From the State Government edition of October 4, 2026
Iorio testimony to Vermont JITOC (Sep 30): Anthropic SLTT cyber agreement limits purpose not access, model can change without notice, liability capped
Geopolitical Insight and Education Foundation (Bennett Iorio), written testimony to Vermont JITOC · Independent policy analysis / state use of agentic AI for defensive cybersecurity · Vermont, with reference to California, Texas and other SLTT participants
- Publisher
- Vermont General Assembly (JITOC written testimony)
- Original publication
- 2026-09-30
- Source retrieved
- 2026-10-05
- Event date
- 2026-09-30
What happened
Iorio's written testimony describes Anthropic's SLTT Cyber Defense Program as $100,000 in credits over six months for defensive cybersecurity, capped at 100 governments and $15 million, with Vermont alongside California, Texas and others. He says Vermont's agreement covers Claude for Enterprise including Claude Security (a scanner) and Claude Code (an agentic coding tool that reads, writes and runs commands), so the scope is wider than scanning. His main points: the agreement limits purpose, not access; the underlying model can change without notice to the government (he reports Claude Security moving from Opus 4.8 to Mythos 5 on Aug 21 and Mythos 5.1 eleven days later); services appear to be provided as is, Claude Security is a beta service, and template liability is the greater of $1,000 or fees paid. He recommends asking for model-change notice, written scope limits, a risk assessment matched to the current configuration, an escape-scenario plan, an advance standard from the Cybersecurity Advisory Council, and publication of such agreements.
Why it matters
Gives state CIOs, CISOs and oversight committees a concrete checklist for any agentic AI tool that touches state source code, which applies to every state in the SLTT program, not just Vermont. Why now: written testimony from the Sep 30 hearing, newly retrievable and not in the archive.
Evidence and measured results
Opened the PDF over HTTPS via curl and pdftotext; confirmed the program terms, tool descriptions, model-change dates, liability language and six process recommendations as the author states them. The author notes his written text corrects three points from his oral remarks. Agenda confirms his 11:30 AM slot.
Limitations and uncertainty
Advocacy-oriented testimony from a nonprofit that says it takes no AI-developer money; several vendor and incident claims (model switches, retention policy, third-party agent incidents) are reported by the author with footnotes we did not independently verify. No measured outcomes of Vermont's use are given.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-04; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- States accepted credit-funded agentic cyber tools on template terms that limit purpose but not access, allow silent model changes, and cap liability low.
- Stakeholders
- State CISO
- State CIO
- Procurement and contracts counsel
- Cybersecurity advisory council
- Legislative oversight staff
- Discovery questions
- Are you in a vendor SLTT cyber credit program?
- Which tools are enabled: scanner only, or agentic coding tools?
- Do your terms require notice when the underlying model changes?
- What is retained by the vendor and for how long?
- Value hypothesis
- A focused contract and controls review can close model-change, retention and liability gaps before the six-month trial ends.
- Potential engagement
- Two-week agentic-tool agreement review with a written scope map and escape-scenario tabletop.
- Unsupported claims
- That Vermont's tools caused harm
- That vendor containment can be guaranteed
- That the author's third-party incident accounts are verified
- Any measured vulnerability reduction
Pre-sales engineering
Role takeaway
- Fit
- Security architecture for agentic AI tools with code-write access on state systems.
- Architecture and integration
- Isolated repos or sandboxes, scoped service accounts, action logging to SIEM, merge gates requiring human review, and model-version tracking in the CMDB.
- Prerequisites
- Inventory of repositories exposed to the tool
- Vendor data-retention terms in writing
- Current model version disclosure
- Kill-switch or credential-revocation procedure
- Constraints
- Template terms favor the vendor
- Model may change mid-trial
- Six-month credit window
- Author's vendor claims need confirmation
- Security
- Treat the tool as a privileged insider: no production secrets, revocable credentials, egress monitoring, and documented response if it acts outside scope.
- Proof of value
- Escape-scenario tabletop with measured time to revoke access
- Retention settings confirmed in writing by vendor
- Risk assessment re-run after any model change
Delivery
Role takeaway
- Work
- Convert the testimony's six process recommendations into contract clauses, a scope document, and a tested response runbook.
- Dependencies
- Vendor willingness to amend terms
- Cybersecurity advisory council schedule
- Agency developer participation
- Ownership
- State CISO, with procurement and the cybersecurity advisory council.
- Skills and adoption
- Developers and security staff need training on safe agentic-tool scoping and review of AI-generated patches.
- Governance checkpoints
- Written scope approved before use
- Model-change notice clause executed
- Risk assessment refreshed after configuration change
- Agreement published or disclosed to oversight
- Acceptance criteria
- All six recommendations documented with owners
- Credential revocation tested in under one hour
- No AI-generated patch merged without human review
- Risks
- Vendor refuses notice or retention changes
- Trial converts to paid dependency without review
- Unverified containment assumptions
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
An agentic coding tool with patch rights on state systems needs explicit read, write and execute boundaries, environment isolation, and a stop mechanism; the testimony stresses that containment needs specification and verification. Model versions can change underneath a fixed contract, so configuration management must track the model.
Governance
Who approves, reviews and stays accountable for outcomes?
Recommends standards set in advance for agreements where AI tools receive state code, notice of model changes, and routine publication of AI agreements and their authority.
Security and privacy
What data, permissions and controls need testing?
Raises vendor retention of prompts and outputs (he reports a 30-day retention policy on Mythos-class models applying even to zero-retention customers) and persistence of state source code after the trial ends. These are the author's reported facts and need vendor confirmation.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Limited; the workforce angle is that agency developers using agentic tools need clear rules on what they may point the tool at.
Procurement
What should contracts, pricing and exit terms secure?
Negotiate model-change notification, data retention and termination terms, and liability above template defaults before accepting credit-funded AI services.
Operating model
Which teams own the service once it runs?
Ask the state cybersecurity advisory body to set a standard for AI agreements touching state code, so each new trial is measured against it.
Publication history
- 2026-10-04State Government · Issue 285 resources
Stable resource ID: vermont-iorio-sltt-cyber-agreement-testimony-20260930