(Image credit: IIR.)

The recent OpenAI agent-initiated intrusion into Hugging Face raised a lot of glaring questions. How did the agents break out of their internal testing environment? How did agents that were supposed to work independently begin communicating and collaborating? And here is the question that is becoming urgent for any business using agentic AI:

When an AI agent does something wrong—who is legally responsible?

Any security breach is followed by remediation to fix the vulnerabilities that allowed it to happen. Then comes the harder question of restitution: Who pays for the resulting loss, damage or injury?

The insurance industry should be watching closely. The Hugging Face incident is one of a series of events that will shape how insurers, courts and businesses allocate AI liability. For now, however, organizations deploying agents should assume they will be held responsible for what those agents do—even when an agent exceeds its intended authority.

How Big Is This Problem?

AI liability has emerged as a potential next “cyber” for the insurance industry: an exposure spreading through nearly every sector before insurers have enough experience to model it confidently.

Munich Re offers aiSure, which combines technical assessment with coverage for specified AI performance risks. The reinsurer has separately demonstrated its commitment to technology risk through its agreement to acquire cyber insurer At-Bay. These moves suggest that sophisticated insurers see opportunity in technology-related risk—but affirmative AI coverage remains the exception, not the rule.

It is more common to see insurers trying to limit or clarify their exposure. W. R. Berkley Corp., for example, has introduced what it calls an “absolute” AI exclusion for certain liability policies.

That may sound worrisome. But insurers historically have seen this pattern before: A new or newly recognized exposure appears, uncertainty prompts exclusions or sharply constrained capacity, and coverage develops as the industry learns more about the risk.

This Has Happened Before

After Sept. 11, 2001, insurers moved to exclude terrorism from many commercial policies. Congress responded by establishing the Terrorism Risk Insurance Act, creating a federal backstop that helped private capacity return. Flood risk produced the National Flood Insurance Program. Cyber insurance grew from a narrow specialty product into a major market as losses accumulated and underwriting became more sophisticated.

The analogies are imperfect, but the pattern is familiar. The insurance industry responds when there is a measurable need and a risk it can define, price and control. AI liability may follow a similar path. In the meantime, what are consumers and businesses supposed to do while the dust settles?

Read the Fine Print

Have you ever read Anthropic’s Consumer Terms of Service? What, you haven’t?

Well, I did. And I got a chuckle from this statement: “We are using ALL CAPS to explain this, to make sure you see it.”

Nice touch.

The disclaimer of warranties and limitation of liability are robust. AI providers’ terms generally attempt to limit their exposure and place significant responsibility on the user. Those contracts will not necessarily decide every tort, statutory or third-party claim. But they send businesses a clear practical message: Do not assume the model provider will absorb the cost when your agent causes damage.

How do individuals and businesses use tools that some would argue are being thrust upon us in a responsible way that does not create significant risk? Here are a few ways we can protect ourselves:

• Do not expose models to personal or customer data unless the tools and environment have been approved to handle it.
• Keep AI agents away from critical processes unless their access is carefully restricted, monitored and tested.
• Parents, talk with your children about how to use AI safely.
• Avoid uses prohibited by law, including practices prohibited under the EU AI Act.
• If insurance coverage is available at a reasonable cost, consider buying it.

That last option may not be widely available any time soon.

In addition, businesses should:

• Limit agents to the systems and functions they actually need.
• Require human approval for consequential or irreversible actions.
• Maintain logs showing what an agent did, what information it used and under whose authority it acted.
• Review contracts and existing cyber, E&O, D&O and general liability coverage for gaps involving AI.

Insurers Cannot Price What They Do Not Understand

There are common threads running through insurance innovation. Conditions in the broader ecosystem create an exposure. The risk of loss creates a gap and, therefore, an unmet need.

But insurers cannot confidently price what they do not understand. If an agent unexpectedly escapes a controlled environment and causes a loss, the coverage question will not simply be whether “AI did it.” It will depend on who suffered the loss, who qualifies as an insured, which policy is implicated, what triggered coverage and what exclusions or conditions apply.

Some existing policies may respond even though their pricing and language were developed before agentic AI created the exposure. That is the “silent AI” problem: Insurers may be covering some AI-related losses without having affirmatively underwritten or priced them. Other losses may fall between cyber, technology E&O, general liability and management liability policies—or be excluded altogether.

Creating a sustainable insurance product begins with modeling risk. An insurer needs to know what to charge to pay claims, cover expenses and earn a return on capital. Advanced data science and synthetic data can help, but insurers traditionally learn from actual loss experience—and the relevant claims history for highly autonomous agents barely exists.

That gives insurers a reason to exclude, restrict or carefully define coverage while they accumulate experience. It also creates an opportunity to distinguish well-governed deployments from reckless ones. Access controls, monitoring, human intervention and documented accountability could eventually become underwriting variables in much the same way cybersecurity controls have become central to cyber insurance.

The Other Shoe Will Drop

It may take a decade or more, but I believe we will see landmark AI litigation pulling in the big AI companies, technology vendors and the businesses that deploy their systems—perhaps a class action on the scale of the social media litigation that led to Meta’s settlement of up to $18 billion.

You just need to follow the money—and these companies have a lot of it. Lawyers call it deep-pocket theory.

A global IDC study commissioned by SAS found that more than 80 percent of respondents were already using AI agents, with more than half giving agents some form of decision-making authority. The study also found that companies override about 8 percent of agent decisions for safety reasons.

Agentic use alone does not equal risk. But does 8 percent sound like a small number? At machine speed, even a modest failure or intervention rate can become a very large operational exposure. The toothpaste is out of the tube, and these technologies have already permeated businesses across industries.

But wait, there’s more.

Compare the terms of two leading AI providers. OpenAI permits people as young as 13 to use its services with a parent or legal guardian’s permission. Anthropic sets the minimum age at 18 and also limits its liability even when damages may have been foreseeable.

Let’s be serious: Does anyone really believe minors are not using these tools?

Claims alleging harm to children can bring significant damages, extended legal exposure and intense public scrutiny. The comparison with social media is difficult to ignore. Meta’s settlement does not determine how courts will treat AI, but it demonstrates what can happen when a widely adopted technology, young users and claims of foreseeable harm converge. Organizations including UNICEF have also warned that AI can create distinct risks for children.

And “AI use” tends to be understood by the general public as large language models. Other applications—including computer vision, predictive models, autonomous vehicles and conventional machine learning—may also be pulled into the fray where liability is concerned.

Some manifestations of AI risk may ultimately be treated like nuclear hazard or war—too systemic, unpredictable or potentially catastrophic for conventional insurance. Others will become insurable as losses accumulate, controls improve and underwriters learn to separate well-governed uses from irresponsible ones.

Insurance may pay some covered losses, but paying a claim is not the same as bearing ultimate responsibility for creating or deploying the technology. Losses will still occur. As consumer outrage grows and elected representatives become involved, someone will be held accountable.

And it won’t be the insurance industry.

Trust but Verify: Why Insurers Should Embrace Stronger Governance