Virginia Gov. Abigail Spanberger ordered a statewide cybersecurity strategy to address threats from artificial intelligence, adding to states’ efforts to fill preparedness gaps left by the absence of comprehensive federal AI guardrails.
Executive Directive 6, issued Friday (Oct. 23), instructs Virginia’s secretary of public safety and homeland security to develop a coordinated plan to prevent and respond to cyberattacks and strengthen critical infrastructure.
The initiative brings government agencies, universities and private companies into a common effort to identify vulnerabilities and prepare for disruptions, the Royal Examiner reported Sunday (Oct. 25).
The approach underscores how state AI safety efforts extend beyond rules governing developers and businesses. Governments also must protect their own systems and essential services as AI makes finding and exploiting software weaknesses faster and cheaper.
Spanberger criticized Washington’s response and framed the directive as an exercise of state responsibility amid federal inaction, the report said.
Virginia has particular reasons to act. It is home to several federal agencies and facilities, including the CIA and Pentagon, and many government workers. A Richmond Federal Reserve analysis identified Virginia as having one of the country’s highest shares of civilian workers employed by the federal government, underscoring its exposure to disruptions affecting public institutions.
The state also has historically welcomed technology investment. Northern Virginia hosts the world’s largest data center market, placing it among the most concentrated computing hubs anywhere in the United States, the Joint Legislative Audit and Review Commission reported. The commission, which is the primary legislative oversight, program evaluation and research agency for the Virginia General Assembly, identified the state’s fiber network, proximity to major customers and state tax incentives among the factors supporting that growth. That footprint makes cybersecurity preparedness consequential for both government operations and the digital economy.
Under Spanberger’s directive, a new Cyber Consortium will connect public safety agencies, emergency management personnel, state officials, educational institutions and private-sector partners, according to the Royal Examiner report. The objective is better communication and cooperation among organizations protecting infrastructure such as electricity, water, transportation, communications and emergency services.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Regular briefings with AI companies, researchers and regulators will help officials track technological developments and emerging threats, the report said. Virginia will also work with universities and other states to assess cybersecurity readiness and risks from more advanced systems, including those capable of improving aspects of their own performance.
The immediate backdrop includes unintended actions by Anthropic AI agents on government websites, according to the report. Spanberger said an agent submitted false Freedom of Information Act requests through a Virginia Department of Education website.
“While it is our understanding that no sensitive information was accessed, that makes me no less concerned about the future risks that lie ahead,” Spanberger said of the breach, per the report.
Unlike chatbots that primarily generate answers, agents can navigate websites, complete forms and carry out multistep tasks. Their ability to act creates risks when their behavior exceeds their operators’ instructions. Anthropic acknowledged improper activity and restricted agents’ internet access during internal testing while reviewing safeguards, the report said.
The announcement also followed the Oct. 21 disclosure of serious vulnerabilities in PHP, a widely used web programming language. Researchers used advanced AI tools to help find and analyze the flaws, illustrating technology’s dual role of improving defensive research while potentially accelerating attackers’ discovery of exploitable weaknesses, according to the report.
Virginia’s response builds on its Unified Readiness Framework and expands the work of its existing AI Task Force. Academic expertise will contribute, including the Commonwealth Cyber Initiative, a network of 48 Virginia colleges and universities, the report said.
The directive nevertheless leaves implementation questions unresolved. The announcement specifies neither a cost nor new funding, and it does not establish a new cybersecurity regulatory program for private businesses or restrictions on public AI use.
For now, the emphasis is coordinated preparation. Its practical significance will depend on translating shared expertise into stronger defenses and response capabilities across the institutions delivering essential services.
For all PYMNTS AI coverage, subscribe to the daily AI newsletter.