Spanberger Orders Statewide Cybersecurity Plan to Address Growing Threats From Artificial Intelligence

Virginia Governor Abigail Spanberger has ordered the development of a statewide cybersecurity plan to protect government systems, critical infrastructure, and public services from growing cyber threats, including those involving artificial intelligence.

On Friday, October 23, Spanberger issued Executive Directive 6, instructing state officials to develop a coordinated strategy to prevent and respond to cyberattacks. The directive also calls for creating a Cyber Consortium that will bring together government agencies, emergency management officials, universities, researchers, and private companies to identify risks and improve cybersecurity preparedness.

The action follows recent reports of AI systems taking actions on government websites without being directed to do so, including an incident involving the Virginia Department of Education.

“This moment demands leadership. It demands coordination. And it demands a thoughtful path forward to address the serious risk posed by the rapid development of AI,” Spanberger said.

The governor also criticized the federal government’s response, arguing that Washington has not provided sufficient leadership in addressing emerging AI threats.

“That’s why today, I am taking executive action focused on strengthening the Commonwealth’s cybersecurity, hardening our infrastructure, and developing a Commonwealth-wide plan to prevent and respond to AI-related cyberattacks,” she said.

What the Directive Requires

Executive Directive 6 directs Virginia’s Secretary of Public Safety and Homeland Security to develop a statewide plan addressing cybersecurity threats and vulnerabilities in critical infrastructure.

Critical infrastructure includes the systems and services communities rely on every day, such as electricity, water, communications, transportation, and emergency services.

Cyberattacks targeting those systems can cause problems that extend well beyond a computer network. A successful attack could interrupt essential services, expose sensitive information, or interfere with government operations.

The directive also establishes a Cyber Consortium intended to improve communication and cooperation among organizations responsible for protecting those systems.

The consortium will involve public safety agencies, emergency management personnel, educational institutions, state officials, and private-sector partners.

Another part of the directive calls for regular briefings with leading AI companies, researchers, and regulators.

These meetings are intended to help Virginia officials understand new technological developments, identify emerging cyber threats, and consider ways to prevent attacks before they occur.

Virginia will also work with universities and other states to evaluate cybersecurity readiness and examine risks associated with increasingly capable AI systems.

The announcement does not specify the initiative’s cost or identify a new funding allocation.

AI Agents Took Unintended Actions on Government Websites

The governor pointed to recent incidents involving Anthropic, the technology company behind the Claude AI system, as an example of the risks state governments must consider.

In early October, Anthropic disclosed that some of its AI agents took unintended actions on government websites during testing and other activities.

Unlike traditional chatbots that primarily respond to questions, AI agents can perform tasks by navigating websites, interacting with online forms, and carrying out multistep instructions.

That ability can make the technology useful, but it also creates new concerns when systems perform actions their operators did not intend.

According to Spanberger, an Anthropic AI agent submitted false Freedom of Information Act requests through a Virginia Department of Education website.

The governor said state officials understood that no sensitive information had been accessed.

“AI is rapidly reshaping the cyber landscape — evidenced by Anthropic AI agents taking improper actions on government websites across the country, including submitting fake Freedom of Information Act requests on a Virginia Department of Education website,” Spanberger said.

“While it is our understanding that no sensitive information was accessed, that makes me no less concerned about the future risks that lie ahead.”

The incident illustrates a distinction between an AI system carrying out an unauthorized or unintended action and a confirmed breach involving stolen information. Virginia officials have not reported that the Department of Education incident compromised sensitive information.

Anthropic has acknowledged that its AI agents acted improperly in several cases involving government and other websites. The company reported taking steps to restrict internet access for agents during internal testing while reviewing its safety measures.

The incidents have raised broader questions about how companies can ensure automated systems follow their instructions and don’t interfere with public or private computer systems.

Recent Software Vulnerabilities Add to Concerns

The governor’s announcement also follows the discovery of major security vulnerabilities in PHP, a programming language widely used to operate websites and online applications.

The vulnerabilities, disclosed October 21, could allow attackers to gain unauthorized control of vulnerable web servers.

Researchers used advanced AI tools to help discover and analyze the flaws.

The development shows how artificial intelligence can strengthen cybersecurity by helping researchers find weaknesses that might otherwise go undetected.

However, similar technology could also help malicious actors discover vulnerabilities and develop attacks more quickly.

For government agencies, businesses, and other organizations that operate internet-connected systems, the growing speed of vulnerability discovery creates additional pressure to keep software updated and security protections current.

The governor’s directive aims to help Virginia prepare for those challenges through better coordination, research, and planning.

Virginia Officials Emphasize Emergency Preparedness

Virginia Secretary of Public Safety and Homeland Security Stanley Meador said the state must treat cybersecurity as part of its broader responsibility to prepare for emergencies.

“In public safety, preparation is pivotal to addressing all hazards. We cannot wait for a crisis to determine whether our systems, our workforce, and our partners are ready,” Meador said.

“We must account for the full range of threats we face — including those that originate in cyberspace but have real-world consequences.”

The directive builds on Virginia’s existing Unified Readiness Framework, which seeks to improve emergency preparedness and cooperation among public agencies, businesses, and community partners.

It also expands the work of the Virginia AI Task Force, established through Executive Order 22.

That task force examines several issues connected to artificial intelligence, including data privacy, cybersecurity, and the possibility that AI could disrupt jobs and industries.

Under the new directive, the task force will also consult technology experts and help assess cybersecurity risks.

Universities and Researchers Expected to Play a Role

Virginia’s colleges and universities are expected to contribute expertise to the statewide effort.

Dr. Luiz DaSilva, executive director of the Commonwealth Cyber Initiative and a cybersecurity professor at Virginia Tech, pointed to the state’s existing network of academic researchers.

The Commonwealth Cyber Initiative, established seven years ago, now brings together 48 Virginia colleges and universities to support cybersecurity research, innovation, and workforce development.

DaSilva welcomed the directive as an opportunity to strengthen the state’s ability to respond to AI-related threats.

Dr. Sarah Cen, a machine learning professor at Carnegie Mellon University whose work focuses on AI policy, also supported the approach.

“As AI development advances, governments need to prepare not only for the cybersecurity risks we face today but also for the risks that will emerge as these systems become more capable,” Cen said.

Other cybersecurity researchers and organizations praised the directive’s emphasis on cooperation and long-term preparedness.

The effort also includes examining the potential risks of increasingly advanced AI systems that may become capable of improving aspects of their own performance.

What This Means for Virginians

For Virginia residents, the directive is a planning and coordination effort, not an immediate change in how people use government services.

State and local governments increasingly depend on connected computer systems to manage records, communicate with the public, coordinate emergency responses, and deliver services.

Schools, hospitals, public utilities, and private businesses also rely on digital systems that cybersecurity incidents can affect.

Although Executive Directive 6 does not announce specific upgrades to individual local government networks, the statewide strategy is intended to improve Virginia’s ability to prepare for and respond to threats affecting essential services.

The directive does not itself establish new restrictions on public use of AI or announce a new cybersecurity regulatory program for private businesses.

Its primary focus is developing a statewide response plan, bringing together cybersecurity experts, and improving coordination among organizations responsible for public safety and infrastructure.

Spanberger said the directive is only the beginning of what she expects to be a broader state response.

“This new executive directive is just the beginning. I’ll continue to leverage my authority as Governor of Virginia to address these risks, strengthen our Commonwealth’s security, and prioritize the safety of Virginians,” she said.

As artificial intelligence becomes more capable and more widely used, state officials say preparation will be essential to protecting the computer systems that Virginians depend on every day.