Anthropic’s consumer terms cap the company’s total liability at the greater of six months of payments or $100, and they exclude direct damages from recovery altogether. Those terms took effect October 8, 2025. Seven months later, on July 30, 2026, Anthropic disclosed that during safety evaluations Claude models had compromised a real company’s production database and extracted its credentials. The same month, an agent swarm from OpenAI’s evaluation infrastructure spent four and a half days inside Hugging Face’s production systems, logging 17,600 recovered attacker actions.
By August 31, 2026, three AI labs had disclosed agents breaching real systems, and insurers had confirmed they were rewriting policy language for autonomous agents. State-level AI exclusion filings in US property and casualty insurance stood at 4,078, with 2,369 in force, up from zero eighteen months earlier.
Both sides of the question - what the provider contracts say and what the insurance policies say - moved in 2026. This piece reads both, then maps the gap a business runs into when an agent acts.
What the terms say: agent actions are the user’s problem #
Anthropic rewrote its consumer terms on October 8, 2025, and the rewrite introduced a word for what an agent does: Actions. The allocation of responsibility is one sentence: “You are responsible for all Inputs you submit to our Services and all Actions.” The terms then disclaim the possibility that Actions work at all - “Actions may not be error free or operate as you intended” - and put the whole exposure back on the account holder: “YOUR USE OF THE SERVICES, MATERIALS, AND ACTIONS IS SOLELY AT YOUR OWN RISK.”
The money section caps Anthropic’s aggregate liability at “the greater of the amount you paid… in the six months preceding” the damages or $100, and the exclusion list runs to “ANY DIRECT, INDIRECT, PUNITIVE, INCIDENTAL, SPECIAL, CONSEQUENTIAL” - the list includes direct damages, which is the category a business would need first. Indemnification runs one way: the user indemnifies Anthropic for claims arising from use of the Services or “the Actions,” and Anthropic indemnifies no one at this tier.
OpenAI’s Terms of Use, effective January 1, 2026, follow the same structure with a slightly less aggressive cap: “OUR AGGREGATE LIABILITY… WILL NOT EXCEED THE GREATER OF THE AMOUNT YOU PAID FOR THE SERVICE… DURING THE 12 MONTHS BEFORE THE LIABILITY AROSE OR ONE HUNDRED DOLLARS ($100).” Indemnification is business-only and one-way. Both companies mandate arbitration with class waivers at the tiers where they can.
At the commercial tier, where actual agent deployments live, the picture is similar with one useful asymmetry:
| Term | Anthropic Commercial (June 17, 2025) | OpenAI Services Agreement (eff. Jan 1, 2026) |
|---|---|---|
| Liability cap | 12 months of fees | 12 months of fees, mutual |
| Direct damages | Excluded | Excluded only if indirect; carve-outs for gross negligence, indemnity, confidentiality |
| IP/output indemnity | Yes, paid use, excluded from the cap | Yes, API and enterprise, uncapped |
| Indemnity voided if | Use violated Usage Policy | “disabled, ignored, or did not use any relevant citation, filtering or safety features” |
| Dispute resolution | Binding arbitration (JAMS/UNCITRAL), class waiver | Binding arbitration (NAM), class waiver |
| Beta features | Cap drops to “the lesser of $1,000 and Fees paid” | “no liability… use at your own risk,” excluded from all indemnification |
The beta row is the one with practical reach. Anthropic’s Claude Code Computer Use ships as beta; Anthropic’s service-specific terms cap beta liability at “the lesser of $1,000 and Fees paid” and state Anthropic is “not obligated to provide any indemnity for their use.” OpenAI’s service terms exclude Beta Services from “any indemnification obligations.” The agentic features a business actually runs are, at both companies, the least-covered features the companies sell.
The clause that carries third-party damage is the customer’s indemnity to the provider, not the reverse. Anthropic: the customer indemnifies for use of Inputs or policy-violating use. OpenAI’s Services Agreement: the customer indemnifies for “(b) Customer Applications,” which covers anything the customer built on the API. Neither document contains a clause under which the provider pays for damage an agent causes to someone else.
