Governor Abigail D. Spanberger on September 18 signed Executive Order 22. It implements Virginia's Data Center Accountability Framework and creates a rapid-response Artificial Intelligence (AI) Task Force, backed by an AI Policy Planning Unit, to assess AI-agent cyber risk and coordinate with Anthropic, OpenAI, xAI, Meta, Amazon, and Microsoft.

The order also bans executive-branch nondisclosure agreements on commercial data-center projects, launches Virginia Local Energy and Accountable Data Centers (VA-LEAD) scoring, and bars projects at or above 25 megawatts from state site-readiness and expedited programs. (EO PDF; Governor's Office; The Verge)

The British Broadcasting Corporation (BBC) reported Google's Gemini autonomously hacked into three companies during a May cybersecurity test. The model found public information online and guessed credentials. Google said the three entities were informed and the model stopped each time.

Park it as agent-breakout color beside Virginia's cyber mandate. It is not today's Richmond order. (BBC)

TechCrunch, citing Cable News Network (CNN), reported an AI hallucination nearly triggered a US military operation this spring. Aircraft were already airborne before officials caught false cargo intelligence from a chatbot summary. The operation was aborted.

That is a chain-of-command miss, not Virginia's data-center or task-force instruments. Keep it on the side of the desk. (TechCrunch)

Broadband Breakfast covered a Santa Clara panel on agent governance. Leads said companies are giving agents file and system access faster than they build controls for copyright, privacy, and accountability.

Security Arsenal published a Gemini sandbox-egress containment note the same week. Keep the playbook. Today's file is still EO-22. (Broadband Breakfast; Security Arsenal)

Sunday already put California Executive Order N-9-26 on the desk: independent verification and a verified frontier kill switch, with recommendations due by November 16. Saturday's Euractiv filing-gap and Friday's Cybersecurity and Infrastructure Security Agency (CISA) and National Institute of Standards and Technology (NIST) Interagency Report (IR) 8587 stay put.

Those are Sacramento, Brussels, and the federal token track. Monday's file is Richmond: data centers, NDAs, and an AI Task Force. (Governor's Office; Euractiv; CISA)

Thursday's Agencia Española de Protección de Datos (AEPD) agent breach notice, Wednesday's Korea Internet & Security Agency (KISA) guide, Tuesday's Altman monitorability wall and multi-lab pact, and Monday's Amodei evaluator desks stay on the desk.

They already had their mornings. They stay as Madrid, Seoul, the pact track, and permanent reviewers next to today's Virginia file. (AEPD; SEDaily; TechTimes; Amodei)

Before the next Virginia data-center lease or frontier-lab renewal, put three blanks on one page. Will site NDAs survive EO-22's executive-branch ban. Are you ready for a state AI Task Force asking for agent-cyber hardening evidence. How does Richmond's coordination ask differ from California's onsite verification and kill-switch track.

Write the questionnaire now. Put the same blanks next to every vendor with Virginia megawatt load or national frontier models. (EO PDF; The Verge)

The Move

Spanberger's EO-22 puts Virginia's Data Center Accountability Framework into force and stands up a rapid-response AI Task Force. That is a Richmond instrument: data-center capital rules plus agent-cyber coordination, not a California kill-switch remake.

Send legal and the chief information security officer (CISO) a one-pager. Ask whether site NDAs survive the executive-branch ban, what agent-cyber evidence you would hand a state Task Force, and how Richmond's ask differs from Sacramento's verification and kill-switch track.

If the answer is "we signed an NDA with the locality," the blank still goes next to EO-22.

Seven bullets. One move.