We test whether AI models and agents can be used to run influence operations, and whether they repeat wrong, stale or out-of-place information about voting. Every claim the system makes is fact-checked against official, current, in-scope evidence.
First-person walkthrough
Walk the site in first person and run a red team test at each station: inspect, disrupt, limit, retest. 6 stations, about five minutes.
Illustrative environment
Election security red teaming
Election harm reaches an AI system two ways: someone tries to use it for an influence operation, or it repeats something about voting that is wrong, stale or from the wrong place. Our campaigns test both, and fact-check every claim the system makes along the way.
Election security specialists run voter suppression, official and candidate impersonation, synthetic media, fabricated evidence, mass-produced variants and targeted discouragement against your agents, in single requests and across long conversations.
We seed retrieval and tool results with stale notices, rules from the wrong state, rumor chains that trace back to one post and look-alike official sources. Then we fact-check what the system says.
The same campaign runs at several points in the election calendar, because what counts as current changes as Election Day nears and again once counting starts.
Every attempt and every checked claim is kept as a tamper-evident decision record. Answers to voters are scored with Intonation's voter-answer evaluation, and each failure gets a control and a retest.
Example campaign plan
Fictional plan for illustration. Each engagement sets its own rows, phases and depth.
Operations at scale
Campaigns include agents filing registrations and ballot requests in other people's names, challenging voters in bulk, probing results sites and phishing election staff. We check whether each attempt is stopped, by whom, and how fast.
Election security threat taxonomy
Every campaign is scoped against the same eight lanes, so findings from different clients, models and points in the calendar can be compared. The marks show where each lane is covered today.
Lanes 6 to 8 are tested at the level of scenario and response, and detection names what an attack does without describing how. We do not produce working exploits, threat content or targeting data.
Built for
Ways to start
A report describes a failure once. We leave a test that catches it again, a corrected answer to train on, a control that holds it at the point of sending, and a retest each time the system changes.
We run your assistant on our published questions and on a private set built for your jurisdictions, languages and sources. You get a score for each threat lane, every failure with the answer it should have given, and a regression suite you keep.
Try the public questions ↗Election security specialists run the full campaign against your models and agents, with poisoned retrieval and long conversations, at several points in the election calendar.
We replay what your systems faced during the 2026 midterms against the taxonomy, find what slipped through, and turn each gap into a test and a fix before 2028.
Retests whenever a model, prompt, source or rule changes, with Intonation enforcing the same checks at the point of sending while fixes land.
What you keep
In depth
Public research, standard frameworks and a simplified look at our method. Working tools, attack libraries and client data stay private.
Most election harms from AI are mundane and specific: a wrong registration deadline, a polling place that moved, a fake call in a candidate's voice. In a 2024 test by Proof News and the AI Democracy Projects, expert raters judged about half of five leading models' answers to voting questions inaccurate. That same year a cloned-voice robocall reached New Hampshire primary voters, and the FCC confirmed that AI-generated voices fall under existing robocall rules.
We test the systems that answer voters and the people who serve them: assistants, hotlines, results pages and press tools. Each answer is checked against the official source for that jurisdiction and date. We also test whether the system knows when to stop and send people to the election office.
Failure classes we test, mapped to public frameworks so findings slot into the reports you already file. ATLAS IDs can be searched on the MITRE ATLAS site.
| Ref | Class | What it looks like | Frameworks | Control that belongs there |
|---|---|---|---|---|
| EL-1 | Wrong procedural facts | A deadline, ID rule or polling place wrong for that jurisdiction. | Answers grounded in official sources, with dates and links. | |
| EL-2 | Stale information | Correct last cycle, wrong now. | Source freshness checks, and routing to the office past the update date. | |
| EL-3 | Impersonation | A cloned voice or video of an official or candidate. | Provenance checks, verified channels and response playbooks. | |
| EL-4 | Discouraging voters | Answers that talk eligible people out of voting. | Policy and classifiers for discouragement patterns. | |
| EL-5 | Results misreporting | Summaries that misstate counts or call races early. | Certified sources only, and no projections. | |
| EL-6 | Partisan asymmetry | Answer quality differs by candidate or party. | Paired prompts across parties and symmetric policies. | |
| EL-7 | Targeting election workers | The product helps find or harass officials. | Personal data controls and escalation to security teams. |
# Simplified accuracy check. Jurisdiction fixtures and question sets stay private.# Taken from the county election office, datedFIXTURE = load_official("state-x/county-y", as_of="2026-10-20") def check(answer, field: str) -> dict: official = FIXTURE[field] return { "correct": matches(answer.value, official.value), "dated": answer.as_of is not None, "cites_official": official.url in answer.citations, "routes_when_unsure": answer.confident or answer.points_to_election_office, } results = [check(ask(assistant, q), q.field) for q in QUESTIONS]failures = [r for r in results if not all(r.values())]print(f"{len(failures)} of {len(results)} answers need review")Simplified for publication. Payload libraries, harness code and scoring rubrics stay private and are shared with clients under NDA.
For ███ of the counties tested, the assistant stated the previous cycle's deadline with no date or source, because its retrieval index had not been refreshed since the change.
Public research and guidance behind this page. Summaries are ours.
Expert testers rated about half of five leading models' answers to voting questions as inaccurate.
Confirmed that AI-generated voices count as artificial voices under the TCPA, after a cloned-voice robocall reached New Hampshire primary voters.
Faked audio of a party leader spread on Facebook two days before a close national election, leaving fact-checkers little time to respond.
Covers confident false output and over-reliance, the category most voter-facing findings fall under.
Defines twelve generative AI risk categories, from CBRN information to information integrity, with suggested actions for each.
How an engagement runs
Scope, access, responsibilities and the final deliverable are agreed before work begins.
Each engagement starts from a specific threat model: the system, its intended use and the decision you need to make.
Technical and policy specialists work together when a finding needs both kinds of analysis.
Methods and evidence support independent review and reproduction, within the limits of the NDA.
Each finding is mapped to where it entered the pipeline, the control that belongs there and who owns it, then retested after the fix and when the system changes.
Between campaigns
A red team finds where a system fails. These keep it in tune through the rest of the election calendar.
Before the calendar starts, we map every agent and channel that will talk about voting, the official sources each should rely on, the names it may sign for and who reviews escalations.
When a model, prompt, source or rule changes, we rerun the campaign and report what moved, through certification.
The same checks enforced at the point of sending, with a free version in the Fermata MCP server.
Try Intonation ↗Tabletop exercises for trust and safety, communications and support teams, built on fictional jurisdictions.
Training ↗Practice and training
Red Teaming Games lets your team break a synthetic workflow, choose the control and its owner, and replay the attack. The live AI Red Teaming and Risk Governance workshop covers red teaming agents and turning findings into controls.
Specialists can apply to join the Trusted Red Team Network for future campaigns.
Tell us about the system and the decision ahead. We aim to reply within two business days.