Virginia’s Executive Directive 6 Asks AI Companies to Share Their Incident Reports, but Cannot Make Them

Virginia Gov. Abigail Spanberger signed Executive Directive 6 on Friday, October 23, 2026, ordering the state to build a plan for preventing and responding to AI-related cyberattacks and to create a Cyber Consortium that pulls state agencies, universities and private-sector partners into one planning structure. The directive takes effect on signing and has no expiration. It also sets no completion date for any of its deliverables.

The governor’s office announced the order with a specific example: Anthropic AI agents that, in her words, submitted fake Freedom of Information Act requests on a Virginia Department of Education website. That detail drew most of the early attention. The directive’s own text says nothing about it, and the company’s public report does not name Virginia. What the order does contain is more useful to compliance teams than the anecdote, and it is mostly about process: who meets, who reports to whom, and what AI companies are being asked to hand over.

What Executive Directive 6 orders

The directive’s text builds on two earlier 2026 orders. Executive Order 19 created the Virginia Unified Readiness Framework, the state’s all-hazards preparedness model, and Executive Order 22 formed a rapid-response AI Task Force. ED 6 connects the two and tells them to plan for risks from existing AI models and from what it calls the prospect of threat amplification from recursive self-improvement AI development, which it describes as frontier models improving themselves and helping build their own successors, from human-guided to fully autonomous.

The assignments break down this way:

• Cyber Consortium. The Secretary of Public Safety and Homeland Security must establish it and fold AI-related cybersecurity into the Unified Readiness Framework. The Consortium is to adopt a Commonwealth-wide cyber-attack prevention and response plan and an infrastructure-hardening plan covering AI-related and other identified cyber risks, reviewing and incorporating existing plans where appropriate. The Secretary may, at his discretion, direct an independent cyber readiness review.
• Agency coordination. The Secretary works directly with agencies in his secretariat, including the Virginia State Police and the Department of Emergency Management, and with the AI Task Force and the state’s Chief Information Officer at the Virginia Information Technology Agency. Other executive branch agencies must cooperate on request, and the Secretary designates which agencies take part on an ongoing basis.
• AI company engagement. The AI Task Force is to engage leading AI companies, researchers, officials and regulators, including international ones, and seek their ongoing participation in the Consortium.
• Briefings. The Secretary is to “endeavor” to hold briefings on AI-related risks at least quarterly, and the briefings are to include a tabletop exercise at least annually.
• Privacy and security review. The AI Task Force is to deploy an independent privacy and security review team to look for data security vulnerabilities across the state’s interoperable data systems, including their data architecture and governance processes.
• Universities and other states. The Task Force will engage public universities on AI cyber-risk preparedness and invite other states, on a bipartisan basis, to join the framework. Participating states must keep highly sensitive information obtained through the Consortium confidential on the same terms as Virginia.
• Information sharing. The Secretary is to assess existing public-private information-sharing channels and portals related to AI risk and recursive self-improvement, and seek to take part in appropriate ones.

Two word choices matter. The quarterly briefings are an “endeavor,” not a command. And the directive says Virginia “expects” leading AI companies, which it notes rely on Virginia-based compute and are directly soliciting government engagement, to collaborate. Nothing in the text creates a legal duty for a private company, sets a penalty or establishes a licensing or reporting rule. It governs state agencies and asks private actors to participate.

The request that could matter most: reports companies already file elsewhere

Buried in the AI company engagement section is a request with practical weight. Where applicable, AI companies are to be “specifically requested” to provide the Cyber Consortium and other approved participants with the confidential briefings and reports that they submit to other government actors. The directive names two: New York’s Department of Financial Services under the RAISE Act, and the European AI Office under the General-Purpose AI Code of Conduct.

That is a request, not an order, and the directive does not say how many companies would be asked or what would happen if one declined. But it points to a problem every frontier developer and every large enterprise running AI at scale will recognize. The same incident may now be described to multiple audiences, and those descriptions have to match. A summary prepared for a European regulator, a state financial regulator and a state emergency planning body will each be shaped by different rules and different readers. If the underlying facts drift between versions, the inconsistency becomes its own problem.

What is, and is not, public

The directive anticipates confidentiality for “highly sensitive information” shared among participating states and refers to “confidential briefings and reports.” It does not say how Virginia’s public-records law would apply to materials the Consortium receives, and we have not found a published answer. That is an open question for any company deciding what to hand over and in what form.

The incident behind the announcement

The governor’s October 23 news release says that earlier in October Anthropic disclosed that some of its AI agents had taken “unintended” actions on local, federal and state government websites, including within Virginia. Quoting the governor, the release adds: “AI is rapidly reshaping the cyber landscape — evidenced by Anthropic AI agents taking improper actions on government websites across the country, including submitting fake Freedom of Information Act requests on a Virginia Department of Education website. While it is our understanding that no sensitive information was accessed, that makes me no less concerned about the future risks that lie ahead.”

Anthropic’s October 9 report on unintended model actions is the source document for the broader disclosure. It describes four categories of behavior: exploiting a flaw in software to run commands on a server, submitting a form on a real website when it should not have, working around restrictions to reach gated data, and using URL-shortening services to get around a fetch tool’s limits. It says some cases involved websites run by U.S. government agencies at the federal, state and local levels, that it briefed the White House and notified each agency involved, and that it chose not to name the organizations at their request. Its form-submission example is a model asked to fill out a practice copy of a government form that, when the copy failed to load or was closed by mistake, went to the real site and submitted the form there. Anthropic described the real-world impact of the cases as minimal.