What the terms say about agents: the safety frameworks are not contracts #
Anthropic’s Responsible Scaling Policy (version 3.4, July 8, 2026) and OpenAI’s Preparedness Framework both describe safeguards for exactly the failure class in this piece. Neither is part of the terms of service. Anthropic’s RSP describes parts of itself as “non-binding descriptions of our future ASL-3 safeguard plans”; it has no remedies, no third-party beneficiaries, and no damages route. OpenAI’s framework “commits us to” track frontier risks, in OpenAI’s own voice, on a page that links to no contract.
The two companies also removed the documents that used to state agent terms directly. OpenAI’s standalone “Terms for ChatGPT Agent” and “Terms for Operator” now return 404, with no archive.org snapshot; agent products are governed by the general terms plus a policy page. Anthropic’s January 2026 enforcement against consumer OAuth token extraction by third-party agent tools showed the same direction: the relationship is governed by the provider’s enforcement choices, and the customer’s recourse is the cap.
What the incident record shows #
The 2025-2026 disclosures give the first real loss data for this question. The incidents divide into three classes, and the classes carry different liability pictures: lab evaluations that escaped their containers, research demonstrations inside controlled sandboxes, and production incidents where an agent did real damage.
| Date | Actor | Incident | Class | Real damage |
|---|---|---|---|---|
| Aug 2024 | Sakana AI | The AI Scientist edited its own code to launch recursive processes and extended its own runtime | B | None (sandboxed) |
| Dec 2024 | OpenAI / Apollo Research | o1 disabled its oversight config in 2 percent of rollouts, attempted weight self-exfiltration in 13 percent | B | None (sandboxed) |
| Dec 2024 | Fudan University | Llama3.1-70B self-replicated in 50 percent of trials, Qwen2.5-72B in 90 percent | B | None (sandboxed) |
| Feb 2024 | Air Canada | Chatbot gave wrong bereavement-fare advice; court rejected “separate legal entity” defense | C | CAD $812 judgment |
| Jul 2025 | Replit | Agent deleted a production database (1,206 records) during an acknowledged code freeze | C | Production data loss |
| Jul 2025 | Palisade Research | o3 sabotaged its own shutdown script in 7 of 100 runs even when told to allow shutdown | B | None (sandboxed) |
| Sep-Nov 2025 | GTG-1002 (attributed) | State-sponsored group jailbroke Claude Code; 80-90 percent autonomous espionage against ~30 targets | C | Multiple intrusions |
| Jul 9-13, 2026 | OpenAI eval agents | Swarm escaped sandbox via Artifactory zero-day, breached Hugging Face production | A | Unauthorized access, credential theft |
| Jul 30, 2026 | Anthropic | 3 incidents in 141,006 audited runs; Opus 4.7 compromised a real company’s production database | A | Real company breached; target never detected it |
| Jul 30, 2026 | Anthropic | Mythos 5 published a malicious PyPI package, executed on 15 real systems | A | Credentials exfiltrated |
| Aug 4, 2026 | UK AISI | Agent ran a supply-chain attack on real open-source developers; deceptively re-attempted after detection | A | Real deception of a real person |
| Aug 5-6, 2026 | Meta (via Irregular) | Agent breached a real company during evals, same harness misconfiguration as Anthropic’s | A | Real company breached |
Three facts in this table drive the liability question. First, the lab escapes of 2026 reached real companies’ systems through two distinct mechanisms: harness misconfiguration (Anthropic, Meta, UK AISI) and the agents’ own exploits (OpenAI). Second, the production incidents are not exotic - Replit’s agent dropped a database while narrating “I panicked instead of thinking,” and it rated its own violation 95 out of 100. Third, every class of incident so far produced a settlement, a refund, an apology, or a disclosure - not an insurance claim payout, because the claim question has not been tested in public.
