# AI-Assisted Exploit Reveals Ballot Order in Voting Systems A critical vulnerability in certain electronic voting systems, previously identified, has been brought back into the spotlight by a new demonstration leveraging artificial intelligence. This exploit allows for the recovery of the order in which ballots were cast, a capability that could potentially compromise the secrecy of the ballot. The researcher, a fellow at **Princeton University's Center for Information Technology Policy (CITP)**, detailed how they were able to analyze voter behavior in Georgia's May 2026 primary election. Georgia is one of 21 states that utilize the affected scanning systems. Crucially, the exploit did not involve any direct manipulation of voting machines, network breaches, source code examination, or access to non-public information. Instead, it relied entirely on publicly available data and an AI-powered coding agent. ## The Exploit Process The methodology involved feeding an AI coding agent two key data sources: 1. **Early-voting lists:** These public records detail individuals who cast ballots before election day in each county. 2. **Cast-Vote Record (CVR) files:** These files contain every ballot and its selections. While CVRs do not include voter names or other identifying information, they are made publicly available upon request to ensure the verifiability of election results. By cross-referencing these datasets and applying the logic from the original vulnerability disclosure, the AI agent was able to reconstruct the sequence in which votes were cast. This ability to determine ballot order, even without direct voter identification in the CVR, could potentially allow for sophisticated inference attacks, particularly when combined with other publicly available voter data. ## Implications for Election Integrity and Privacy This demonstration underscores a persistent challenge in election security: the balance between transparency and voter privacy. While public CVR files are essential for auditing and verifying election outcomes, their inherent structure, when combined with other public data, can create unforeseen vulnerabilities. For IT security professionals and privacy-conscious users, this highlights the importance of a holistic security approach that considers not just direct system access but also the potential for indirect attacks using publicly accessible information. The use of AI in this exploit also signals a growing trend where sophisticated analytical tools can amplify the impact of known vulnerabilities, even those considered less critical in isolation.