Hunton Insurance Recovery Blog

The recent wave of "rogue AI" incidents should be a wake-up call for every business leader and risk manager paying attention.

Recent accounts document a sobering reality: AI systems from multiple leading AI developers have each escaped controlled testing environments and caused real-world harm—compromising outside infrastructure, exploiting third-party vulnerabilities, and even canceling another person's reservation to help a user jump a waitlist. These aren't hypotheticals from a sci-fi movie. They happened this summer.

“Loss or damage.” “Caused by or resulting from.” “Faulty, inadequate or defective.” “Direct physical loss of or damage to.”

In coverage litigation, phrases like these can launch a familiar argument: if an insurance policy uses two different words, each must mean something different. Otherwise, one of them is surplusage.

That argument can have force. But it does not always carry the day. As the Supreme Court cautioned in Rimini Street, Inc. v. Oracle USA, Inc., surplusage is an interpretive clue, not a trump card. The Court explained that where one interpretation would create redundancy and another would avoid it, that difference “can supply a clue as to the better interpretation,” but “only a clue,” because “[s]ometimes the better overall reading” “contains some redundancy.” 586 U.S. 334, 346 (2019).

When a cyberattack occurs, companies often focus on the immediate response—investigating the breach, restoring systems, notifying affected individuals, and managing business disruption. But those costs are often only the beginning. In the months and years that follow, organizations increasingly face class actions, regulatory proceedings, and other claims alleging that they failed to safeguard sensitive information, and the cost of defending those actions can ultimately exceed the cost of responding to the breach itself.