{"resourceId":"vermont-ads-written-answers-anthropic-trial-ballots-compass-20261006","versions":[{"version":"external-9890acd079b6dcc07b7ffbc6522d3c0cc97ec2ba8e7a7c569163d54b00d741ec","resource":{"id":"vermont-ads-written-answers-anthropic-trial-ballots-compass-20261006","title":"Vermont's digital services secretary says AI-suggested code fixes are applied only after human review and AI helped proofread ballots, but the state isn't tracking the number or severity of issues found","organization":"Vermont Agency of Digital Services (Secretary Denise Reilly-Hughes), as reported by Compass Vermont","sector":"State IT security / application maintenance and election administration support","geography":"Vermont statewide","publishedAt":"2026-10-06","publicationDate":"2026-10-06","eventDate":"2026-10-05","sourceName":"Compass Vermont","sourceLabel":"Vermont Is Using Anthropic's AI to Help Fix State Software and Proofread Ballots (Compass Vermont, Oct 6, 2026)","sourceUrl":"https://www.compassvermont.com/p/vermont-is-using-anthropics-ai-to","evidenceClass":"independent-reporting","outcomeClass":"mixed","topics":["developers-agents","data-security","governance-procurement","knowledge-work"],"finding":"In written answers to Compass Vermont on Oct 5, Secretary Reilly-Hughes said developers have 'scanned dozens of applications' with Anthropic's tools under the state and local trial (June to December) and every application had improvement recommendations, 'many of which are minor.' The agency doesn't track the number or severity of issues centrally. AI suggestions are produced outside state systems and developers review and test changes before applying them. Vermont says it has never used Claude Security or Mythos; developers used Claude Code with Opus and Sonnet and also had unrestricted access to Fable, a Mythos-class model, and the answers don't say whether Fable was used on state code. Separately, the agency used Claude Opus to check ballot templates against public candidate information; staff reviewed every ballot, and CDAIO Raiche told StateScoop the job took three hours. No error counts were given. Both uses will be added to the state's public AI inventory in January 2027, and answers to lawmakers were due Oct 7.","sledRelevance":"This is the operator's first detailed written account after the Sep 30 Vermont oversight hearing, and it shows what a state can and can't currently say about an AI security trial: the controls (human review, no live access) are described, but outcomes aren't measured. The ballot use extends state AI to election administration support.","evidence":"Opened the Compass Vermont article (curl, BeautifulSoup), which quotes the secretary's written answers and links the Oct 2 StateScoop interview and Anthropic's Claude Code data policy. Vermont Daily Chronicle republished the same text. The Vermont legislature's JITOC page did not yet show the Oct 7 answers when checked.","architectureImplications":"AI analysis runs outside state systems on code excerpts developers submit; fixes go back through normal review and testing. That keeps AI out of the production pipeline but means source code leaves the state's environment, and retention depends on model and account settings the answers didn't specify.","governanceImplications":"The trial will be disclosed in the January 2027 public inventory, which by Vermont law must note data sharing with outside companies and free vendor products ($100,000 of free use here). The secretary has said future trials will get full contract review. The lack of central tracking of findings limits what oversight bodies can verify.","securityPrivacyImplications":"Per the secretary, Opus and Sonnet retain no data while Fable keeps limited data up to 30 days for misuse monitoring, and Anthropic must notify the state before opening flagged material; Vermont has received no notice. Compass notes Anthropic's published policy lists 30-day retention as standard for business customers, and Vermont's actual retention agreement wasn't stated. The answers didn't say whether patched applications hold residents' personal records.","caveats":"Operator-reported answers relayed by a single outlet; not the formal responses to the legislature, which were due Oct 7 and weren't posted when checked. No counts of vulnerabilities, fixes, or ballot errors caught; the three-hour ballot figure comes from a separate interview and has no baseline. Whether Fable touched state code is unanswered.","streamIds":["state-government"],"roles":{"sales":"Vermont's answers show a state using AI code review with human gates but no way to show results: findings aren't counted or ranked centrally. That's a credible opening for help with measurement and disclosure, not for selling more scanning. Lead with what oversight bodies are asking for, such as the executed agreement, retention settings and a record of fixes. Don't claim the trial reduced risk or saved time; the source gives no counts, and the ballot timing has no baseline.","engineering":"The architecture keeps AI outside state systems: developers send code excerpts, get suggestions, and apply reviewed changes through normal pipelines. Engineering questions are about records and data: which model handled