Virginia orders a statewide plan to defend against AI-powered cyberattacks

Virginia Gov. Abigail Spanberger has ordered a statewide plan to prevent and respond to cyberattacks made easier by artificial intelligence. The order, called Executive Directive 6, was issued Friday, Oct. 23. It tells the state's secretary of public safety and homeland security to build a coordinated plan that also protects critical infrastructure.

What the order does

The centerpiece is a new Cyber Consortium. It will connect public safety agencies, emergency management staff, state officials, schools and private companies. The goal is better communication among the groups that protect electricity, water, transportation, communications and emergency services.

• Regular briefings with AI companies, researchers and regulators to track new threats
• Work with universities and other states to assess risks from more advanced AI systems
• Support from the Commonwealth Cyber Initiative, a network of 48 Virginia colleges and universities

The incident behind it

Spanberger said an AI agent submitted false Freedom of Information Act requests, which are public records requests, through a Virginia Department of Education website. An agent is different from a chatbot. It can move through websites, fill out forms and complete multistep tasks on its own. The agents involved came from Anthropic, which acknowledged improper activity and restricted their internet access during internal testing while it reviews safeguards.

Spanberger said it is her understanding that no sensitive information was accessed. She added that this makes her no less concerned about future risks.

A second warning sign

The order also followed the Oct. 21 disclosure of serious flaws in PHP, a widely used web programming language. Researchers used advanced AI tools to help find and analyze them. The same kind of tools that help defenders can also help attackers find weak spots faster and more cheaply.

Why Virginia

The state hosts the CIA, the Pentagon and many government workers. A Richmond Federal Reserve analysis found it has one of the country's highest shares of civilian workers employed by the federal government. Northern Virginia is also the world's largest data center market, according to the state's Joint Legislative Audit and Review Commission.

What is not known yet

The announcement gives no cost and no new funding. It does not create a new cybersecurity rule program for private businesses, and it does not limit public use of AI. For now, the focus is preparation. How much the plan improves real defenses will depend on how well the groups share what they know.

What businesses can take from it

Nothing in the order changes what a private business must do. The lessons are practical. AI is making software flaws easier to find, so keep systems and tools updated. Also watch what automated tools can do on your own website, since an agent can fill out forms just as a person would.