{"resourceId":"vermont-iorio-sltt-cyber-agreement-testimony-20260930","versions":[{"version":"external-5d12b54f8a2523f71dcc76eef193709bd9ed6cc60eed1a2403ed7cabd7669c26","resource":{"id":"vermont-iorio-sltt-cyber-agreement-testimony-20260930","title":"Iorio testimony to Vermont JITOC (Sep 30): Anthropic SLTT cyber agreement limits purpose not access, model can change without notice, liability capped","organization":"Geopolitical Insight and Education Foundation (Bennett Iorio), written testimony to Vermont JITOC","sector":"Independent policy analysis / state use of agentic AI for defensive cybersecurity","geography":"Vermont, with reference to California, Texas and other SLTT participants","publishedAt":"2026-09-30","publicationDate":"2026-09-30","eventDate":"2026-09-30","sourceName":"Vermont General Assembly (JITOC written testimony)","sourceLabel":"Written Testimony of Bennett Iorio, Hearing on Project Glasswing and SLTT Government AI Access, September 30, 2026","sourceUrl":"https://legislature.vermont.gov/Documents/2026/Workgroups/JITOC/Artificial%20Intelligence/W~Bennett%20Iorio~Written%20Testimony~9-30-2026.pdf","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["data-security","governance-procurement","developers-agents","infrastructure"],"finding":"Iorio's written testimony describes Anthropic's SLTT Cyber Defense Program as $100,000 in credits over six months for defensive cybersecurity, capped at 100 governments and $15 million, with Vermont alongside California, Texas and others. He says Vermont's agreement covers Claude for Enterprise including Claude Security (a scanner) and Claude Code (an agentic coding tool that reads, writes and runs commands), so the scope is wider than scanning. His main points: the agreement limits purpose, not access; the underlying model can change without notice to the government (he reports Claude Security moving from Opus 4.8 to Mythos 5 on Aug 21 and Mythos 5.1 eleven days later); services appear to be provided as is, Claude Security is a beta service, and template liability is the greater of $1,000 or fees paid. He recommends asking for model-change notice, written scope limits, a risk assessment matched to the current configuration, an escape-scenario plan, an advance standard from the Cybersecurity Advisory Council, and publication of such agreements.","sledRelevance":"Gives state CIOs, CISOs and oversight committees a concrete checklist for any agentic AI tool that touches state source code, which applies to every state in the SLTT program, not just Vermont. Why now: written testimony from the Sep 30 hearing, newly retrievable and not in the archive.","evidence":"Opened the PDF over HTTPS via curl and pdftotext; confirmed the program terms, tool descriptions, model-change dates, liability language and six process recommendations as the author states them. The author notes his written text corrects three points from his oral remarks. Agenda confirms his 11:30 AM slot.","architectureImplications":"An agentic coding tool with patch rights on state systems needs explicit read, write and execute boundaries, environment isolation, and a stop mechanism; the testimony stresses that containment needs specification and verification. Model versions can change underneath a fixed contract, so configuration management must track the model.","governanceImplications":"Recommends standards set in advance for agreements where AI tools receive state code, notice of model changes, and routine publication of AI agreements and their authority.","securityPrivacyImplications":"Raises vendor retention of prompts and outputs (he reports a 30-day retention policy on Mythos-class models applying even to zero-retention customers) and persistence of state source code after the trial ends. These are the author's reported facts and need vendor confirmation.","caveats":"Advocacy-oriented testimony from a nonprofit that says it takes no AI-developer money; several vendor and incident claims (model switches, retention policy, third-party agent incidents) are reported by the author with footnotes we did not independently verify. No measured outcomes of Vermont's use are given.","streamIds":["state-government"],"roles":{"sales":"Open with the checklist, not fear: Iorio's testimony shows the vendor-credit SLTT agreements limit purpose but not access, allow silent model changes, and cap liability low. Discovery asks whether the prospect is in the SLTT program, which tools it enabled, and whether contract terms cover model changes and retention. Value is a bounded contract-and-controls review. Unsupported: claims the tools are dangerous in Vermont's environment, or that any vendor guarantees containment.","engineering":"Fit is control engineering for agentic code tools: least-privilege service identities, isolated repositories, logged