Governor Abigail Spanberger today issued Executive Directive 6 to strengthen the Commonwealth’s cybersecurity and address the risks posed by the rapid development of artificial intelligence.
As part of the directive, Governor Spanberger instructed the Secretary of Public Safety and Homeland Security to develop a Commonwealth-wide plan to prevent and respond to cyberattacks and strengthen the resilience of critical infrastructure Virginians rely on. The Governor also ordered the establishment of a Cyber Consortium to improve coordination with public safety leaders, emergency management personnel, state agencies, universities and higher education institutions, and private sector partners across the Commonwealth.
“This moment demands leadership. It demands coordination. And it demands a thoughtful path forward to address the serious risk posed by the rapid development of AI — particularly as we have seen no leadership from this President and his allies in Congress,” said Governor Abigail Spanberger. “That’s why today, I am taking executive action focused on strengthening the Commonwealth’s cybersecurity, hardening our infrastructure, and developing a Commonwealth-wide plan to prevent and respond to AI-related cyberattacks.”
The Governor’s action comes as AI makes it faster and cheaper to find and exploit weaknesses in our digital infrastructure — as this week’s discovery of critical, decade-old flaws in PHP, the code behind most of the world’s websites, made clear. The new directive also comes amid increased reports of AI models going beyond their explicit instructions to access websites and hack government services, private companies, and financial networks. Earlier this month, Anthropic disclosed that some of its AI agents had taken “unintended” actions on local, federal, and state government websites — including within the Commonwealth of Virginia — without being directed to do so.
“Despite federal inaction, the Commonwealth will continue to address the very serious concerns Virginians have about the development of this technology. We’ve already seen how real it is,” said Governor Abigail Spanberger. “AI is rapidly reshaping the cyber landscape — evidenced by Anthropic AI agents taking improper actions on government websites across the country, including submitting fake Freedom of Information Act requests on a Virginia Department of Education website. While it is our understanding that no sensitive information was accessed, that makes me no less concerned about the future risks that lie ahead.”
Governor Spanberger added, “This new executive directive is just the beginning. I’ll continue to leverage my authority as Governor of Virginia to address these risks, strengthen our Commonwealth’s security, and prioritize the safety of Virginians. That is my obligation to every person in this Commonwealth, and I take it seriously.”
Executive Directive 6 instructs the Secretary of Public Safety and Homeland Security and Virginia’s AI Task Force to conduct regular briefings with leading AI technology companies, researchers, and regulators to identify emerging threats, evaluate potential risks, and develop strategies to strengthen cybersecurity and safeguard public safety. Virginia will also engage with public institutions of higher education and other states to assess AI cyber-risk preparedness and the risks of recursive self-improvement AI development.
“In public safety, preparation is pivotal to addressing all hazards. We cannot wait for a crisis to determine whether our systems, our workforce, and our partners are ready,” said Secretary of Public Safety and Homeland Security Stanley Meador. “We must account for the full range of threats we face — including those that originate in cyberspace but have real-world consequences. Governor Spanberger understands that protecting Virginians means preparing for threats across every domain. I’m proud to support her new executive directive — an important step forward in strengthening Virginia’s cybersecurity preparedness.”
The Governor’s directive aligns with the Commonwealth’s existing Unified Readiness Framework to modernize emergency preparedness and prioritize greater coordination among public safety, private sector, and community partners to keep Virginians safe during crises. The directive also builds on Virginia’s AI Task Force — established by the Governor through Executive Order 22 to confront risks to workforce displacement, data privacy, and cybersecurity.
Last month, in a letter to U.S. congressional leadership, Governor Spanberger called for immediate federal action to confront the unprecedented risks posed by the rapid development of AI. The Governor warned of significant negative impacts without new federal “guardrails that achieve meaningful AI accountability.”
Governor Spanberger’s Executive Directive 6 was praised by leading machine learning and cybersecurity experts.
“As AI development advances, governments need to prepare not only for the cybersecurity risks we face today but also for the risks that will emerge as these systems become more capable,” said Dr. Sarah Cen of Carnegie Mellon University, a leading machine learning professor focused on AI policy. “Virginia’s commitment to sustained collaboration among government, researchers, and technology leaders is an important step toward building the resilience needed to keep pace with a rapidly changing AI landscape.”
“Virginia has had the foresight of establishing, seven years ago, the Commonwealth Cyber Initiative (CCI), uniting 48 universities and colleges across the Commonwealth with a common mission of research, innovation, and workforce development in cybersecurity,” said Dr. Luiz DaSilva, Executive Director of the Commonwealth Cyber Initiative and Bradley Professor of Cybersecurity at Virginia Tech. “I am glad that Governor Spanberger is taking the responsible step forward to ensure Virginia stays at the forefront of AI-conscious cybersecurity with her new Executive Directive.”
“Governor Spanberger’s AI safety directive is a welcome step toward preparing Virginia for emerging AI risks,” said Nick Beckstead and Thomas Woodside, Co-founders of Secure AI Project. “The directive takes the danger of recursive self-improvement seriously, engages experts across the public and private sectors, and encourages AI companies to submit safety information to Virginia. It’s a thoughtful first step for Virginia, and we applaud the Governor for leading on this important issue.”
“The Center for Long-Term Cybersecurity’s research and experience in cyber operations strongly suggests that the ability to secure AI technology is deeply dependent on cybersecurity capabilities,” said Ann Cleaveland, Executive Director of the UC Berkeley Center for Long-Term Cybersecurity (CLTC). “With this Executive Directive, Governor Spanberger and Virginia place themselves among the forward-thinking states prioritizing cybersecurity by moving toward whole-of-state approaches and developing new means of interagency coordination. As digital threats continue to increase faster than federal support does, we expect the role of state executives to become even more critical to community cyber defense.”
Click here to read the full text of Governor Spanberger’s Executive Directive 6.