AI Tools Now Let Researchers Unmask Georgia Voters' Ballots, Security Experts Warn

Georgia's voting machines have carried a known ballot-secrecy flaw since 2022. What's changed since then is artificial intelligence, and that's turning a theoretical problem into a practical one, according to the Associated Press.

The flaw involves the state's touchscreen voting machines, which print paper ballots that voters feed into scanners. Those scanners generate cast-vote records and electronic ballot images that are supposed to be randomized so no one can trace a ballot back to the voter who cast it.

Researchers who discovered the vulnerability in 2022 found that the shuffling could be reversed. Combined with other public records, that means someone could figure out how specific voters cast their ballots, according to the researchers' report cited by the Associated Press.

The twist in 2026 is speed and accessibility. Max Springer, a Princeton University researcher who studies AI and wasn't part of the original team, says he gave the vulnerability research to a publicly available AI assistant. He told the Associated Press it successfully reversed the shuffling of electronic ballot records from Georgia's May primary and identified what other records would be needed to match voters to ballots.

J. Alex Halderman, a University of Michigan voting technology specialist who helped expose the original flaw, called this "a bit of a wake-up call" because AI can now do the technical heavy lifting that once required specialized expertise, according to the Associated Press.

Why Georgia and not everywhere else

The voting equipment in question was made by Dominion Voting Systems, a company that has since been sold and renamed Liberty Vote. Plenty of other jurisdictions use the same machines. Most aren't at the same risk.

Mark Lindeman, policy and strategy director at Verified Voting, told the Associated Press that many of those jurisdictions applied a software patch that fixes the flaw. Others simply don't allow public release of the specific records needed to exploit it.

Georgia checks neither box. It's the only state that uses this system statewide, and it has an open records law that gives the public access to the cast-vote records and ballot images needed to reverse the shuffle. Lindeman called that combination a "perfect storm" and didn't mince words about it: "It's really embarrassing that this is still a possibility."

Georgia is also hosting one of the most closely watched U.S. Senate races in the country this year, which raises the stakes on getting this fixed before voters show up in November.

What state officials say, and what critics say back

Georgia election officials say they've already taken steps to reduce the potential harm from the vulnerability. That's a legitimate point. No source here disputes that some mitigation has occurred.

But election security advocates argue those steps don't go far enough, and that a full software fix, the kind other states have already applied, has not happened in Georgia. The Associated Press doesn't specify exactly what mitigation Georgia has implemented or why a complete patch hasn't been rolled out statewide, which leaves a real gap in the public record heading into a competitive election cycle.

What this flaw does and doesn't do requires precision. It cannot change a single vote. It cannot be used to alter results or manufacture fraud. The risk here is exclusively about secrecy, whether a bad actor with the right records could figure out which candidate a specific person voted for. That's a serious constitutional issue in Georgia, where ballot secrecy is a protected right under the state constitution, and a violation could open the door to legal challenges. But it is a different category of problem than vote manipulation, and conflating the two would misstate the risk.

A related complication, reported separately by Votebeat and noted by Karmactive, is that Georgia law barred ballots from using QR codes after July 1, and lawmakers have struggled to fund a replacement system for counties. That fight doesn't cause the secrecy flaw, but it shows Georgia's ballot-marking hardware is already tangled up in unresolved legislative disputes heading into November.

What's unresolved

Neither the Associated Press nor any of the outlets carrying its reporting specify a firm deadline by which Georgia's Secretary of State plans to apply a complete fix, or whether the state intends to restrict public access to the records that make the exploit possible. Verified Voting's Lindeman frames it as a matter of urgency given the November elections. Whether Georgia moves before ballots are cast, or voters head to the polls with the vulnerability still live, remains an open question.