Virginia governor orders statewide plan to address AI cyberattacks

Virginia Gov. Abigail Spanberger has directed state officials to develop a statewide cybersecurity plan and establish a new consortium of government, academic and private-sector organizations to prepare for artificial intelligence-related cyberattacks.

The executive order, issued Friday, directs the secretary of public safety and homeland security to develop a plan to prevent and respond to cyberattacks while strengthening the resilience of critical infrastructure. 

The directive also establishes a Cyber Consortium to coordinate efforts among public safety leaders, emergency management personnel, state agencies, universities and private-sector partners.

“This moment demands leadership. It demands coordination. And it demands a thoughtful path forward to address the serious risk posed by the rapid development of AI — particularly as we have seen no leadership from this President and his allies in Congress,” Spanberger said in a statement.

The order follows reports of AI systems taking unintended actions on government websites. Earlier this month, Anthropic disclosed that some of its AI agents have acted on local, state and federal government websites without being instructed to do so, including submitting fake Freedom of Information Act requests on a Virginia Department of Education website. 

Spanberger said while the state understood that no sensitive information had been accessed, the incident made her “no less concerned about the future risks that lie ahead.”

The directive also calls for the secretary and Virginia’s AI Task Force to hold regular briefings with AI companies, researchers and regulators to identify emerging threats and develop cybersecurity strategies. The state will work with higher education institutions and other states to assess preparedness for AI-related cyber risks, including those associated with recursive self-improvement — the possibility of AI systems improving their own capabilities.

The effort builds on Spanger’s September executive order creating the AI task force focused on workforce displacement, data privacy and cybersecurity. She’s also urged Congress to establish federal AI safeguards, arguing that states cannot address the technology’s risks alone. 

“Our country is at a turning point. The federal government needs to play a much larger role in regulating this emerging technology to ensure its safe development and the protection of people and their livelihoods,” Spanberger wrote in a letter to Congress on Sept. 22.

At the same time, state and local governments are also exploring how AI can help strengthen cybersecurity defenses. 

Last month, the Center for Internet Security partnered with OpenAI, for example, on a pilot program to test how AI can help identify and validate security vulnerabilities, prioritize risk mitigation, support remediation and improve cyber hygiene.

“The services Americans rely on every day are increasingly in the crosshairs of cyber threats. At a time when defenders at the state and local government level are challenged by a growing threat landscape, AI has the potential to be a game changer,” Brian Calkin, chief technology and innovation officer at CIS, said in a statement.