AI-assisted research helps close flaw in election agency’s planning tool

Cybersecurity company XBOW says its AI-assisted research uncovered a serious vulnerability in a public web application operated by the U.S. Election Assistance Commission. The company reported October 29 that the agency validated and fixed the issue before the November 3 midterm election.

The affected application was a resource and logistics calculator. XBOW explicitly distinguishes it from voting machines and voter-registration systems. Its disclosure describes a weakness that could have allowed an unauthenticated attacker to run code inside the application’s backend environment.

AI findings still require verification

NPR’s October 29 report describes researchers using AI to identify weaknesses that could otherwise escape attention, while emphasizing the need to distinguish exploitable problems from findings that do not translate into practical attacks. Its account says the affected server was not connected to voting machines or voter rolls.

XBOW says its automated testing is followed by human review to determine whether a finding warrants a report. The disclosed case concerns a repaired weakness, not evidence that ballots, registration records or election results were compromised.

Disclosure is part of the infrastructure

The EAC’s published vulnerability disclosure policy provides a defined route for reporting security issues. It limits testing to specified systems, requires researchers to avoid disruption and data exposure, and directs them to stop once a vulnerability is established.

The policy asks for at least 45 days before public disclosure and states that the agency does not operate a paid bug-bounty program. Those provisions make the reporting and remediation process as important as the tools used to discover weaknesses.