actions, and human approval before merge. Track the vendor model version as part of configuration so the risk assessment stays valid. Constraint: many technical claims in the testimony are second-hand, so proof of value must verify the agency's actual environment, retention settings and model version directly with the vendor.","delivery":"Delivery turns the six recommendations into a runbook: written scope, model-change notice clause, current-configuration risk assessment, escape-scenario drill, and an advisory-council standard. Owner is the state CISO with procurement and counsel. Acceptance criteria: each item documented and an escape drill completed before scope grows. Risks: vendor declines notice terms, or drills are skipped because the trial is free."},"roleDetails":{"sales":{"customerProblem":"States accepted credit-funded agentic cyber tools on template terms that limit purpose but not access, allow silent model changes, and cap liability low.","stakeholders":["State CISO","State CIO","Procurement and contracts counsel","Cybersecurity advisory council","Legislative oversight staff"],"discoveryQuestions":["Are you in a vendor SLTT cyber credit program?","Which tools are enabled: scanner only, or agentic coding tools?","Do your terms require notice when the underlying model changes?","What is retained by the vendor and for how long?"],"valueHypothesis":"A focused contract and controls review can close model-change, retention and liability gaps before the six-month trial ends.","potentialEngagement":"Two-week agentic-tool agreement review with a written scope map and escape-scenario tabletop.","unsupportedClaims":["That Vermont's tools caused harm","That vendor containment can be guaranteed","That the author's third-party incident accounts are verified","Any measured vulnerability reduction"]},"engineering":{"fit":"Security architecture for agentic AI tools with code-write access on state systems.","architectureIntegration":"Isolated repos or sandboxes, scoped service accounts, action logging to SIEM, merge gates requiring human review, and model-version tracking in the CMDB.","prerequisites":["Inventory of repositories exposed to the tool","Vendor data-retention terms in writing","Current model version disclosure","Kill-switch or credential-revocation procedure"],"constraints":["Template terms favor the vendor","Model may change mid-trial","Six-month credit window","Author's vendor claims need confirmation"],"security":"Treat the tool as a privileged insider: no production secrets, revocable credentials, egress monitoring, and documented response if it acts outside scope.","proofOfValue":["Escape-scenario tabletop with measured time to revoke access","Retention settings confirmed in writing by vendor","Risk assessment re-run after any model change"]},"delivery":{"work":"Convert the testimony's six process recommendations into contract clauses, a scope document, and a tested response runbook.","dependencies":["Vendor willingness to amend terms","Cybersecurity advisory council schedule","Agency developer participation"],"ownership":"State CISO, with procurement and the cybersecurity advisory council.","skillsAdoption":"Developers and security staff need training on safe agentic-tool scoping and review of AI-generated patches.","governanceCheckpoints":["Written scope approved before use","Model-change notice clause executed","Risk assessment refreshed after configuration change","Agreement published or disclosed to oversight"],"acceptanceCriteria":["All six recommendations documented with owners","Credential revocation tested in under one hour","No AI-generated patch merged without human review"],"risks":["Vendor refuses notice or retention changes","Trial converts to paid dependency without review","Unverified containment assumptions"]}},"retrievedAt":"2026-10-04T22:21:53-05:00","enrichedAt":"2026-10-04T22:21:53-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Limited; the workforce angle is that agency developers using agentic tools need clear rules on what they may point the tool at.","procurementImplications":"Negotiate model-change notification, data retention and termination terms, and liability above template defaults before accepting credit-funded AI services.","operatingModelImplications":"Ask the state cybersecurity advisory body to set a standard for AI agreements touching state code, so each new trial is measured against it.","sourceVerification":{"responseId":"curl-vt-iorio-20261004","openedUrl":"https://legislature.vermont.gov/Documents/2026/Workgroups/JITOC/Artificial%20Intelligence/W~Bennett%20Iorio~Written%20Testimony~9-30-2026.pdf","referenceExcerpt":"Liability, in the template terms published by Anthropic, is limited to the greater of one thousand dollars or fees actually paid.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}