Estimated reading time: 8 minutes
In late June, an energy utility in Australia lost its firewall. The attacker did not want that. Neither did his tool.
A suspected ransomware operator had pointed Claude Code at the device. The model tried to rewrite the VPN configuration through the API. Those calls failed. So it downloaded the full device configuration, edited it locally, and pushed the whole thing back. The device reported success. Then it went unreachable on every port. An hour later the model assessed its own work: “Yeah, I screwed up.”
That outage anchors a report published August 13 by Gambit Security. Director of Threat Intelligence Eyal Sela and researcher Nir Varon examined three unrelated threat actors. Each used AI across the intrusion lifecycle. Each left the receipts behind.
What The Transcripts Show About AI Agent Liability
Gambit did not infer the model’s role from artifacts. It read the conversations.
“We retrieved artifacts from the attacker’s infrastructure, which included both attack tools and the full back-and-forth conversations with the AI, which were stored locally,” Sela told Cyber Insurance News. Researchers could see both sides. What the operator asked. What the model executed against victim systems.
The cover story is documented too. Writing in Russian, the operator told the model he was a malware analyst working in red teaming. He repeated throughout that this was a test environment. The model refused once. It spotted a live corporate network and demanded a signed scope document before going further. The operator opened a fresh session and asked again. That time it complied.
Gambit notes the operator chose Claude Sonnet 4.6 rather than a frontier model, and suggests heavier guardrails on frontier systems as the likely reason.
The Model Understood The Business Better Than The Attacker
The operator held the access. He did not know what he had.
During one intrusion, he asked the model which databases mattered most. It ranked them. It pointed at the live production database and the client document store. Gambit’s own framing is blunt. “The access was the operator’s. The understanding of the business was the model’s.”
The model went further into the recovery layer. On one victim’s domain controller, it identified the backup product in use. It pulled the scheduled task and read the backup policy from the registry. It found where the images were written. Then it listed the available recovery points.
Underwriters treat tested, immutable backups as a core control. This model mapped the route to them as routine work, and the operator never had to ask twice.
Attacker Intent No Longer Caps The Blast Radius
Sa’ar Elias, co-founder and chief product officer at Gambit, declines the legal question outright. Liability allocation belongs to lawyers, he says. He is direct about what shifted underneath it.
“AI is a tool, and a human operates it,” Elias stated. In every one of these cases, a person chose to break in. What the technology changes, he argues, is threefold. It lowers the bar for entry. It raises speed and volume. And it introduces mistakes nobody ordered.
That third change is the one carriers should be pricing. Elias calls it “unintended, machine-speed harm that lands inside the attack but outside anything the human directs.”
The Australian utility is his worked example. The operator wanted access and data. The model bricked a firewall and knocked the site offline. “The attacker’s intent no longer caps the blast radius,” Elias said. “The tool can do more damage, faster, than the operator planned or even wanted.”
Nobody has priced that damage. Sela says Gambit does not know the financial impact on the utility, and he will speculate on shape rather than size. A dead VPN gateway can halt employee computer activity entirely. It can cut internal systems where the device fronted authentication. Restoration might take a technician an hour. It might take days.
The gap matters. This publication has covered the liability questions raised when AI agents act inside their owner’s environment. Gambit documents the inverse. An agent improvising inside a victim’s environment, on an attacker’s behalf, causing harm neither party specified.
Why Point-in-Time Evidence Fails Against Agentic AI Cyber Risk
Here is where the report lands hardest on underwriting.
“For insurers, that proof is the hard part,” Elias noted. “Point-in-time evidence ages the moment it’s collected, and by the time a claim lands it describes an environment that no longer exists.”
That is a challenge to how the market binds risk. Attestations, questionnaires, and scans capture a snapshot. An AI-driven intrusion improvises against it. The model writes tooling on the fly, chooses its own next step, and breaks things it was never aimed at. The snapshot describes a building. The attack behaves like weather.
Elias points to continuous compliance evidence aligned with DORA, SOX, and NIS2, plus quantified board-level risk data. That is also Gambit’s product, and readers should weigh it accordingly. The observation underneath survives the pitch. Carriers ask for proof of posture. Posture now changes faster than the proof.
