The $20 Exploit: How an AI Agent Broke Georgia's Ballot Privacy

An AI coding agent costing $20 successfully de-anonymized 1.52 million Georgia ballots from the May 2026 primary, prompting a shift in election data transparency policy.

The exploit combined a known, unpatched vulnerability with accessible public data and the force-multiplier capability of an AI agent, highlighting the collapse of the barrier to exploiting technical vulnerabilities.

Georgia's response to the incident included redacting ballot ID numbers in public records and shuffling ballots before printing, but a permanent technical resolution remains blocked by a political stalemate in the state legislature.

In August 2026, Max Springer, a postdoctoral research fellow at Princeton's Center for Information Technology Policy, demonstrated that a commercially available AI coding agent—costing just $20—could de-anonymize 1.52 million Georgia ballots from the May 2026 primary. By processing public cast-vote-record files and early-voting sign-in lists, the agent successfully matched 98.9% of in-person ballots across 114 counties. This event marks the first documented instance of AI agent behavior directly forcing a shift in election data transparency policy, signaling a new era where the barrier to exploiting known technical vulnerabilities has effectively collapsed.

The structural mechanism behind this exploit is deceptively simple: it combines a known, unpatched vulnerability with accessible public data and the force-multiplier capability of an AI agent. The vulnerability, identified as a flaw disclosed in 2022 , involves Dominion ImageCast Precinct and ImageCast Evolution scanners that assign deterministic, non-random unique identifiers to electronic ballot records. While a software fix (version 5.17) was certified by the Election Assistance Commission in March 2023, it remained largely undeployed in Georgia by August 2026. Springer simply pointed an AI agent at the 2024 academic paper detailing the flaw and requested a pipeline to exploit it. The agent produced a functional solution within hours, requiring no insider access, network exploitation, or proprietary data.

Georgia's response was immediate and reactive. Secretary of State Brad Raffensperger ordered the redaction of ballot ID numbers in public records and instructed counties to shuffle ballots before printing. This directive triggered a contentious emergency meeting of the Georgia State Election Board on October 1, 2026. During the session, board member Salleigh Grubbs argued that the redaction order violated state law enacted after the 2020 election, while proposing—unsuccessfully—that voters place ballots in secure boxes for later scanning. Ultimately, the board passed a 3-2 resolution urging the Secretary of State to update the voting machines, even as Gabriel Sterling of the Secretary of State's office pushed back on the severity of the findings, citing lingering uncertainty in any matching attempt.

The path to a permanent technical resolution remains blocked by a political stalemate. Funding for a comprehensive Dominion software overhaul has stalled in the state legislature, caught in a feud between Raffensperger and conservative lawmakers. This friction leaves Georgia in a precarious position as early voting for the November 2026 midterms begins on October 13. While Ben Adida of VotingWorks maintains that the Secretary of State's office had previously addressed security concerns, the reality on the ground—such as the agent's ability to match the majority of voters in Heard and Cherokee counties—suggests that the gap between policy and technical reality is widening.

The implications of this incident extend far beyond Georgia. As J. Alex Halderman, a co-author of the original research on the vulnerability, noted, this is a wake-up call regarding how easily technical flaws can be weaponized when AI handles the heavy lifting. This event illustrates a broader pattern in agent governance: AI is collapsing the time-to-exploit window for known vulnerabilities, forcing regulators to react in real-time to agent-driven threats. This shift raises urgent questions developer liability and the adequacy of current oversight frameworks, particularly as the Federal Trade Commission begins to scrutinize the broader agent liability gap.

Several open questions remain as other jurisdictions observe Georgia's struggle. With 21 states utilizing the affected scanners, the risk is not localized; it is a systemic exposure. The core tension lies in the balance between transparency—the public's right to verify election records—and the fundamental requirement of the secret ballot. As Springer observed, the secret ballot has long been an article of faith in U.S. elections, a principle now being tested by the ease with which AI can bypass traditional safeguards. Moving forward, the focus must shift toward whether states will prioritize the deployment of version 5.17 or newer software, or if they will continue to rely on administrative workarounds that may prove insufficient against increasingly capable autonomous agents.