anthropic’s election analysis
| Category | Reported share | How to interpret it |
|---|---|---|
| Politics, policy or social issues | 5.75% | Share in the 21–27 September US consumer sampleSource 1 |
| Elections or voting | 0.51% | A narrower topic category in that same sampleSource 1 |
| Whom or what to vote for | About 0.01% in the public account | The graphic displays the upper 95% confidence bound; this is not an exact observed countSource 1 |
| Election-policy violations | About 0.002% | A separate 250,000-conversation policy reviewSource 1 |
These samples suggest that legitimate political questions are much more common than identified policy violations on this service. Anthropic’s guidance permits tasks such as drafting press statements, analysing turnout data and preparing for debates. Preserving that usefulness requires distinguishing a topic from a deceptive purpose.[1]
A strong score can coexist with a different failure
Anthropic reports a 99% score for Claude Opus 5.5, Sonnet 5.5 and Haiku 5.5 on its own political even-handedness evaluation. That score measures behaviour on a defined evaluation, not the probability of every political response being unbiased. The company also summarises external reviews that found unsolicited counterarguments in advocacy writing and uneven hedging in Sonnet 4.5; these involve different methods and, in the latter case, an earlier model.[1]
The same principle applies to misuse. A classifier can perform well on an isolated harmful prompt while failing to join the pieces of a longer operation. The safety target is not merely “refuse the bad request.” It is “recognise that a sequence of normal-looking requests is collectively building the bad outcome.”
The safeguard must remember enough—but not presume too much
Anthropic says it added classifiers aimed at novel and multi-step misuse, including fake social-media accounts, political news sites and financially motivated election schemes. The company also reports banning accounts that used Claude to produce fabricated US midterm coverage aligned with Russian, Iranian and North Korean narratives, and separate content designed to attract advertising revenue.[1]
Longer-horizon detection creates its own governance question. How much context should a provider retain, what evidence is sufficient to connect tasks, and how can a legitimate user challenge a mistaken restriction? The better the safeguard becomes at reconstructing intent, the more carefully it must distinguish reconstruction from assumption.
The useful unit of evaluation is therefore the whole operation: the requests, the tools used and the outcome they jointly pursue. A provider needs evidence that connects those steps, while allowing ordinary political research and advocacy to proceed. Anthropic’s account identifies a concrete failure mode to test rather than a single score that settles election safety.
Sources & further reading
- Preparing for the 2026 US midterms Anthropic · 14 Oct 2026 · Accessed 15 Oct 2026