From the State Government edition of October 5, 2026
At the Sep 30 hearing, Vermont's digital services secretary said the AI saw only test code and future trials will get full contract review; the signed terms and model used remain open
Vermont Agency of Digital Services and Joint Information Technology Oversight Committee (reported by Compass Vermont) · State IT / agency use of AI for defensive cybersecurity · Vermont statewide
- Publisher
- Compass Vermont
- Original publication
- 2026-09-30
- Source retrieved
- 2026-10-06
- Event date
- 2026-09-30
What happened
Compass Vermont's account of the Sep 30 JITOC hearing gives the agency's side. Secretary Denise Reilly-Hughes said Vermont signed on June 15 to Anthropic's free six-month, $100,000 evaluation (ending in December), that developers submitted pieces of test and development code rather than live systems, that no large system was reviewed in full, and that staff reviewed the AI's reports. Code did leave state computers for Anthropic's, with the state remaining administrator of its account. ADS did not treat the free evaluation as a procurement, but after consulting the Secretary of Administration said future trials will go through full contract review and this trial will be added to the annual public AI inventory. Written answers are due Oct 7. Unresolved: the signed terms (only the unsigned form is public), whether the scanner was used after Anthropic switched it to its Mythos model on Aug 21 (which affects 30-day retention), and what the trial found; the secretary had no count of systems reviewed.
Why it matters
Pairs with the legislators' memo to show both sides, and records concrete process changes (full contract review for future trials, inventory listing) that other states can adopt now. Why now: it supplies the ADS response our Oct 4 edition lacked, and the Oct 7 deadline falls this week.
Evidence and measured results
Opened the Compass Vermont post (curl, UA SLED-research-bot/1.0, BeautifulSoup extraction); article:modified_time 2026-09-30. Confirmed the June 15 signing, test-code-only description, process commitments, Oct 7 deadline and open questions, and checked the agreement description against the memo's attached form. The hearing video was not reviewed.
Limitations and uncertainty
Independent Substack reporting of testimony; ADS statements are the secretary's account and not independently verified. Compass describes the liability cap as $1,000 or 1 percent of the trial's value; the attached form says the greater of $1,000 or fees paid. Claims about Anthropic's Mythos switch and retention come from Compass's linked sources, which were not opened. No measured security outcomes.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-05; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies run free AI trials without contract review or a way to report results, which leads to oversight disputes.
- Stakeholders
- Agency digital services secretary
- CISO and development leads
- Secretary of Administration
- Legislative oversight committee
- AI inventory owner
- Discovery questions
- Do free AI trials go through contract review?
- Is every trial on your AI inventory?
- Can you say what a trial found and fixed?
- How do you track vendor model changes during a trial?
- Value hypothesis
- A free-trial intake rule and results template can reduce oversight friction and show whether a trial was worth continuing.
- Potential engagement
- Short design of a free-trial intake policy, inventory entry and results report template, piloted on one current trial.
- Unsupported claims
- That the trial found or fixed a measured number of vulnerabilities
- That only test code was shared, beyond the secretary's statement
- That state code was or was not retained
- That future contract review will resolve legislative concerns
Pre-sales engineering
Role takeaway
- Fit
- Controls and logging for AI-assisted code security review on existing development workflows.
- Architecture and integration
- Restrict submissions to non-production code, secret-scan before upload, log vendor service and model per submission, and feed findings into the vulnerability tracker.
- Prerequisites
- Repository inventory with environment tags
- Secret scanning
- Vulnerability management workflow
- AI inventory entry
- Constraints
- Testimony-only technical detail
- Vendor may change models mid-trial
- Signed terms not public
- Vermont-specific inventory law
- Security
- Treat submitted code as sensitive, confirm retention terms for the specific model used, and require human review before any patch merges.
- Proof of value
- Log shows what code was sent and to which model
- Findings tracked to remediation
- No production secrets in submissions
Delivery
Role takeaway
- Work
- Route free trials through contract review, list them on the AI inventory, and report results to oversight.
- Dependencies
- Secretary of Administration contract process
- Vendor disclosure of model and retention
- CISO findings data
- Ownership
- Agency of Digital Services with the CISO.
- Skills and adoption
- Developers need training on safe code submission and reviewing AI findings; leaders need to know trials trigger review.
- Governance checkpoints
- Contract review before trial
- Inventory listing
- Mid-trial vendor change review
- End-of-trial results report
- Acceptance criteria
- Proposed: every free trial reviewed before use
- Proposed: results report with systems reviewed and findings remediated within an agreed time
- Proposed: model and service recorded for each submission
- Risks
- Vendor model change alters retention unnoticed
- Results never measured
- Dispute over past trial continues
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
The account confirms code was processed off state systems, and that which model and service handled it may have changed mid-trial when the vendor switched its scanner. Agencies need to track model and service changes during a trial.
Governance
Who approves, reviews and stays accountable for outcomes?
Shows a quick fix under oversight pressure: full contract review for future free trials and listing the trial in the statutory AI inventory, while the dispute over whether this trial needed review remains.
Security and privacy
What data, permissions and controls need testing?
Only test and development code was reportedly shared, but code can contain embedded passwords and reveal security design; vendor retention may depend on the model used.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
State developers ran the trial and reviewed AI findings; skills and staff time for review are not quantified.
Procurement
What should contracts, pricing and exit terms secure?
The administration now commits to full contract review for future free AI trials, which other states can adopt as a rule for vendor credit programs.
Operating model
Which teams own the service once it runs?
Inventory listing and contract review become the standard path for AI trials; the agency still needs a way to report trial results, which the secretary could not yet give.
Publication history
- 2026-10-05State Government · Issue 305 resources
Stable resource ID: vermont-ads-anthropic-hearing-compass-vermont-20260930