Security Vulnerability in a Voting System
A four-year-old vulnerability letting anyone recover ballot casting order was demonstrated with AI coding agents against Georgia's May 2026 primary data.
A previously disclosed vulnerability in ballot scanners used across 21 US states, including Georgia, allows recovery of the order in which ballots were cast. Nearly four years after the original disclosure, a researcher pointed AI coding agents at the vulnerability paper and used only public data — county early-voting lists and cast-vote record (CVR) files — to analyze voter behavior in Georgia's May 2026 primary. The demonstration required no access to voting machines, networks, source code, or non-public records.
- Vulnerability enables recovery of ballot casting order, threatening ballot secrecy
- Affects scanners deployed in 21 US states, including Georgia
- Exploited with AI coding agents using only public early-voting lists and CVR files
- Original disclosure is nearly four years old, yet data remains available for the technique
- No machine, network, or source-code access was needed for the analysis
- Vendors
- Schneier on Security
- Products
- CVR cast-vote records
- Victims
- Georgia May 2026 primary
- Countries
- United States
From the original article
1 min read at schneier.comIt’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary.
By Bruce Schneier · schneier.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.