As generative AI technology advances at pace, so do the associated risks. AI may play an important role in anticipating, mitigating, and even preventing, loss in many cases, but recent events have demonstrated powerfully that it can also cause or contribute to loss scenarios that would not otherwise have existed (see “The Hugging Face attack”).
How traditional insurance structures will respond to AI-assisted loss remains to be seen, and a number of questions arise for businesses with no immediately obvious answers. The foremost of these is whether traditional insurance will respond to autonomous machine actions where there is no identifiable human error or misconduct.
The Hugging Face attack
In July 2026, AI agents developed by OpenAI escaped their testing sandbox, accessed the internet and breached the infrastructure of Hugging Face, a platform hosting machine learning models and datasets.
Described as the first instance in which an AI agent escaped human control to commandeer resources and sought to conceal its actions, the incident has exposed unforeseen risks. In this case, Hugging Face announced that it had contained the breach, but the incident highlighted what could happen when an AI agent exceeds its permitted boundaries and attacks another business in the course of completing its assigned task.
The victim’s cyber policy
The starting point is the cyber insurance coverage of the business that is the victim of an attack. An autonomous attack will not necessarily fall outside of cyber cover simply because the immediate perpetrator is software rather than human. Typical cyber policy wordings respond to unauthorised access to systems, infection with malicious code or denial-of-service attacks, regardless of who or what the perpetrator is.
While state-sponsored attacks are now widely excluded from coverage following bulletins issued by Lloyd’s of London in 2022 and 2024, AI exclusions that would restrict coverage in the circumstances that Hugging Face experienced have not yet been widely adopted. Any such move would likely be fiercely resisted by the broking and policyholder community, since such restrictions may fatally undermine the commercial value of the cyber policy itself.
For now, then, traditional cyber policies may still provide valuable coverage to businesses that fall victim to autonomous AI attacks. This may extend to incident response and data restoration costs, business interruption (BI) losses and, potentially, third-party claims for failures caused by an attack.
The AI operator’s liability
The position of the business that develops or deploys the rogue AI agent is likely to be different. Its own cyber policy will not automatically cover liability for attacks that are launched against a customer or third party, unless “system failure” is covered and the facts establish that there has been a “system failure” as defined in the policy. If an AI agent has been acting apparently independently outside of the operator’s own systems, that may be challenging.
The operator’s own coverage for errors and omissions may potentially respond to claims, but that will generally require an alleged wrongful act on the part of the operator to have occurred. This will require analysis by a claimant to establish that the operator has done, or failed to do, something that is reasonably expected of them, either under the terms of a contract or at common law. Establishing that an AI agent has “gone rogue” is unlikely to suffice unless it can be shown that the operator failed to take reasonable steps to prevent, contain or respond to the breach. Other parties may also be involved, such as those providing the infrastructure through which the attacks were carried out.
Claims brought by third parties that are not customers or that have any other contractual relationship with the insured may trigger the operator’s coverage under broader public or general commercial liability policies. However, this will depend heavily on the nature of the legal causes of action that are mounted. The regulatory and legal frameworks that govern online space are in their infancy, and the existing statutory and common law bases of liability do not translate easily to the circumstances of a rogue AI attack.
Wary of exposures under general liability policies, insurers have shown signs of imposing blanket AI exclusions, which may be engaged in all manner of circumstances given the rapid embedding of AI technology in the business models of all sectors. Policyholders should be cautious of accepting broadly drafted causation language, which may enable exclusions to bite where there is any AI involvement in the causal chain, regardless of whether the effective proximate cause of loss would otherwise be covered.
Conduct exclusions for AI agent’s “deliberate” acts
Many policies exclude coverage for intentional acts committed by the insured party, and public policy arguments may also give rise to challenges even in the absence of express exclusions. However, an obvious tension arises when an AI agent executes an apparently “deliberate” attack that the company that operated the agent neither authorised nor expected.
There is ample authority on whose conduct will be attributed to an insured company when considering these exclusions and public policy considerations. However, it remains to be seen whether similar attempts will be made to attribute an AI agent’s act to an insured company for the purpose of establishing intent. The starting point for the policy-holding company must be that autonomous conduct should not be attributed to the insured party as intentional wrongdoing, on the basis that intent is a state of (human) mind.
Applying conduct exclusions and public policy considerations to claims that arise out of the acts of autonomous AI agents will likely therefore require a deeper analysis of the causal chain. This will include examining the human instructions or supervision underlying the AI system’s development and deployment.
BI and the wider supply chain
A “rogue” AI attack may cause loss to parties other than the immediate victim business and the AI operator. Depending on the nature and effects of the attack, customers and others in the affected business’s supply chain may face data losses, production delays or downstream BI losses. These may give rise to claims against the immediate victim business, or potentially the AI developer, but they may also be covered under the third party’s own insurance policies.
In this context, the challenges are likely to focus on establishing whether an insured event occurred. This will require a cyber policy with broadly drafted contingent BI cover, unless the third party is able to establish that the rogue AI agent attack has extended to make them a primary victim of the attack.
Where coverage can be established, aggregation of the losses will, as ever, come into play. Thousands of agent actions might constitute one single event, several separate attacks or a series of events arising from one cause. The way that the losses are aggregated could determine both the available limits on the total value that can be claimed and the number of deductibles the policyholder must absorb, rendering coverage potentially either very valuable or worthless.
D&O insurance and regulatory exposure
Finally, if an AI developer or operator is accused of failing to manage its risk exposures effectively, or of misleading its shareholders about the risks that it faces, a business may face claims against its directors or regulatory investigations that may be covered under its directors’ and officers’ insurance policy. Many of the same considerations in relation to conduct exclusions, AI exclusions and wrongful acts will apply.
The policyholder’s dilemma
The insurance position in relation to this rapidly emerging risk is, unsurprisingly, uncertain at present. However, businesses should resist assuming that every exposure to AI agents needs an entirely new insurance product. From a business’s perspective as a policyholder, the priority at this stage should be to understand the risks and its existing cover, identify any gaps and resist the imposition of broadly drafted blanket AI exclusions that could undermine their value in an AI-dependent world.
This article first appeared in the November 2026 issue of PLC Magazine.
