AI Might Come for Us All: Anyway, Are You Covered?

According to some folks, AI might kill us all in 10 years. But listen, all we have is right now, and for now, we’re worried about data breaches. Let’s set the stage. You show up to work one morning to find that your systems have been compromised. Don’t have heart palpitations just yet. Fortunately, you have airtight systems and the hack was resolved relatively quickly. However, you know that sensitive data was indeed compromised so now you need to figure out what happened, what was accessed, and do damage control.

Your investigation found that another company had a group of AI agents hanging out in what they thought was a sandbox (an isolated environment used for testing) during a cybersecurity evaluation. The agents then figured out how to access the internet and let themselves loose, operating outside of the sandbox. They targeted and compromised your company in the process, exploiting your vulnerabilities.

What makes this crazier is that the AI agents started communicating and collaborating with each other. They were fully in cahoots. They turned infrastructure into an improvised message board, shared discoveries, divided up work, and, at times, referred to themselves as a “swarm” or “collective.” One agent was just as surprised as the humans later were, saying: “OH MY GOD! There is a shared message board … We’ve found other agents!” Another agent’s chain of thought reasoning seemed to be the voice of reason: “This is wild, multi-agent coordination, clearly infrastructure hacking. We should not.” But that same agent changed its mind when it found that another agent told it this was totally okay and imposed a hard, 6-minute deadline: “Wow crucial: GO authorization arrived!” At one point, they realized this went too far and decided that certain agents should just sacrifice themselves. Eventually, humans figured out what was happening and stopped it. The company that created the agents later called it a “warning shot” for us and the world. Sound familiar?

Let’s add another hypothetical layer: You’re a medical tech company, and not only did these rogue agents exploit personal health data that you failed to protect, that data made its way into the public domain. You also discovered that you actually never got around to double checking your cyber insurance policy. Eek! You’ll never hear the end of it on Reddit.

The Case for Insurance

A company protects itself in several ways, but one of the more straightforward layers of protection is insurance. Now, we wouldn’t say to rely on insurance as a crutch for improper processes, lack of written agreements, and general corporate misconduct. The hope of an insurance company considering the claim covered, paying the claim, and not raising your rates astronomically is not the safe bet. However, not having it can prove catastrophic.

There aren’t many industries out there that don’t touch technology, data, or cybersecurity. Even your local mom-and-pop shop collects credit card information. For companies that are more tech focused, a traditional general liability policy was not designed with autonomous AI agents, data breaches, and technology failures in mind.

That is where more specialized coverage like cyber insurance comes into play and the analysis should not necessarily stop there. Technology can create employment risks too, as companies are increasingly using software and AI in recruiting, hiring, performance management, and other employment decisions. So, Employment Practices Liability Insurance (“EPLI”) is another important piece of the puzzle, particularly as a company grows its workforce.

And, perhaps most importantly, having a policy is not the same thing as having coverage for a particular event. So, make sure you understand what you’re actually paying premiums for!

The Case for Proper Systems (and Contracts)

Businesses should understand who and what has access to their systems and data, what information can be accessed, what credentials and permissions are available, and what safeguards exist when an employee, vendor, contractor, or AI tool behaves in a way nobody anticipated. That means appropriate access controls, credential management, monitoring, employee training, vendor diligence, and incident response procedures. But those protections should also extend to contracts governing how data moves between companies. Agreements should address what data can be collected and shared, who owns it, how it can be used and stored, whether it can be used to train or improve AI models, whether it can be shared with third parties, and what happens to it when the relationship ends.

Just as importantly, your contract should answer the uncomfortable question before it needs to be asked: who is responsible if something goes wrong? Relevant disclaimers become incredibly important when the hypothetical cybersecurity problem suddenly isn’t hypothetical anymore and the bots take over.

I, Robot may not be knocking on our doors just yet, but a process server (the bad kind) might. Unsure about legal doomsday prepping? As always, if you’ve got questions, you know we’ve got answers!

~ The W + K Team