"I never touched a voting machine, exploited a network, examined source code, or accessed anything non-public." That admission, lifted from a recent blog post, encapsulates a privacy and integrity gap now being re-exploited with new tools.
What the vulnerability does and how AI changed its reach
The vulnerability enables someone to recover the order in which ballots were cast. The post reports that, by combining publicly available files with an AI coding agent, the author was able to resurrect an attack described in an earlier academic paper and apply it to recent election data. The researcher pointed the agent to the original vulnerability paper and then supplied two public data sources highlighted in that paper: county-level early-voting lists and the cast-vote record (CVR) file for each contest.
How the data sources were used
The CVR file contains every ballot and its selections but explicitly does not contain voters’ names or other identifying information. It is available upon request because, as the post notes, a public, ballot-level record is what makes election results independently verifiable. The early-voting lists for each county provide the sequence of voters who voted early. By feeding both files to the coding agent, the author demonstrated that the order of ballots cast can be reconstructed without accessing machines, networks, or any non-public material.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleReal-world demonstration: Georgia, May 2026 primary
Nearly four years after the original vulnerability was disclosed, the author used the same approach to analyze voter behavior in Georgia’s May 2026 primary. Georgia is named in the post as one of 21 states that use the affected scanners. The post stresses that the reconstruction came from public records and an automated coding agent rather than hands-on tampering with election equipment.
What this means for election officials in 21 states, technologists, and voters
- Election officials in the 21 states that use the affected scanners must weigh competing goals: maintaining public, ballot-level CVRs to support independent verification versus protecting the order and privacy of ballots when that order can be inferred from other public lists.
- Technologists and security teams will need to assess whether the original vulnerability can be mitigated by procedural changes (data release practices) or technical fixes to scanners and CVR generation, given that an academic proof-of-concept has now been revived with AI assistance.
- Voters and privacy advocates should note that CVRs, while stripped of direct names, can be combined with other public records to reveal ballot order — a channel to infer behavior that many assumed public release would not permit.
Implications and unanswered operational questions
The demonstration raises concrete operational questions. If public CVRs plus routine voter lists permit reconstruction of ballot order, will jurisdictions change what they publish or how they publish it? Will the original vulnerability be addressed in scanner firmware or in guidance about CVR release? The post documents that the exploit required only two public data sources and an AI coding agent informed by the original paper — a low barrier compared with attacks that require hardware access or network intrusion.
The record presented is precise: a previously disclosed vulnerability remains exploitable in practice, was applied to a real state primary held in May 2026, and was executed without access to non-public systems or data. Those are the verifiable facts the post provides; they point to a narrow, testable technical capability and a broader policy tradeoff between transparency and privacy.
As jurisdictions and security teams consider their next moves, the immediate, public facts are clear: ballot-level public records continue to serve a verifiability purpose, but that same transparency can be leveraged—now with AI tooling—to recover ballot order when paired with other routine public lists. The choice for officials is whether and how to change practices to reflect that tradeoff.
https://www.schneier.com/blog/archives/2026/09/security-vulnerability-in-a-voting-system.html
