{"resourceId":"vermont-ads-anthropic-hearing-compass-vermont-20260930","versions":[{"version":"external-651a5f68508ec8d2aec4922d3c727e06daf93934b14e0a1e982a3eab73979413","resource":{"id":"vermont-ads-anthropic-hearing-compass-vermont-20260930","title":"At the Sep 30 hearing, Vermont's digital services secretary said the AI saw only test code and future trials will get full contract review; the signed terms and model used remain open","organization":"Vermont Agency of Digital Services and Joint Information Technology Oversight Committee (reported by Compass Vermont)","sector":"State IT / agency use of AI for defensive cybersecurity","geography":"Vermont statewide","publishedAt":"2026-09-30","publicationDate":"2026-09-30","eventDate":"2026-09-30","sourceName":"Compass Vermont","sourceLabel":"Vermont Sent Pieces of Its Computer Code to an AI Company to Find Security Holes. Lawmakers Took It Up, and the Hearing Got Heated (Sep 30, 2026)","sourceUrl":"https://www.compassvermont.com/p/vermont-sent-pieces-of-its-computer","evidenceClass":"independent-reporting","outcomeClass":"mixed","topics":["governance-procurement","data-security","developers-agents"],"finding":"Compass Vermont's account of the Sep 30 JITOC hearing gives the agency's side. Secretary Denise Reilly-Hughes said Vermont signed on June 15 to Anthropic's free six-month, $100,000 evaluation (ending in December), that developers submitted pieces of test and development code rather than live systems, that no large system was reviewed in full, and that staff reviewed the AI's reports. Code did leave state computers for Anthropic's, with the state remaining administrator of its account. ADS did not treat the free evaluation as a procurement, but after consulting the Secretary of Administration said future trials will go through full contract review and this trial will be added to the annual public AI inventory. Written answers are due Oct 7. Unresolved: the signed terms (only the unsigned form is public), whether the scanner was used after Anthropic switched it to its Mythos model on Aug 21 (which affects 30-day retention), and what the trial found; the secretary had no count of systems reviewed.","sledRelevance":"Pairs with the legislators' memo to show both sides, and records concrete process changes (full contract review for future trials, inventory listing) that other states can adopt now. Why now: it supplies the ADS response our Oct 4 edition lacked, and the Oct 7 deadline falls this week.","evidence":"Opened the Compass Vermont post (curl, UA SLED-research-bot/1.0, BeautifulSoup extraction); article:modified_time 2026-09-30. Confirmed the June 15 signing, test-code-only description, process commitments, Oct 7 deadline and open questions, and checked the agreement description against the memo's attached form. The hearing video was not reviewed.","architectureImplications":"The account confirms code was processed off state systems, and that which model and service handled it may have changed mid-trial when the vendor switched its scanner. Agencies need to track model and service changes during a trial.","governanceImplications":"Shows a quick fix under oversight pressure: full contract review for future free trials and listing the trial in the statutory AI inventory, while the dispute over whether this trial needed review remains.","securityPrivacyImplications":"Only test and development code was reportedly shared, but code can contain embedded passwords and reveal security design; vendor retention may depend on the model used.","caveats":"Independent Substack reporting of testimony; ADS statements are the secretary's account and not independently verified. Compass describes the liability cap as $1,000 or 1 percent of the trial's value; the attached form says the greater of $1,000 or fees paid. Claims about Anthropic's Mythos switch and retention come from Compass's linked sources, which were not opened. No measured security outcomes.","streamIds":["state-government"],"roles":{"sales":"The useful frame is that both sides agree on using the tools and disagree on process. Vermont now says future free AI trials get full contract review and inventory listing. Discovery should ask whether a prospect has a rule for vendor-credit trials and can report what a trial found. A bounded offer is a free-trial intake policy and results template. This account cannot support claims about vulnerabilities found or prevented, since the secretary had no count yet.","engineering":"Fit is trial controls for AI code scanning: limit submissions to test and development code, scan for embedded secrets, record which vendor service and model processed each submission, and watch for vendor changes mid-trial that alter retention. Integrate findings into the existing vulnerability management workflow with human review. Constraint: no technical detail beyond testimony, so proof of value is a trial log showing what was sent, to which model, and what was fixed.","delivery":"Delivery work is putting Vermont's commitments into practice: route free trials through contract review, add them to the AI inventory, and report results to oversight with counts of systems reviewed and findings remediated. Ownership sits with the digital services agency and CISO. Acceptance criteria are proposals, such as trial results reported within an agreed time after the trial ends. Risks are vendor model changes going unnoticed and results never being measured."},"roleDetails":{"sales":{"customerProblem":"Agencies run free AI trials without contract review or a way to report results, which leads to oversight disputes.","stakeholders":["Agency digital services secretary","CISO and development leads","Secretary of Administration","Legislative oversight committee","AI inventory owner"],"discoveryQuestions":["Do free AI trials go through contract review?","Is every trial on your AI inventory?","Can you say what a trial found and fixed?","How do you track vendor model changes during a trial?"],"valueHypothesis":"A free-trial intake rule and results template can reduce oversight friction and show whether a trial was worth continuing.","potentialEngagement":"Short design of a free-trial intake policy, inventory entry and results report template, piloted on one current trial.","unsupportedClaims":["That the trial found or fixed a measured number of vulnerabilities","That only test code was shared, beyond the secretary's statement","That state code was or was not retained","That future contract review will resolve legislative concerns"]},"engineering":{"fit":"Controls and logging for AI-assisted code security review on existing development workflows.","architectureIntegration":"Restrict submissions to non-production code, secret-scan before upload, log vendor service and model per submission, and feed findings into the vulnerability tracker.","prerequisites":["Repository inventory with environment tags","Secret scanning","Vulnerability management workflow","AI inventory entry"],"constraints":["Testimony-only technical detail","Vendor may change models mid-trial","Signed terms not public","Vermont-specific inventory law"],"security":"Treat submitted code as sensitive, confirm retention terms for the specific model used, and require human review before any patch merges.","proofOfValue":["Log shows what code was sent and to which model","Findings tracked to remediation","No production secrets in submissions"]},"delivery":{"work":"Route free trials through contract review, list them on the AI inventory, and report results to oversight.","dependencies":["Secretary of Administration contract process","Vendor disclosure of model and retention","CISO findings data"],"ownership":"Agency of Digital Services with the CISO.","skillsAdoption":"Developers need training on safe code submission and reviewing AI findings; leaders need to know trials trigger review.","governanceCheckpoints":["Contract review before trial","Inventory listing","Mid-trial vendor change review","End-of-trial results report"],"acceptanceCriteria":["Proposed: every free trial reviewed before use","Proposed: results report with systems reviewed and findings remediated within an agreed time","Proposed: model and service recorded for each submission"],"risks":["Vendor model change alters retention unnoticed","Results never measured","Dispute over past trial continues"]}},"retrievedAt":"2026-10-05T22:19:41-05:00","enrichedAt":"2026-10-05T22:19:41-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"State developers ran the trial and reviewed AI findings; skills and staff time for review are not quantified.","procurementImplications":"The administration now commits to full contract review for future free AI trials, which other states can adopt as a rule for vendor credit programs.","operatingModelImplications":"Inventory listing and contract review become the standard path for AI trials; the agency still needs a way to report trial results, which the secretary could not yet give.","sourceVerification":{"responseId":"curl-compass-vt-20261005","openedUrl":"https://www.compassvermont.com/p/vermont-sent-pieces-of-its-computer","referenceExcerpt":"The Agency of Digital Services didn’t consider the free evaluation a procurement, so it didn’t run it through the state’s full contract review.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}