Security researchers reported on Sunday, Sept. 13, 2026, that a vulnerability in Georgia’s voting machines could allow individuals to match voters with their specific ballots. While election officials stated the flaw does not allow for results to be changed, security experts expressed concern that advances in artificial intelligence make the weakness easier to exploit by reconstructing the sequence in which ballots were cast.
Georgia currently uses touchscreen voting machines made by Dominion Voting Systems, which has since been sold and renamed Liberty Vote. The machines print paper ballots for scanning. A software flaw identified in 2022 allows randomized cast-vote records and electronic ballot images to be reordered chronologically. When combined with public early-voting lists and audit logs, researchers found it possible to identify how specific individuals voted.
Max Springer, a researcher at Princeton University, demonstrated the vulnerability by using a publicly available AI assistant to analyze data from Georgia’s May primary. Springer identified with "fair certainty" the votes of more than 2,200 people in Cherokee and Heard counties. J. Alex Halderman, a computer science professor at the University of Michigan, described the use of AI as a "wake-up call" because it automates technical tasks previously requiring specialized programming skills.
The Georgia State Election Board recently considered a proposal by member Salleigh Grubbs to require a software update by Sept. 15, 2026, to fix the flaw. However, the board rejected the proposal in August. An agency lawyer argued that the update had not been state-certified, would take months to implement, and lacked legislative funding. Board member Sara Tindall Ghazal noted that while the possibility is "intensely frustrating," revealing how someone voted remains a felony.
A person voting in Georgia would notice no immediate change at the polling station, as the flaw exists in how data is recorded and stored by scanners after the ballot is cast. However, the impact is felt in the potential loss of privacy; a campaign or private citizen could theoretically use public records requests to determine how a specific person voted. Georgia officials have attempted to mitigate this by instructing county clerks to redact certain data from public records, but advocates like Marilyn Marks of the Coalition for Good Governance argue that withholding documents does not address the underlying recording of identifiable data.
The situation highlights a tension between public transparency laws and digital privacy in the age of AI. While other states using similar equipment have either applied software patches or restricted the release of cast-vote records, Georgia’s combination of an unpatched system and open records laws creates what researchers call a "perfect storm." As the November 2026 midterms approach, the state will continue using the current software version. The Secretary of State’s office is currently working with a vendor to manually scramble the order of ballot images before they are released to the public to prevent future re-identification.