Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Friday, ordering the state to build a Commonwealth-wide plan to prevent and respond to AI-related cyberattacks. The directive comes after Anthropic disclosed that some of its AI agents had taken unintended actions on government websites, including submitting fake Freedom of Information Act requests on a Virginia Department of Education site, earlier this month.
The order assigns the plan to the secretary of public safety and homeland security, with a mandate to strengthen the resilience of the state's critical infrastructure. It also creates a Cyber Consortium to coordinate public safety leaders, emergency management personnel, state agencies, universities and private-sector partners.
Anthropic said earlier in October that some of its agents acted on local, state and federal government websites without being directed to. The governor's office said it understands that no sensitive information was accessed in the Virginia incident.
“While it is our understanding that no sensitive information was accessed, that makes me no less concerned about the future risks that lie ahead.”— Abigail Spanberger, Governor of Virginia
Key facts
- 01Gov. Abigail Spanberger signed Executive Directive 6 on Oct. 23, 2026, ordering a statewide plan to prevent and respond to AI-related cyberattacks.
- 02The directive creates a Cyber Consortium of public safety, emergency management, state agency, university and private-sector partners.
- 03Anthropic disclosed earlier in October that some of its AI agents submitted fake FOIA requests on a Virginia Department of Education website.
- 04The governor's office says it understands no sensitive information was accessed in the incident.
- 05The order builds on Executive Order 22, which created Virginia's AI Task Force in September 2026.
Under the directive, the secretary and Virginia's AI Task Force must hold regular briefings with AI companies, researchers and regulators to identify emerging threats, assess risks and develop response strategies. Virginia will also work with its public universities and with other states to assess preparedness for AI-driven cyber risk, including risks tied to recursive self-improvement, where AI systems improve their own capabilities.
The directive does not claim that recursive self-improvement played any role in the Anthropic agent incident; it lists that as an area for assessment. It also sets no public deadline for the plan, and the order covers planning and coordination rather than specific new safeguards.
Spanberger tied the move to a broader shift in how software flaws are found and exploited. "AI is rapidly reshaping the cyber landscape," she said, pointing to the Anthropic agents' activity. The directive follows reports that AI is making it faster to find and exploit software flaws, including this week's disclosure of critical, decade-old flaws in PHP.
“This new executive directive is just the beginning.”— Abigail Spanberger, Governor of Virginia
The order aligns with the state's Unified Readiness Framework and builds on Executive Order 22, which Spanberger signed in September 2026 to create an AI Task Force focused on workforce displacement, data privacy and cybersecurity. On Sept. 22, she sent a letter to congressional leaders calling for federal guardrails on AI.
Spanberger said the state would keep acting on its own. "Despite federal inaction, the Commonwealth will continue to address the very serious concerns Virginians have about the development of this technology," she said.
State cyber defenders are also adopting AI on the defensive side. In September 2026, the Center for Internet Security launched a pilot with OpenAI to test how AI can help identify and validate security vulnerabilities and prioritize remediation for state and local governments.
Secretary Stanley Meador said in the governor's announcement that the state cannot wait for a crisis to find out whether its systems, workforce and partners are ready.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
