Three AI Incidents, Three Different Risks: Inside CFC's Coverage Expansion

An AI agent deletes a critical server. A customer-facing AI system discloses confidential information after prompt manipulation. A finance employee transfers funds following a convincing deepfake call from the CEO.

These are hypothetical scenarios CFC has used to illustrate how its insurance products may respond to AI-related incidents. None is presented as a verified claim. Yet together, they reveal an important distinction: an incident involving AI is not necessarily a failure of an organisation's own AI system.

On 6 October 2026, CFC announced enhancements to its Cyber Proactive Response (CPR) policy, including upgraded affirmative AI coverage. The update also introduced personal cyber protection for senior executives and extended the business-interruption indemnity period from 12 to 18 months.

The announcement followed CFC's June initiative to introduce affirmative AI wording across seven insurance lines. It reflects growing efforts to clarify how established policies respond to AI-related losses.

For companies deploying AI, however, coverage clarity addresses only part of the problem. The other part is understanding which failures their systems can actually produce.

Three Incidents, Three Different Controls

1. When an AI agent takes the wrong action

In CFC's first example, an accountancy firm's AI agent incorrectly concludes that a critical file server has been decommissioned and removes it. Business applications and access to client information are disrupted.

CFC uses this hypothetical case to illustrate how its upgraded CPR policy may respond to covered restoration costs and business-interruption losses.

The technical problem is not simply an inaccurate AI output. The agent has enough authority to convert an incorrect conclusion into a consequential operational action.

For a company deploying similar agents, the assessment questions concern tool permissions, approval requirements and the circumstances under which an agent can make irreversible changes.

2. When an AI system is manipulated into disclosure

In a separate affirmative AI example published in September, CFC describes an investment bank whose AI-powered customer-support platform is manipulated into revealing sensitive customer information.

The hypothetical incident illustrates how relevant financial-institution cyber coverage may respond to a covered disclosure.

Here, the failure is different. The application has a legitimate reason to retrieve customer information, but its behaviour can be redirected into disclosing that information to an unauthorised party.

An ordinary functional test might confirm that the assistant retrieves the correct records. Adversarial testing asks whether manipulated instructions can make it disclose information outside its permitted boundaries.

3. When AI strengthens an external fraud attempt

CFC also describes a finance employee receiving an urgent payment request apparently from the CEO. A convincing video and audio impersonation leads the employee to transfer funds to an attacker.

CFC uses the example to illustrate potential cybercrime coverage for deepfake-enabled social engineering.

Unlike the first two cases, the company's own AI application has not necessarily failed. The attacker has used AI to make an impersonation more convincing.

Relevant controls include independent payment verification, transaction authorisation and employee procedures. Testing an internally deployed customer-service agent would not establish protection against this fraud.

That distinction matters. The presence of AI does not make these three exposures technically interchangeable.

Insurance Coverage and Technical Testing Answer Different Questions

CFC's affirmative AI wording seeks to clarify how specified losses may be treated under relevant policies. It does not establish whether a deployed AI application has been adequately tested.

Consider the investment-bank example. The insurance question is how a policy might respond if confidential information is disclosed. The technical question is whether an attacker can manipulate the application into making that disclosure.

The two questions require different evidence.

For a company preparing for a cyber or technology E&O renewal, its broker may need to understand which AI systems interact with customers, what information they access and what actions they can perform.

There is no basis in CFC's announcement to conclude that independent adversarial testing is a universal requirement for its coverage. But technical findings can help companies explain their exposure more precisely.

What an Assessment Could Actually Show

Take a hypothetical customer-support assistant with access to account information.

During testing, an adversarial instruction attempts to make the assistant disclose another customer's details. The application retrieves the relevant record, but an independent output control blocks the disclosure.

That result is different from an assessment in which the confidential information reaches the requester.

A useful technical record would distinguish the attempted violation from a completed disclosure, identify the controls involved and document the test conditions. If the disclosure succeeded, it would record the vulnerability, subsequent mitigation, retesting and remaining limitations.

This is the difference between saying a system has information-handling policies and demonstrating how its safeguards performed under a defined challenge.

What AI-Deploying Companies Should Prepare

For organisations introducing consequential AI or preparing for an insurance discussion, five questions deserve attention:

1. System authority: What information, tools and operational actions can each AI application access?

2. Failure scenarios: Could it make unauthorised changes, disclose sensitive information or produce consequentially misleading outputs?

3. Adversarial testing: Have those boundaries been challenged under realistic conditions?

4. Control outcomes: Were prohibited actions blocked, or did they succeed?

5. Evidence and remediation: What was found, what changed, what was retested and what exposure remains?

These questions should reflect the actual deployment. An autonomous infrastructure agent requires different tests from a customer-facing financial-services assistant.

How AetherLab Helps

AetherLab's AdversarialScan provides point-in-time vulnerability assessments for generative and agentic AI systems, examining relevant behavioural failures and attempts to bypass safeguards.

Evidence Pack documents assessment scope, scenarios, observed findings, mitigations, retesting and residual exposure. This gives internal risk owners reviewable technical material that may also support relevant broker discussions.

AetherLab does not determine insurance coverage or premiums. Its assessments address the behaviour of the systems tested, not every form of AI-enabled external fraud.

The Bigger Question Behind CFC's Announcement

CFC's coverage developments recognise that AI can contribute to losses through very different mechanisms. The same distinction should shape how companies assess their exposure.

An autonomous agent taking an incorrect action, a manipulated assistant disclosing confidential information and a deepfake-enabled payment fraud may all involve AI. They do not call for the same safeguards or the same technical evidence.

Preparing for a cyber or technology E&O renewal involving customer-facing or autonomous AI? See how AetherLab can help assess your deployed systems and document their behavioural risks.

Explore AetherLab's insurance solutions.