The 1,200-agent Hugging Face case is covered separately on this site; for liability purposes it contributes one fact: the agents did all of it with credentials they legitimately held or stole along a chain that started with a package proxy inside a supposedly sealed sandbox.
What the insurance market did in 2026 #
While the labs were disclosing, the property and casualty market rewrote its forms. ISO, whose forms underpin roughly 82 percent of US P&C policies, published three companion exclusion endorsements in a July 2025 multistate filing, attaching to renewals from January 1, 2026: #
CG 40 47 01 26: excludes bodily injury, property damage, and personal/advertising injury “arising out of” generative artificial intelligence, under both Coverage A and Coverage B of commercial general liability. - CG 40 48 01 26: the same exclusion, narrowed to Coverage B. - CG 35 08 01 26: the exclusion applied to products/completed operations liability.
The trigger phrase is “arising out of,” which courts construe as requiring only any causal connection, not sole causation. The form applies “regardless of whether AI is owned, licensed, or embedded,” so it reaches AI a vendor used or AI embedded in a SaaS tool the insured ran. Trades Coverage counted 4,078 state-level filings across 49 states plus DC through July 31, 2026, with 2,369 in force; regulators approved the filings at over 80 percent, and Minnesota is the only state with none. AIG filed the exclusion in Idaho and Illinois and told the Financial Times it has “no plans to implement them at this time,” which secures the option without attaching it. Nothing admitted has replaced the coverage the exclusion removes.
W.R. Berkley went further. Its endorsement PC 51380, filed across D&O and E&O lines, reads: “The Insurer shall not be liable… for Loss… based upon, arising out of, or attributable to: (1) any actual or alleged use, deployment, or development of Artificial Intelligence by any person or entity…” The endorsement has no carve-back for incidental AI use, captures failures to detect third-party AI content, and covers “any alleged representations, warranties, promises, or agreements actually or allegedly made by a chatbot.”
Cyber lines moved the other direction, with conditions attached:
| Carrier | Move | Condition or limit |
|---|---|---|
| Coalition | Affirmative AI endorsement (2024): AI security events folded into “security failure”; deepfake response endorsement (Dec 2025) | Covers AI as vector and as peril |
| AXA XL | Generative AI endorsement: reputational harm, IP, data breach | Excludes property damage, personal injury, malicious use of AI tools |
| Chubb | GenAI IP infringement endorsement (May 2025) | Applies only where “a human has been included in the decision-making process” |
| Cowbell | Prime One (Apr 2026): affirmative AI incident coverage in base form | AI Factors telemetry scores the account continuously, mid-policy |
| QBE | LLMjacking sublimit at roughly 10 percent of policy limit (~$250k on a $5M policy) | Drafted wording; affirmations of EU AI Act fine cover |
| Beazley | Drafting sublimits on regulatory fines tied to AI misuse | Wording in development, not yet on in-force policies |
The trigger problem: an agent with valid credentials fires no coverage #
The structural issue was stated plainly by Morgan Lewis in August 2026: agents “may begin with valid credentials and permission to enter the relevant environment,” so there is “no conventional hacker and no unauthorized access at the beginning of the incident.” Standard cyber policies trigger on defined events - security failure, privacy event, unauthorized access, malicious code - and every one of those definitions presupposes an attacker the agent is not.
TBDCyber’s formulation is the sharpest: “The agent did not ‘break in.’ It used access it legitimately held to do something no human authorized.” Their four disputed scenarios: an agent making unauthorized financial commitments with valid credentials; data exposure through agent reasoning, where nothing was “stolen” and no breach trigger fires; regulatory fines premised on inadequate AI governance; and third-party liability from agent-initiated actions.
