Ask an Expert: Could hackers use AI to influence US elections?

UNIVERSITY PARK, Pa. — Concerns about general election infrastructure and the role artificial intelligence (AI) might play in undermining election security are sparking debates around the country in the runup to the midterm elections. Although systems are in place to keep elections secure, Joseph Squillace, associate teaching professor of cybersecurity in the Penn State College of Information Sciences and Technology, says the increasingly prevalent role social media plays in the news ecosystem, alongside rapid development of AI since the last major U.S. election cycle, introduces new vulnerabilities and concerns.

In the following Q&A, Squillace, who studies the cybersecurity of critical infrastructure, election-related disinformation and voting integrity, discussed the pressing issues facing U.S. election security and the impact AI has had on the way people think about elections.

Q: What are the big cybersecurity concerns around voting? How realistic is it to hack voting and tabulation systems?

Squillace: People often discuss the integrity of election machines. While in a closed lab environment, researchers have successfully hacked voting machines — changing votes and the outcomes for specific races — but these are in-lab tests where hackers were given direct access. Most election machines are in a closed-circuit type system that lacks external internet access, so a hacker would first have to get inside that closed network. This means an attacker would have to get within physical proximity of a machine to insert a thumb drive or have access to the network the machine is connected to. While there’s still a risk, polling officials can mitigate chances by being aware of who's near machines, who has access to the facility and ensuring that security controls lock down the data and network.

Additionally, the U.S. Election Assistance Commission reports that in 2024, more than 98% of jurisdictions used voting equipment that produces a paper ballot or an auditable paper record, providing a record that cannot be changed remotely. More than 10,000 local jurisdictions run decentralized elections with different equipment, rules and staff — meaning no single target exists. It is highly unlikely that anyone could target all those jurisdictions and machines at once, while also having physical access to the devices.

The most likely avenue of a cyberattack would be towards the statewide and local voter registration databases maintained by local governments. Since these systems store the information that determines the election outcome, if a hacker were to access those systems, they could in theory change the outcome. We have controls and systems in place to limit this risk, but federal support for that work has shifted ahead of this midterm cycle. This puts more weight on state and county officials to ensure security.

Q: Could a foreign nation interfere with the election?

Squillace: It’s hard to hack the count, but it’s easy to hack the conversation — the weak point isn’t the infrastructure, but the perception of the vote, so foreign actors are increasingly going after this perception through social media, AI, phone operations and cloned voices to shape what people believe about the election and whether they vote. Our adversaries know there are very limited things we can do to control the mass of media on this side, so they exploit it. It’s cheap, it’s effective, and it has a large impact on how they manipulate elections.

Q: What potential dangers does AI pose to U.S. election infrastructure?

Squillace: The reality is that although AI poses very real cybersecurity concerns, the approach would be no different than what a hacker looking to destabilize an election would have taken before. AI might be capable of executing an attack far faster, but without physical access to the machine or the network, an attack still isn’t possible.

Outside of cybersecurity, AI is helping to spread election misinformation because there are no consistent laws governing it. According to the advocacy group Public Citizen, not every state has enacted laws on election deepfakes, and the rules that have been suggested vary widely from state to state. There is no federal law governing AI in elections, and candidates themselves, including members of Congress, are using AI in political ads.

This fake content is a force multiplier for anyone trying to influence an election, because it can quickly and cheaply produce fake content. An adversary pushing one candidate can flood feeds with deepfakes showing an opponent in a situation that isn’t real, a quote voters won’t agree with, or false numbers, such as claiming a candidate is up by 65%. As voters see and hear more misinformation, a bias builds, and some may conclude that their vote doesn’t count or that the election has already been taken over.

Q: How else is U.S. election infrastructure vulnerable?

Squillace: Cases have gone to court regarding election integrity, but out of the more than 158 million ballots counted in 2024, from more than 211 million active registered voters, the very small number of cases claiming voter fraud, voting concerns or voting irregularities are minor anomalies. The bigger concern is that you don't get your ballot, or that a family member who lives in a retirement home votes by mail, that mail gets lost, and their vote doesn't get counted.

Social media is often overlooked in terms of election integrity concerns. Disinformation campaigns, enabled through foreign actors or otherwise, can manipulate election outcomes without accessing the technical component. I’ve seen and studied this phenomenon in other parts of the world, specifically in Hungary last year as a Fulbright scholar, where I studied the information environment around the country’s 2026 election,

Particularly, my collaborators and I looked at the social media campaigns that were coming from outside countries pushing one candidate or the other in the lead up to their spring election. The response to these campaigns included encouraging old school voting methods like paper ballots, and encouraging younger voters to investigate candidates, confirm their voter information and come out in person to vote by paper with their ID in hand. One likely aftereffect is that people were more trusting of the actual process, which may have contributed to the election swinging the other way this spring. Hungarian turnout reached a record 79.5%, and the opposition won a two-thirds majority —an incumbent of 16 years was replaced with a new leader moving forward, with younger voters playing a significant role.

There is also potential that after an election, traditional media or social media personalities may push the idea that the winner somehow cheated. Whether there is evidence or not, these claims plant the seed in the public’s mind that the election is no longer trustworthy. If voters can’t believe in what their vote is doing, the result is a civic breakdown in how people believe society functions. People need to be aware of this possible manipulation, because it's subtle, but it happens every single day on social media and the other platforms where we get our news.

Q: What can voters do to spot AI-driven manipulation and ensure their vote is secure and accurate?

Squillace: Check the source — who posted it? What reputable outlet is reporting it? Does it give you an angry, visceral reaction, as if it’s designed to provoke an emotional response rather than inform you? Stop and think about whether the message is real before you act on it or share it. Be especially careful with anything that says a polling place is closed or has moved and confirm it with your county election office or your state’s official election website. Trusting what you read blindly, or spreading it without checking, is how misinformation wins.

To secure your vote, ask to confirm that the information on your ID matches your record in the polling system. This helps you make sure your ballot matches your identity and reflects what you voted for. Make sure, too, that no one has already voted in your name. If you mail your ballot, you can track it to make sure that your ballot was received, entered and counted by the state correctly. These are old-school checks that anyone can do without relying on the technology.

We can also push for further legislation, conducting post-election audits and accountability checks to ensure election officials are transparent with how the elections are being run, and that the data matches what people voted for. Forty-eight states already require some form of post-election audit, according to the Brennan Center, so the push is to make those audits rigorous, routine and public. The takeaway from here is not to be so worried about someone hacking a voting machine — focus on holding yourself and your family accountable to do what you can to ensure your vote counts.