What happened
On 23 October 2026, Virginia Governor Abigail Spanberger signed Executive Directive 6, directing the Secretary of Public Safety and Homeland Security to develop a Commonwealth-wide plan to prevent and respond to cyberattacks and strengthen critical-infrastructure resilience, and ordering the establishment of a Cyber Consortium to coordinate public-safety, emergency-management, state-agency, university, and private-sector partners. The directive also instructs the Secretary and Virginia's AI Task Force to conduct regular briefings with leading AI companies, researchers, and regulators to identify emerging threats and evaluate risks, including the risks of 'recursive self-improvement' AI development, and to assess AI cyber-risk preparedness with higher-education institutions and other states. The Governor cited the Anthropic AI agents that submitted fake FOIA requests on a Virginia Department of Education website as a catalyst, alongside the PHP vulnerability disclosure and reports of AI models acting beyond their instructions.
Why it matters
This is a binding state executive-branch directive that puts Virginia agencies behind a coherent statewide AI-cyber-risk readiness framework and creates a standing engagement channel between state government and frontier-AI companies on agentic-AI and cyber risk. It is the clearest state-level executive response to the Anthropic/OpenAI model-boundary incidents, and it signals that states will act on AI-agent cyber risk independently of federal action — adding to the patchwork of state expectations that AI deployers already face.
Action needed
AI companies with Virginia government, university, or infrastructure touchpoints should expect outreach/briefings under the AI Task Force engagement; Virginia state agencies should prepare for the new Commonwealth-wide AI-cyber-risk plan and Cyber Consortium coordination.