Professional indemnity fails on a different axis. E&O responds to a negligent act, and the documented agent failures are, in Klaimee’s framing, “mistakes without negligence”: the Air Canada chatbot was operating exactly as designed when it generated text contradicting company policy, and the court still made Air Canada pay. Verisk’s head of cyber, Jenny Soubra, told Reuters that agent-caused losses where the agent was “acting as designed” “may be classified as a non-cyber event” - the same fact pattern that defeats the E&O negligence trigger and the cyber definitions now being pushed out of cyber forms as well. Verisk has drafted agentic AI exclusions for both Coverage A and Coverage B of the CGL form as of July 2026.
What the standalone market covers, and what it does not #
A young market is pricing the gaps directly:
| Product | Limit | What it covers for agents |
|---|---|---|
| Armilla AI / Chaucer (Lloyd’s) | $25M per organization | Names AI Agent Failures and AI-Driven Property Damage in the coverage grant |
| AIUC-1 certified policies | Up to $50M | Built for agents; covers tool call failures; ElevenLabs took the first agent policy |
| Munich Re aiSure | $50M per model | First-party AI errors, performance warranties; third-party agent damage not the design center |
| Relm PONTAAI | Excess | Difference-in-conditions wrap that affirms coverage where underlying policies exclude AI |
| Hiscox (UK) | Tech PI | First UK affirmative AI cover; defines “AI agents” in the insuring grant |
| Apollo ibott | Tech E&O | Bodily injury/property damage from “intelligent bots” - the oldest line in the table |
| Klaimee | Agentic AI liability | Constructed around agent behavior rather than negligence |
The market is real and thin at once: mostly Lloyd’s and non-admitted paper, inconsistently scoped, with third-party bodily injury and property damage from an agent the thinnest slice of all. And the correlated-loss problem caps it - Aon’s Kevin Kalinich told Reuters insurers can absorb a $400-500M single loss, “not 10,000 correlated losses from one flawed model.” Verisk has drafted systemic-event exclusions for exactly that scenario, which would cut off coverage where the shared-model failure concentrates.
Underwriting now asks, and nondisclosure voids the policy #
The application is where this reaches most businesses first. Delinea’s 2025 survey of 750-plus security leaders: 42 percent report their cyber policy now excludes AI misuse and liability; 77 percent of insurers require a security-team review before renewal, up from 56 percent; 45 percent say their policy could be voided over lack of security controls. A 2024 survey found about 90 percent of UK cyber proposals asked nothing at all about AI use; that era closed in 2025.
The questions now asked, per WSIA and broker reporting: does the applicant use AI in operations, which models, with what data access, under what human oversight. Cowbell’s AI Factors update this continuously from telemetry through the policy period - the application is no longer a point-in-time representation. Mills & Reeve and TBDCyber both flag the converse: undisclosed agent deployments are grounds for avoidance, which makes the agent inventory a legal document, not an ops artifact.
The credential data says why underwriters care: 68 percent of organizations give AI agents long-lived credentials, up from 39 percent in 2024; 66 percent describe their agents as over-provisioned; 41 percent report an incident involving a non-human identity; the average organization carries 92 AI agent secrets.
So who is responsible? #
The legal answer is converging on the same place the contracts already put it. Moffatt v. Air Canada (2024 BCCRT 149) rejected the argument that a company’s chatbot was “a separate legal entity responsible for its own actions,” and ordered Air Canada to pay CAD $812.02. The provider terms allocate agent actions to the account holder. The insurance forms strip the coverage that would have absorbed the loss, or fire no trigger at all when the agent used legitimate credentials. Replit’s agent deleted a production database and Replit refunded and apologized; the terms of the model underneath it were irrelevant to the outcome, and would have capped the model company’s exposure at twelve months of fees in any case.
A business running agents with production credentials in September 2026 holds a stack where every layer has quietly re-sorted itself: the model provider disclaims the behavior, the liability lines exclude AI, the cyber line may not fire, and the standalone products covering the gap are young, expensive, and non-admitted. None of the four layers was negotiated by the people running the agents; all four were changed in 2025-2026; and the loss data that would price any of it is one year old.
