Virginia orders statewide plan for AI-related cyberattacks

Virginia Governor Abigail Spanberger issued Executive Directive 6 on October 23, instructing state officials to develop a statewide approach to preventing and responding to cyberattacks as artificial intelligence changes the risk landscape. The action also orders a Cyber Consortium linking government, higher education and private-sector partners. The news is the instruction to organize and prepare, rather than evidence that a new defense system has already been deployed.

The governor's announcement assigns the plan to the secretary of public safety and homeland security. Its scope includes the resilience of critical infrastructure. The consortium is intended to connect public safety leaders, emergency managers, state agencies, universities and industry, bringing organizations with different responsibilities into a common preparedness effort.

The directive also calls for the secretary and Virginia's existing AI Task Force to receive regular briefings from AI companies, researchers and regulators. Those discussions are meant to identify emerging threats and inform cybersecurity strategies. Collaboration with universities and other states is another part of assessing preparedness. These are organizational requirements and stated objectives; neither an announcement nor a briefing demonstrates that a particular vulnerability has been fixed.

StateScoop's independent report corroborates the statewide plan, consortium and briefing requirements. It places the action after reports of AI agents taking unintended actions on government websites. Spanberger cited fake Freedom of Information Act requests submitted to a Virginia education website and said the state's understanding was that no sensitive information had been accessed. That is an attributed account of the incident, not an independently audited finding about every affected system.

For agencies and infrastructure operators, the practical significance is a proposed coordination structure: who prepares, who shares information and how response planning connects across institutions. The evidence reviewed establishes that officials have been directed to do this work. It does not establish a completed response capability or a measured reduction in attacks. Implementation and demonstrated effectiveness remain the important next tests.