The technology secretary says developers review and test changes before applying them. Ballot proofreading used public information.

by Compass Vermont

State developers have used artificial intelligence to examine dozens of state applications and are working fixes into those programs through their normal review and testing process, Secretary of Digital Services Denise Reilly-Hughes said in written answers to Compass Vermont on Monday.

Her agency also helped the Secretary of State’s office use AI to proofread ballot templates before printing. A ballot template is the master layout of each ballot. That work used publicly available information, she said.

The answers add detail to a Sept. 30 legislative hearing where lawmakers questioned how Vermont authorized a free trial of Anthropic’s cybersecurity tools and what happened to code sent for review. The trial began in June and ends in December.

“The more powerful the technology, the more important it is that we understand who authorized its use,” Rep. Laura Sibilia, I-Dover, wrote in testimony for that hearing, as Compass reported.

At the hearing, Reilly-Hughes described developers submitting pieces of test and development code, with employees reviewing the results. Her written answers explain how those results are becoming software changes, and which AI tools were used.

What the Trial Has Involved

In an Oct. 2 StateScoop interview, Vermont’s chief data and AI officer, Josiah Raiche, said about 100 state developers had been trained, with about 50 more to come. He said the work had produced patches, or software fixes, for several dozen applications. Reilly-Hughes confirmed the training was part of Anthropic’s program for state and local governments.

“We have scanned dozens of applications,” she wrote. “So far, every application has had recommendations for improvements, many of which are minor.”

Those are recommendations, not a finding that every application had a confirmed security hole. Development teams handle most of them in routine maintenance, she said, and the agency does not track the number or severity of the issues centrally.

How Changes Are Checked

The AI produces suggestions outside the state’s systems. Developers review and test any change before applying it, she said.

“We do not automatically incorporate AI generated code into applications as part of this process,” Reilly-Hughes wrote. “ADS only allows ADS developers to manually administer code changes after human review.”

She said the AI tools never had real-time or automatic access to Vermont’s code base or to residents’ data. That describes a limit on access. As Compass previously reported, pieces of state code were sent to Anthropic for analysis.

Her answers did not say which applications received fixes or whether any of them hold Vermonters’ personal records.

Which AI Was Used

The hearing left open whether Vermont had used Mythos, Anthropic’s most powerful model for finding security holes, which runs Anthropic’s Claude Security scanning product.

“Vermont does not, and has never used, ‘Claude Security’ or Mythos,” she wrote.

Developers instead used Claude Code, Anthropic’s coding assistant, and were trained on two of its standard models, Opus and Sonnet. They also had access to Fable, a Mythos-class model that became available after their initial training, she said. Vermont did not restrict access to Fable, though Opus and Sonnet are faster, cheaper and better suited to most of the work, she said. Her answers did not say whether anyone used Fable on state code.

Reilly-Hughes said Opus and Sonnet retain no data, while Fable keeps limited data for up to 30 days to watch for misuse. Anthropic must notify the state if it opens retained material after a misuse flag, she said, and Vermont has received no such notice.

Anthropic’s published data policy for Claude Code lists 30-day retention as standard for business customers, with zero retention available to qualifying accounts. Reilly-Hughes’s answers did not specify Vermont’s retention agreement or account settings.

The Ballots

Reilly-Hughes said her agency used Claude Opus to check public information for the ballot-template review. The review makes sure candidates’ names are spelled correctly and appear in the correct font, and that each ballot has the right number of blank lines.

“Every election cycle this is a labor intensive, highly detailed review process that occurs in multiple rounds,” she wrote.

Raiche told StateScoop that Secretary of State staff were checking hundreds of draft ballots against a spreadsheet of about 3,000 candidates, with the printing deadline days away. The AI flagged errors it was confident about and items it wasn’t sure of. Staff then reviewed every ballot themselves, confirming the flags and looking for anything the AI missed. He said the job took three hours.

Neither official identified the election or said how many errors the tool caught.

What Comes Next

Both the Anthropic trial and the ballot work will be added to the state’s public AI inventory in its January 2027 update, Reilly-Hughes said. Vermont law requires each entry on that list to say whether the tool or its data is shared with an outside company, and to list any free products a vendor provided. Anthropic’s trial gave Vermont $100,000 worth of free use.

The agency’s written answers to lawmakers’ questions are due Oct. 7. Reilly-Hughes said she expects the Legislature to post them on the Joint Information Technology Oversight Committee’s page.