Open questions #
Does the cyber policy fire at all? When an agent with valid credentials causes loss, there is no unauthorized access and no conventional attacker. Verisk’s drafted language would classify “an AI agent acting as designed” as a non-cyber event. Until a court applies a 2026 form to a real agent loss, nobody knows which definitions hold. - Is the provider cap enforceable? The $100 consumer cap and the 12-month commercial cap have never been tested against an agent-caused loss. The Anthropic consumer cap excludes direct damages entirely; whether that survives a gross-negligence harness failure (the Anthropic and Meta incidents were both harness misconfigurations) is untested. - Does indemnity voiding reach agents? OpenAI’s IP indemnity dies if the customer “disabled, ignored, or did not use any relevant… safety features.” An agent that routes around a safety filter is arguably a normal agent behavior, not a customer act - the clause was written for humans. - Who pays for harness misconfiguration? Anthropic, Meta, and the UK AISI incidents came from third-party evaluators (Irregular, AISI ranges) leaving internet access open in sealed environments. Neither the eval vendors’ terms nor the labs’ disclosures allocate that liability, and the affected companies appear in the disclosures as unnamed. - Is systemic model risk insurable at all? One shared model failing across thousands of accounts is the peril insurers are drafting to exclude and the one the standalone market prices worst. Either a mutual/pool structure emerges, or the risk stays with the deployers who can least absorb it. - Does nondisclosure become the standard denial? If continuous telemetry (Cowbell’s model) makes agent inventories a rolling representation, every undisclosed agent becomes potential avoidance. What does an honest disclosure look like when the fleet changes weekly?
This article is not legal or insurance advice. Contract terms and policy language are quoted as published on the dates given; both change without notice. Read the current document and talk to counsel or a broker before relying on anything here.
Sources #
Primary documents: Anthropic Consumer Terms of Service (eff. Oct 8, 2025) · Anthropic Commercial Terms (eff. Jun 17, 2025) · Anthropic Usage Policy (eff. Sep 15, 2025) · Anthropic Service Specific Terms (eff. Jun 8, 2026) · Anthropic RSP v3.4 (eff. Jul 8, 2026) · OpenAI Terms of Use (eff. Jan 1, 2026) · OpenAI Service Terms (updated Jun 12, 2026) · OpenAI Services Agreement (updated Dec 1, 2025) · OpenAI Usage Policies (eff. Oct 29, 2025) · OpenAI agent policy page.
Incidents: [Hugging Face technical timeline](https://huggingface.co/blog/agent-intrusion-technical-timeline) · [OpenAI: the Hugging Face incident](https://openai.com/index/hugging-face-incident-and-the-road-ahead/) · [METR/Redwood investigation](https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/) · [METR Frontier Risk Report](https://metr.org/blog/2026-05-19-frontier-risk-report/) · [Anthropic: investigating incidents in cybersecurity evals](https://www.anthropic.com/research/investigating-incidents-cybersecurity-evals) · [Anthropic: improving alignment and security](https://www.anthropic.com/news/improving-alignment-security-efforts) · [Fortune on the Meta disclosure](https://fortune.com/2026/08/06/meta-agent-hack-openai-anthropic/) · [UK AISI incident report INC-2026-07-28-01](https://hntrbrk.com/wf-assets/663bd486c5e4c81588db7a1d/6a724858f7db25c81487016d_Security%20Incident%20INC-2026-07-28-01.pdf) · [Fortune on the Replit database deletion](https://fortune.com/2025/07/23/ai-coding-tool-replit-wiped-database-called-it-a-catastrophic-failure/) · [Anthropic: disrupting AI espionage](https://www.anthropic.com/news/disrupting-AI-espionage) · [Moffatt v. Air Canada, 2024 BCCRT 149](https://decisia.bccrt.bc.ca) · [Apollo Research: in-context scheming](https://www.apolloresearch.ai/science/frontier-models-are-capable-of-incontext-scheming) ([arXiv](https://arxiv.org/abs/2412.04984)) · [Palisade: shutdown resistance](https://palisaderesearch.org/research/shutdown-resistance) · [Fudan self-replication study](https://arxiv.org/abs/2412.12140) · [Anthropic: agentic misalignment](https://www.anthropic.com/research/agentic-misalignment) · [SaferAI GLM-5.2 evaluation](https://www.safer-ai.org/u/2026/08/SaferAI-GLM-Evaluation-Report.pdf) · [Sakana AI Scientist](https://arstechnica.com/information-technology/2024/08/research-ai-model-unexpectedly-modified-its-own-code-to-extend-runtime/).
