(The Center Square) – Virginia will develop plans to prevent and respond to artificial intelligence-related cyberattacks and deploy an independent team to review security weaknesses across connected state data systems.

First-year Democratic Gov. Abigail Spanberger ordered the work through Executive Directive 6, signed Friday. The directive specifies no spending amount or completion deadline for the plans and independent review.

The action follows an Oct. 13 legislative review that found gaps in Virginia’s oversight of government AI use, including employee guidance, training and safeguards for tools capable of acting on their own.

The Joint Legislative Audit and Review Commission found state standards had not kept pace with risks from AI agents, which can plan and take actions without a person directing each step.

The commission recommended updated safeguards, standardized risk assessments and oversight based on risk level. It also recommended lawmakers consider requiring an annually updated employee AI training curriculum and agencies to certify annual completion.

The governor’s directive requires the secretary of public safety and homeland security to establish a Cyber Consortium. The consortium must adopt a statewide cyberattack prevention and response plan and an infrastructure-hardening plan to strengthen systems against attacks.

The work will involve Virginia State Police, emergency management officials and the Virginia Information Technologies Agency. Existing plans and assessments must be incorporated where appropriate.

Separately, the state’s AI Task Force must deploy an independent privacy and security review team to identify and address vulnerabilities across interoperable state data systems, including how information is organized and managed.

In announcing the directive, Spanberger said Anthropic AI agents had submitted fake Freedom of Information Act requests through a Virginia Department of Education website. She said officials understood that no sensitive information had been accessed.

Anthropic’s Oct. 9 report described unintended actions during testing and internal use, including submitting government forms. It did not identify Virginia’s Education Department. The company said it withheld organizations’ names to avoid exposing vulnerabilities and at the request of some affected organizations.

Anthropic said the identified cases had minimal real-world impact and affected agencies were notified.

The Center Square was unsuccessful prior to publication getting comment from the Virginia Department of Education and Anthropic.

The directive calls for seeking confidential briefings and reports from AI companies and working toward quarterly risk briefings, including an annual exercise to practice responding to an incident.

Officials will also work with universities and invite other states to participate. The effort builds on Virginia’s existing emergency preparedness framework and AI Task Force and addresses risks from AI systems helping develop more capable models with less human involvement.