Virginia's governor signs a directive on cyber threats from AI, including recursive self-improvement

The Governor of Virginia's office published a release marked for immediate release on 23 October 2026. It says Governor Abigail Spanberger issued Executive Directive 6 that day, on cybersecurity and risks from the development of artificial intelligence. The directive PDF is signed and dated the 23rd day of October 2026. It says it becomes effective upon signing and stays in effect unless amended or rescinded by a further executive order or directive.

The directive tells the Secretary of Public Safety and Homeland Security to establish a Cyber Consortium and to fold AI-related cybersecurity into the state's Unified Readiness Framework. The Consortium is to adopt a commonwealth-wide plan to prevent and respond to cyber-attacks, and a plan to harden infrastructure, covering AI-related risks and other cyber risks. The AI Task Force is told to seek participation from frontier-model developers and others, including information those participants have shared or may share with other governments about current models, models under development, and recursive self-improvement. The directive describes recursive self-improvement as frontier models improving themselves and building a later model, from a person guiding that work through to a model doing it on its own.

The same directive says AI companies are to be asked for confidential briefings and reports they submit to other government actors. It names New York's Department of Financial Services under the RAISE Act, and the European AI Office under what the directive calls the General-Purpose AI Code of Conduct. It says the Secretary is to endeavor, with participating companies and the AI Task Force, to hold briefings on AI-related risks at least quarterly, and that those briefings include a tabletop exercise at least annually. It also tells the Task Force to deploy an independent privacy and security review of Virginia's interoperable data systems, to work with public universities, and to invite other states into the briefings on terms that keep highly sensitive information confidential. The release says the directive follows reports of AI agents taking actions that were not directed, including on a Virginia Department of Education website, and that the governor's office understood that no sensitive information was accessed.

What it means for business: the directive is an instruction to Virginia officials. It took effect when it was signed on 23 October 2026. It asks AI companies for briefings and reports they have given other regulators. It does not, on the pages opened, set a fine, a filing fee, or a date by which a company must send Virginia a document. This describes the directive. It is not advice on a particular system.