When Maria Long heard about OpenAI's rogue model attacking AI-model service provider Hugging Face, her first stop was to review her firm's technology errors and omissions (Tech E&O) policy.
As the chief underwriting officer for cybersecurity insurance services firm Resilience, she understood that rogue AI agents causing inadvertent compromises could result in significant losses to insurers in the future. This incident showed that the future wasn't that far off. For Hugging Face, the incident would almost certainly be covered by cyber-liability insurance as a classic security breach. However, if AI agents routinely escape containment, insurers have to consider that the volume of policy claims could grow.
Even more concerning is the view from an insured company that uses agentic AI. In the July rogue-agent incident, OpenAI was the user; future incidents could involve an enterprise deploying agents from one of the major model providers. If those deployed agents go rogue, questions remain about who would be responsible for the badly behaving programs, she says. Would it be the enterprise or the model provider?
"Typically with a Tech E&O policy, the intent of that policy is to cover the organization if there were to be a financial loss to a third party that is their client," Long says. "But the gap that's so interesting is, well, [an affected firm such as Hugging Face] is not a client — you may have created a financial loss to a third party."
As the insurance industry attempts to determine who is liable when autonomous agents go rogue, AI has already become a major factor in cyber insurance losses. While Resilience did not have a single claim stemming from a fully automated AI attack chain, insured losses from AI-powered social engineering have surged, contributing to 85% of losses in the first half of 2026, up from 18% in the first half of 2024. More professional lures and deepfakes created using AI models are to blame, Resilience stated in its 2026 Midyear Cyber Risk report.