Loading story…
Major insurers are moving to limit their exposure to artificial intelligence (AI) failures after a series of costly and highly publicized incidents, including defamation lawsuits, financial losses from AI-generated errors, and sophisticated scams leveraging AI technologies. Insurers such as AIG, WR Berkley, and Great American are seeking regulatory approval to exclude AI-related claims from corporate policies, citing the unpredictable nature of large language models and the difficulty in quantifying liability. These moves come as enterprises rapidly adopt generative AI tools, leading to expensive mistakes and raising concerns about systemic, correlated losses that traditional underwriting cannot easily address.
Industry experts warn that the lack of clear causation between AI outputs and real-world consequences, combined with slow-moving legislation, has delayed a maturity leap in enterprise AI governance. However, the growing frequency and impact of AI-driven failures are expected to force a reset in enterprise expectations and risk management practices. As the hype around AI continues to outpace regulatory and oversight mechanisms, companies may soon face an overcorrection in how they balance model performance, safety constraints, and business speed, with insurers and regulators playing a pivotal role in shaping the future of AI risk management.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
Rather than broad exclusions, some insurers including QBE and Chubb began using endorsements and partial-coverage approaches to define narrow AI protections while excluding widespread or systemic events. This signaled a broader market shift toward ring-fencing AI risk instead of fully underwriting it.
AIG, W. R. Berkley, and Great American sought regulatory approval for policy exclusions that would limit or deny claims tied to the use or integration of AI systems such as chatbots and agents. The move reflected growing concern that AI incidents could produce large, correlated losses across many insureds.
Google was hit with a $110 million defamation lawsuit tied to allegedly harmful output from its AI Overview feature. The case highlighted how generative AI errors can create large legal liabilities for technology providers.
Engineering firm Arup lost about £20 million after criminals used deepfake technology to impersonate company executives and trick staff into transferring funds. The loss became a prominent example of AI-enabled fraud with major financial consequences.
Air Canada was required to honor a discount that its customer-service chatbot had incorrectly invented, becoming an early public example of AI-generated business liability. The incident was later cited by insurers as evidence that AI systems can create direct financial exposure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetomshardware.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations adopting artificial intelligence face mounting governance challenges, including the proliferation of unapproved 'shadow AI' tools, regulatory uncertainty, and the emergence of new risk management mechanisms. Shadow AI, where employees use unsanctioned models and tools, is responsible for a significant portion of data breaches and exposes sensitive information, as many official governance programs fail to keep pace with the speed and ease of unauthorized AI adoption. At the same time, regulatory frameworks such as the EU’s AI Act are being developed to address risks like data leaks, inaccuracies, and compliance blind spots, creating a complex environment for digital leaders who must balance innovation with strict oversight. In response to these risks, the insurance industry is beginning to develop specialized products to cover AI-related liabilities, with both established insurers and startups entering the market. The effectiveness of these insurance solutions in promoting safer AI practices remains debated, but there is potential for insurers to drive improved risk management if the market matures appropriately. The convergence of shadow AI risks, evolving regulations, and the nascent AI insurance market underscores the urgent need for organizations to implement robust, automated governance strategies that enable innovation while protecting sensitive data and ensuring compliance.
Jun 29, 2026
Enterprises are rapidly integrating artificial intelligence (AI) into their core operations, leading to a significant increase in both the scale and complexity of cybersecurity risks. Autonomous AI agents, once limited to providing suggestions, now act independently within enterprise systems, accessing sensitive data, executing transactions, and triggering downstream workflows without human oversight. These agents, often deployed by individual teams or embedded in third-party software, can inadvertently ingest confidential information, such as customer credit card data, even if the data is only briefly accessible. Unlike human users, AI agents lack contextual understanding and ethical judgment, acting continuously and at scale, which introduces a new category of 'Shadow AI' risk. Multimodal AI systems, which process multiple input streams to generate more human-like outputs, further expand the attack surface. Adversaries can exploit these systems by manipulating data inputs, such as subtly altering images or text, to deceive the AI and bypass security controls. Research has demonstrated that these attacks are not merely theoretical; adversarial manipulations can evade detection and cause significant harm, especially in critical sectors like defense, healthcare, and finance. Organizations are increasingly aware of the dangers posed by AI-augmented threats, including deepfakes and AI-driven social engineering, but many lag in implementing effective technical defenses. Surveys indicate that while a majority of firms have experienced deepfake or AI-voice fraud attempts, more than half have suffered financial losses as a result. Despite this, investment in detection and mitigation technologies remains inadequate, and many companies overestimate their preparedness. The surge in AI adoption is reflected in corporate disclosures, with over 70% of S&P 500 firms now reporting AI as a material risk, up from just 12% two years prior. Reputational and cybersecurity risks are the most frequently cited concerns, followed by legal and regulatory challenges as governments move to establish AI-specific compliance requirements. However, only a minority of corporate boards have formally integrated AI oversight into their governance structures, highlighting a gap between risk awareness and actionable governance. The lack of comprehensive frameworks for managing AI risk leaves organizations vulnerable to both technical and compliance failures. As AI becomes more deeply embedded in business processes, the need for robust governance, continuous education, and responsible-use frameworks becomes increasingly urgent. Security and governance leaders must adapt to this new frontier by developing strategies that address the unique risks posed by autonomous and multimodal AI systems. Failure to do so could result in significant financial, operational, and reputational damage as adversaries continue to exploit the evolving AI landscape.
Jun 29, 2026
Security researchers and industry experts are raising alarms about the growing use of artificial intelligence (AI) in both offensive and defensive cybersecurity operations. Attackers are leveraging AI to bypass advanced security controls, as demonstrated by a researcher who used AI to defeat an "AI-powered" web application firewall, and by the emergence of new malware that exploits AI model files and browser vulnerabilities to evade detection and exfiltrate credentials. Meanwhile, defenders are grappling with the proliferation of unsanctioned AI tools in the workplace, the challenge of auditing AI decision-making, and the surge in AI-powered bug hunting, which has led to a dramatic increase in vulnerability discoveries and bug bounty payouts. The risks are compounded by the lack of clear AI usage policies, the potential for data leaks through generative AI tools, and the difficulty in monitoring or controlling how sensitive information is processed and stored by these systems. Industry reports highlight that a significant portion of employees use unauthorized AI applications, often exposing sensitive data without IT oversight, and that prompt injection and model manipulation are now common vulnerability types. The security community is also debating the extent to which ransomware and other attacks are truly "AI-driven," with some reports criticized for overstating the role of AI in current threat activity. As organizations rush to adopt AI for efficiency and innovation, experts urge the implementation of robust governance, continuous monitoring, and red-teaming to anticipate and mitigate the evolving risks posed by both sanctioned and shadow AI systems. The rapid evolution of AI in cybersecurity is forcing a reevaluation of traditional defense models, emphasizing the need for transparency, operational oversight, and adaptive security strategies.
Jun 29, 2026