which code, what retention applies under the account's settings, and whether any submitted code touched systems holding personal data. A fit would be lightweight tracking that ties each AI finding to severity, the ticket and the merged fix, plus model-level access controls so a stronger model isn't used without a decision.","delivery":"Delivery should add a findings register before the trial ends in December: record each application scanned, recommendations by severity, accepted fixes and who reviewed them. That gives the January 2027 inventory entry and any legislative follow-up something to verify. Settle model access (including Fable) and confirm retention terms in writing. For the ballot use, capture flags raised, errors confirmed and misses found by staff, so the next cycle has a baseline."},"roleDetails":{"sales":{"customerProblem":"The state can't show what its AI code-review trial found or fixed, while lawmakers are asking for records.","stakeholders":["Secretary of Digital Services","Chief Data and AI Officer","Joint Information Technology Oversight Committee","Secretary of State's elections staff","Agency application owners"],"discoveryQuestions":["How many findings were confirmed, by severity, and how many were fixed?","Which model handled which code, and was Fable used on state code?","What retention setting applies to the state's account?","How many ballot errors did the AI flag that staff confirmed, and what did it miss?"],"valueHypothesis":"A findings register and disclosure package could let the state show oversight bodies what the trial did, reducing friction for future AI use.","potentialEngagement":"A short engagement to build a findings register and inventory entry for the trial before it ends in December 2026.","unsupportedClaims":["That the trial reduced security risk: no counts or severity data","That ballot proofreading caught errors or saved time against a baseline","That no state code was retained by the vendor"]},"engineering":{"fit":"Fits AI-assisted code review where suggestions are generated offline and applied through existing review and test pipelines.","architectureIntegration":"Link AI findings to issue tracking and merge records so each suggestion has a severity, a decision and a reviewer.","prerequisites":["Written retention and data-use terms for the account","List of applications scanned and their data classification","Model-access policy"],"constraints":["Code excerpts leave state systems for analysis","Vendor retention varies by model (none vs up to 30 days per the secretary)","Trial ends in December 2026"],"security":"Confirm submitted code excludes secrets and personal data, and restrict higher-capability models to approved uses.","proofOfValue":["Count confirmed vs false-positive findings on a sample of scanned applications","Verify retention settings against the vendor account configuration","Measure ballot-check flags against staff-confirmed errors in the next cycle"]},"delivery":{"work":"Create a findings register, settle model access and retention terms, and prepare the January 2027 inventory entry.","dependencies":["Development team tickets and merge records","Vendor account settings","Formal answers to the legislature (due Oct 7)"],"ownership":"Agency of Digital Services, with development teams owning fixes and the CDAIO owning the inventory entry.","skillsAdoption":"About 100 developers trained so far, with about 50 more planned; reviewers need a shared severity scale.","governanceCheckpoints":["Formal written answers delivered to JITOC","Full contract review for any follow-on trial","January 2027 AI inventory update"],"acceptanceCriteria":["Proposed: every scanned application has a recorded findings count by severity","Proposed: every applied AI-suggested change has a named human reviewer","Proposed: written confirmation of retention terms for each model used"],"risks":["Unrecorded findings leave no evidence of value","Use of a stronger model without an explicit decision","Code containing sensitive data sent outside state systems"]}},"retrievedAt":"2026-10-06T22:23:59-05:00","enrichedAt":"2026-10-06T22:23:59-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"About 100 developers have been trained with about 50 more to come (from the StateScoop interview cited in the article). Ballot proofreading kept staff reviewing every ballot, so AI added a check rather than replacing one.","procurementImplications":"A zero-dollar trial with $100,000 of free use was treated as outside full contract review; the secretary says future trials will go through it. States joining vendor trial programs should expect lawmakers to ask for the executed agreement, data-retention terms, and approvals.","operatingModelImplications":"Findings are handled by individual development teams in routine maintenance rather than tracked centrally, which suits fast remediation but leaves no enterprise record of risk reduced.","sourceVerification":{"responseId":"curl-vt-compass-answers-20261006","openedUrl":"https://www.compassvermont.com/p/vermont-is-using-anthropics-ai-to","referenceExcerpt":"We do not automatically incorporate AI generated code into applications as part of this process","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}