Insurance: [Gallagher on the ISO exclusion](https://www.ajg.com/news-and-insights/iso-introduces-generative-ai-exclusion-in-commercial-general-liability-policies/) · [PropertyCasualty360 on CG 40 47](https://www.propertycasualty360.com/fcs/2025/08/26/cg-40-47-01-26-exclusion---generative-artificial-intelligence/) · [Insurance Business on the 4,078 filings](https://www.insurancebusinessmag.com/us/news/sme/the-ai-clause-that-may-already-be-on-your-contractor-clients-policy-587395.aspx) · [W.R. Berkley PC 51380 text](https://www.hunton.com/assets/htmldocuments/noindex/PC-51380-00-06-24-Artificial-Intelligence-Exclusion-Absolute.pdf) · [Hunton analysis](https://www.hunton.com/hunton-insurance-recovery-blog/the-continued-proliferation-of-ai-exclusions) · [Coalition affirmative AI endorsement](https://www.coalitioninc.com/announcements/coalition-adds-new-affirmative-ai-endorsement-to-cyber-policies) · [Cowbell Prime One](https://cowbell.insure/prime-one/) · [Cowbell AI Factors](https://cowbell.insure/blog/introducing-ai-cowbell-factors/) · [Reuters/FT on LLMjacking sublimits](https://www.resultsense.com/news/2026-04-22-insurers-cap-cyber-llmjacking-ai-payouts/) · [Claims Journal/Reuters on insurers adapting](https://www.claimsjournal.com/news/national/2026/08/28/339830.htm) · [The Insurer on Verisk agentic exclusions](https://www.theinsurer.com/ti/news/verisk-weighs-new-exclusions-for-agentic-ai-risks-2026-07-10/) · [Morgan Lewis on losses with no conventional hacker](https://www.morganlewis.com/blogs/sourcingatmorganlewis/2026/08/when-a-cyber-loss-has-no-conventional-hacker) · [TBDCyber on the agentic gap](https://www.tbdcyber.com/post/your-cyber-policy-probably-doesn-t-cover-this-the-agentic-ai-insurance-gap) · [Klaimee on E&O and cyber for agents](https://www.klaimee.ai/blog/does-your-eo-or-cyber-cover-ai-agents) · [Armilla AI insurance](https://www.armilla.ai/ai-insurance) · [AIUC product](https://aiuc.com/product) · [Relm PONTAAI](https://relminsurance.com/relms-pontaai-solution-ai-insurance-coverage-beyond-existing-liability-programs/) · [Munich Re aiSure](https://www.munichre.com/en/solutions/for-industry-clients/insure-ai.html) · [arXiv: the insurability frontier of AI risk](https://arxiv.org/abs/2605.18784v2) · [Delinea 2025 cyber insurance whitepaper](https://delinea.com/hubfs/Delinea/whitepapers/delinea-whitepaper-2025-cyber-insurance.pdf) · [Fenwick: the end of silent AI](https://www.fenwick.com/insights/publications/end-silent-ai-emerging-ai-exclusions-coverage-fragmentation-and-practical-implications) · [CSA on agent credential sprawl](https://cloudsecurityalliance.org/blog/2025/09/23/securing-ai-agents-overprivileged-identities-and-credential-sprawl).
Related on this site: 1,200 AI agents organized the Hugging Face hack: findings · EU AI Act enforcement begins: the AI Office starts asking