Security Vulnerability in a Voting System

It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools.

Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary.

Notably, I never touched a voting machine, exploited a network, examined source code, or accessed anything non-public.

After pointing a coding agent to the original vulnerability paper, I supplied it with two data sources highlighted in the paper: the early-voting list for each county, and the “CVR” (cast-vote record) file, containing every ballot and its selections (but not the voters’ names or other identifying information). The CVR file is available upon request, precisely because a public, ballot-level record is what makes election results independently verifiable.

Tags: voting, vulnerabilities

Posted on September 4, 2026 at 7:09 AM • 7 Comments

Comments

Grima Squeakersen • September 4, 2026 8:31 AM

My understanding is that, legally, voting (that is: who cast a vote; and under what circumstances) is intended to be public information, not private. If that understanding is correct, an exploitation of what you describe for a nefarious purpose would seem to be more accurately characterized as a potential flaw in the basic system design for voting, rather than a vulnerability in a particular technical system.

Doug • September 4, 2026 9:58 AM

@Grima, the issue is that while it is public information that I voted, my actual vote is private. This exploit allows you to know my vote. I live in GA in a small county. If my neighbor’s wife votes dem and her husband is deep deep red MAGA, and discovers her vote, it can easily lead to family drama. Given tbe south’s long history of voter intimidation, this defect is a big problem.

Andy • September 4, 2026 10:50 AM

Please read the post: the leak is the order of voting, not the content. I.e. you can figure out than Abe then Ben then Carol voted. If you know when Abe and Carol voted, you can deduce the interval when Ben voted as well

Billy Jack • September 4, 2026 3:23 PM

My precinct is a small farming community with about 30 registered voters. In most elections, everyone votes the same.

One time back in the 1960s when it was all Democrat (now all Republican), one woman filed a complaint alleging that her vote was not counted because she voted Republican and there were no Republican votes in the election results.

That started an investigation and what happened soon became clear.

She voted by putting an X in the boxes for the candidate she didn’t want. So, naturally enough, she put an X in the Democrat’s boxes and left the Republican’s boxes blank.

Braden • September 4, 2026 5:51 PM

@Andy, just to clarify: the leak is the order of each ballot, which can then be associated with the order of each voter in order to leak the content. (I.e., given the ballot-level data, this vulnerability means one can determine the order of all ballots that were cast; then, if one knows that you voted 5th through some other means, they can learn how you voted.)

Rontea • September 5, 2026 9:25 AM

This is how technical vulnerabilities can intersect with civic processes. When a security flaw in election equipment remains unpatched for years, it creates a tangible risk to ballot secrecy. The rise of AI coding agents means that the barrier to turning a theoretical exploit into a working attack has essentially disappeared. Publicly available cast vote records and early voting logs, which are critical for transparency, can also become tools for privacy compromise when paired with a reversible ballot shuffle. The takeaway: election administrators need to treat software updates with the same urgency as any other security-critical system. Public confidence in elections depends on robust, up-to-date protections that make sure a secret ballot truly remains secret.

Clive Robinson • September 5, 2026 9:46 AM

@ Braden, ALL,

With regards your comment of,

“this vulnerability means one can determine the order of all ballots that were cast; then, if one knows that you voted 5th through some other means, they can learn how you voted.”

Hmm “other means” could be that Flock Camera that “just happens” to cover the entry/exit to the polling station…

@ ALL,

There are good and proper reasons why “public spaces” should not be “under surveillance” and this is just one of very many of them.

Schneier on Security

Security Vulnerability in a Voting System

Comments

Leave a comment Cancel reply