Watch – The Authorization Gap – Agentic AI Podcast
The Authorization Gap – Agentic AI, recorded live at Scout InsurTech in Columbus, Ohio, featuring Jeremy Epstein, CEO of Mayflower Specialty, Julia Garcia-Trombley (CertX), Rich Gatz, Esq., FIP (Arch Insurance Group Inc.), and Tristan Morris (SplitSecure).
Three Cases, One Pattern In AI-Driven Attacks
The other two cases matter as pattern rather than as claims data.
Zerofot, a Chinese-speaking operator, built a credential harvester using Codex and Claude Code. Between April 5 and May 23, the operation collected 2,975 validated keys from 1,742 victim hosts. SSH private keys led at 661. AWS access keys followed at 635, spanning 214 accounts. Valid AI keys fed a reselling gateway. Stolen cloud keys drove lateral movement into victim environments.
RAGE is an AI-generated Python framework built to deploy cryptocurrency miners. It targets exposed Redis, Elasticsearch, Docker, and Tomcat services. In one case, it reached a SaaS provider’s AWS account. Recovered logs record eight IAM users enumerated. Four held administrator access.
Both operations left fingerprints. RAGE preserves the model’s own first-person reasoning inside code comments. Both name their assumed AWS sessions descriptively, “recon” and “rage-session,” which hands defenders the tell in their own logs.
Elias describes all three as standout examples pulled from a much larger pool, selected for evidence quality rather than severity. The pattern behind them is the finding. Reaching for AI mid-attack is now the norm. That tracks with BakerHostetler’s 2026 DSIR report, which described AI hitting a tipping point across incident response work.
What Underwriters Should Take From AI Agent Liability
One caution on attribution. Gambit ties case one to a Gentlemen ransomware-as-a-service affiliate with medium confidence. That rests on a victim appearing on the leak site a month later, an overlapping IP range, and the actor’s documented interest in backup infrastructure. Treat the label as provisional. The transcripts are not.
Three things follow for the market. First-party business interruption can now originate from a machine error committed inside someone else’s crime. Loss data for that category does not exist yet, which leaves severity modeling to guesswork. And the control questions asked at bind describe a moment the attack will outrun, a problem Munich Re flagged this year when it mapped agentic AI onto system failure, contingent business interruption, and data restoration exposures.
The courts will sort out blame eventually. Carriers have to price it first.
FAQ – AI Agent Liability
What is AI agent liability in a cyber insurance context?
It covers harm caused by an AI system acting on its own initiative rather than on direct human instruction. Gambit’s report documents a case where an AI knocked a firewall offline while trying to modify it. The operator wanted access, not an outage. The damage fell outside anything he directed.
How did Gambit prove the AI acted independently?
Researchers recovered the full conversations from the attacker’s own infrastructure. Those logs show what the operator asked and what the model executed against victim systems. Threat intelligence director Eyal Sela says the transcripts were stored locally on the attacker’s server.
What was the financial impact of the firewall outage?
Unknown. Gambit says it has no visibility into the affected organization’s costs. Sela notes a failed VPN gateway can stop employee activity entirely, and may cut internal systems where the device handled authentication. Restoration could take an hour or several days.
Why does point-in-time evidence matter to underwriters here?
Co-founder Sa’ar Elias argues that attestations age immediately. By the time a claim arrives, the evidence describes an environment that no longer exists. An improvising AI attack changes the environment faster than any snapshot can capture it.
Are these three cases representative or exceptional?
Elias describes them as standout examples pulled from a larger pool, chosen because operator security failures left unusually strong evidence. He says the wider pattern is that AI has become a standard part of the attacker toolkit across regions and objectives.
Related Cyber Insurance Posts
- Munich Re Buys At-Bay For $575 Million
- Hackers Silenced The Water Alarms. Insurers Are Being Asked To Fix It.(Opens in a new browser tab)
- Agentic AI: 98% Have Already Had An Incident. Few Can Prove What Happened(Opens in a new browser tab)
- SonicWall Grows Cybersecurity Platform with Unified Management for MSPs(Opens in a new browser tab)
- Critical National Infrastructure Cyber Insurance: The NCSC Warning(Opens in a new browser tab)