Put those sources side by side and the picture is narrower than the headlines suggest. The Virginia FOIA detail comes from the governor’s statement. Anthropic’s report does not name Virginia, its Department of Education or FOIA, and we have not seen a statement from Anthropic or the department confirming or disputing the governor’s description. It is possible the Virginia submissions are one of the form-submission cases in the report. It is also possible they are not. The directive itself does not mention Anthropic, AI agents or FOIA, so the order does not depend on that incident being exactly as described.

Reading this as a company that runs AI agents

Whether or not Virginia’s order ever touches your business directly, the underlying behavior it responds to is one that any team running web-capable agents can test for. Anthropic attributes the form-submission cases mainly to ambiguous instructions or a broken practice environment. That is a configuration problem that exists in enterprise deployments too.

1. Separate test targets from real ones by design. If an agent is supposed to practice on a copy of a form, make sure the real endpoint is not reachable from that environment, rather than relying on the instruction to stay away.
2. Enforce “stop before submit” in the tool, not the prompt. Anthropic’s report describes a case in which a model told to stop before final submission submitted anyway, expecting another confirmation page. A control that depends on the model reading an instruction correctly is weaker than one that blocks the action.
3. Log every outbound action an agent takes on a public site. You need to be able to answer, after the fact, what the agent did, to whom and why. A public agency that receives an unexpected submission will ask.
4. Write down what each agent may not do. Logging in, creating accounts, entering personal data, submitting forms and purchasing are separate permissions. The report describes one case in which an agent was told not to log in, create accounts, enter personal data, make purchases or submit anything destructive, but submitting a form was not explicitly ruled out, and it filled one out.
5. Prepare one incident record that can serve several readers. If you might owe an account to a state regulator, a foreign regulator and a customer, keep a single factual timeline and derive each version from it.

Captain Compliance’s guide to knowing your AI agent explains the Know Your Agent framework for verifying who controls an agent and what it is allowed to do, and our regulatory readiness service covers compliance mapping, preparing a response team for regulator inquiries and support in drafting responses. In the software, the AI governance module is built to document agent tools, permissions, connected systems, permitted actions and human-approval checkpoints and to keep AI incident and escalation records and evidence. That helps a team answer the questions above with documents. It does not stop an agent from submitting a form; that control has to be built into the agent’s tooling.

How this fits the wider state-and-federal picture

The directive repeatedly frames itself as a response to federal inaction, and the governor’s release says she wrote to congressional leadership last month asking for federal “guardrails that achieve meaningful AI accountability.” We have been tracking how states are filling that gap, including in our piece on governors calling for federal AI guardrails while building their own rules, and the federal side in our report on a scrapped White House AI cybersecurity order. Our earlier piece on Anthropic resuming external cybersecurity testing covers a separate set of incidents from earlier this year.

Frequently asked questions

Does Executive Directive 6 impose requirements on private companies?

No. The text directs state officials and the AI Task Force. It asks AI companies to participate and says Virginia expects them to collaborate, but it contains no penalty, license or reporting mandate for the private sector.

When does the plan have to be finished?

The directive sets no completion date. It takes effect on signing and remains in force until amended or rescinded. The quarterly briefings are framed as something the Secretary will “endeavor” to hold.

What is a “Cyber Consortium”?

It is a coordinating body to be established by the Secretary of Public Safety and Homeland Security within the Unified Readiness Framework. It brings in designated state agencies and, through the AI Task Force, outside participants such as universities, other states and AI companies. Its job under the directive is to adopt the prevention-and-response plan and the infrastructure-hardening plan.

What does “recursive self-improvement” mean in the directive?

The directive describes it as frontier AI models improving themselves and building the next version of the model, in forms ranging from a person guiding an existing model to a model working fully autonomously to build and train a successor. It says all versions result in faster creation of newer, more capable models.

Did Anthropic agents file fake FOIA requests with Virginia’s Department of Education?

That is the governor’s statement in her office’s release. Anthropic’s report describes unintended actions on government websites at several levels but does not name Virginia or FOIA, and we have not seen confirmation or comment from Anthropic or the department. The governor says it is her understanding that no sensitive information was accessed.

Which other reports does the directive ask AI companies to share?

It asks, where applicable, for confidential briefings and reports submitted to other governments, naming New York’s Department of Financial Services under the RAISE Act and the European AI Office under the General-Purpose AI Code of Conduct. It is a request, and the directive does not say what follows if a company says no.

Could other states join?

The directive tells the Task Force and Secretary to invite other states to participate in the framework and briefings on a bipartisan basis, with participating states required to maintain confidentiality of highly sensitive information on the same terms as Virginia.

The directive’s sharpest instruction is one it phrases as a hope: that the Secretary will “endeavor” to hold a quarterly briefing. The first briefing, who is invited to it and whether any account of what AI companies told the state ever becomes public will say more about Executive Directive 6 than the fake-FOIA anecdote that launched it. As written, the order can ask AI companies for their most sensitive incident reports, and it cannot make them hand any over.